[HN Gopher] How to gain code execution on hundreds of millions o...
___________________________________________________________________
How to gain code execution on hundreds of millions of people and
popular apps
Author : xyzeva
Score : 105 points
Date : 2025-02-28 21:05 UTC (1 hours ago)
(HTM) web link (kibty.town)
(TXT) w3m dump (kibty.town)
| oguz-ismail wrote:
| Why is this article in all lowercase?
| spudlyo wrote:
| Why does it use Neko the cursor chasing cat? Why the goth color
| scheme? These are _stylistic_ choices, there is no explaining
| them.
| nickthegreek wrote:
| woah, the cat chases your taps on mobile!
| nkrisc wrote:
| Thankfully there is reader mode. That dumb cat is so
| obnoxious on mobile.
| jpbastyr wrote:
| just the style of their blog
| nickthegreek wrote:
| it's a blog. people regularly use their personal sites to write
| in a tone and format that they are fond of. i only normally
| feel like i see this style from people who were on the internet
| in the 90s. i'd imagine we would see it even more if phones and
| auto correct didn't enforce a specific style. imagine being a
| slave to the shift key. it can't even fight back! i'm more
| upset the urls aren't actually clickable links.
| edm0nd wrote:
| its cool. not everything has to be typed in a "normal" way.
| AndrewStephens wrote:
| why do the stars shine? why does rain fall from the sky? using
| upper case is just a social convention - throw off your chains.
| QuadmasterXLII wrote:
| Finding an RCE for every computer running cursor is cool, and
| typing in all lowercase isn't that cool. Finding an RCE on
| millions of computers has much much higher thermal mass than
| typing quirks, so the blog post makes typing in all lowercase
| cool.
| ge96 wrote:
| the cat chase cursor thing is great
| davej wrote:
| Dave here, founder of ToDesktop. I've shared a write-up:
| https://www.todesktop.com/blog/posts/security-incident-at-to...
|
| This vulnerability was genuinely embarrassing, and I'm sorry we
| let it happen. After thorough internal and third-party audits,
| we've fundamentally restructured our security practices to ensure
| this scenario can't recur. Full details are covered in the linked
| write-up. Special thanks to Eva for responsibly reporting this.
| spudlyo wrote:
| > cannot happen again.
|
| Hubris. Does not inspire confidence.
|
| > We resolved the vulnerability within 26 hours of its initial
| report, and additional security audits were completed by
| February 2025.
|
| After reading the vulnerability report, I am impressed at how
| quickly you guys jumped on the fix, so kudos. Did the security
| audit lead to any significant remediation work? If you weren't
| following PoLP, I wonder what else may have been overlooked?
| davej wrote:
| Fair point. Perhaps better phrased as "to ensure this
| scenario can't recur.". I'll edit my post.
|
| Yes, we re-architected our build container as part of
| remediation efforts, it was quite significant.
| abhiaagarwal wrote:
| Based on the claims on the blog, it feels reasonable to say
| that this "cannot" occur again.
| edm0nd wrote:
| how much of a bounty was paid to Eva for this finding?
| oguz-ismail wrote:
| 0$ and he earned every cent
| rvz wrote:
| My goodness. So much third-party risk upon risk and lots of
| external services opening up this massive attack surface and
| introducing this RCE vulnerability.
|
| From an Electron bundler service, to sourcemap extraction and now
| an exposed package.json with the container keys to deploy any app
| update to anyone's machine.
|
| This isn't the only one, the other day Claude CLI got a full
| source code leak via the same method from its sourcemaps being
| exposed.
|
| But once again, I now know why the entire Javascript / TypeScript
| ecosystem is beyond saving given you can pull the source code out
| of the sourcemap and the full credentials out of a deployed
| package.json.
| XorNot wrote:
| > But once again, I now know why the entire Javascript /
| TypeScript ecosystem is beyond saving given you can pull the
| source code out of the sourcemap and the full credentials out
| of a deployed package.json.
|
| You've always been able to do the first thing though: the only
| thing you can do is obfuscate the source map, but it's not like
| that's a substantial slowdown when you're hunting for
| authentication points (identify API URLs, work backwards).
|
| And things like credentials in package.json is just a sickness
| which is global to computing right now: we have so many ways
| you can deploy credentials, basically 0 common APIs which
| aren't globals (files or API keys) and even fewer security
| tools which acknowledge the real danger (protecting me from my
| computers system files is far less valuable then protecting me
| from code pretending to be me as my own user - where all the
| _real_ valuable data already is).
|
| Basically I'm not convinced our security model has ever truly
| evolved beyond the 1970s where the danger was "you damage the
| expensive computer" rather then "the data on the computer is
| worth orders of magnitude more then the computer".
| GuestFAUniverse wrote:
| " please do not harass these companies or make it seem like it's
| their fault, it's not. it's todesktop's fault if anything) "
|
| I don't get it. Why would it be "todesktop's fault", when all the
| mentioned companies allowed to push updates?
|
| I had these kind of discussions with naive developers giving
| _full access_ to GitHub orgs to various 3rd party apps -- that's
| never right!
| asciii wrote:
| > i wanted to get on the machine where the application gets built
| and the easiest way to do this would be a postinstall script in
| package.json, so i did that with a simple reverse shell payload
|
| From ToDesktop incident report,
|
| > This leak occurred because the build container had broader
| permissions than necessary, allowing a postinstall script in an
| application's package.json to retrieve Firebase credentials. We
| have since changed our architecture so that this can not happen
| again, see the "Infrastructure and tooling" and "Access control
| and authentication" sections above for more information about our
| fixes.
|
| I'm curious to know what the trial/error here was to get their
| machine to spit out the build or if it was in one-shot
| giantg2 wrote:
| With rhe number of dependencies and dependency trees going
| multiple levels deep? Third party risk is the largely unaddressed
| elephant in the room that companies don't care about.
___________________________________________________________________
(page generated 2025-02-28 23:00 UTC)