6 ms·

Hi all! Discord Employee here that was involved in the remediation of this exploit! I just wanted to clarify with a timeline, and explanation as to why we had c

by jhgg 6y ago

Hi all! Discord Employee here that was involved in the remediation of this exploit! I just wanted to clarify with a timeline, and explanation as to why we had context isolation disabled! 9:21 PM on July 16, 2020 we received a very detailed report from Masato outlining this exploit. 9:34 PM: Ticket acknowledged - and we began a deploy that would disable sketchfab embeds within the app, to remediate this known attack vector. 10:00 PM: Update pushed to stable to disable all existing sketchfab embeds. Thanks to the detailed report, we were able to go from a report to a fix deployed to stable in ~40 minutes! Following that, the next day we deployed a better update as we understood more about the issue (which was the sandbox attribute on the iframe.) In addition, we also paid out $5,000 for this bounty, even though the main fault that lead to RCE was due to a bug in Electron (CVE-2020-15174) which allowed for a bypass of our CSP, by allowing the main window to be navigated to a different domain. ---- As for context isolation, a lot of the code that had been written was not compatible with contextIsolation - and required significant work to refactor. For example, due to the way that objects needed to be cloned to pass through the bridge, the internal APIs that existed needed to be entirely reworked, as they were not really compatible with this model. We began this work in April shortly after we worked out all the quirks required to upgrade to Electron 7 which is when contextBridge would be available for us to turn on contextIsolation. It was not as simple as flipping a boolean from false -> true, and required a re-work of our native modules and their internal APIs, and also doing so in a way that would be backwards & forwards compatible with the various app versions that we had shipped in the wild - in addition to dealing with some performance regressions that needed work-arounds in the new context isolated world. In August, we shipped context isolation to our Stable release channel and gave Masato the green light for disclosure - which leads us to today!

elktea 6y ago
Thanks for the explanation. Would you say security issues are the main reasons you update? I open Discord once or twice a week and I feel like there's always an update or 3 waiting.
- jhgg 6y ago
  No. The vast majority of our updates are just new features & bugfixes of existing features.
breakingcups 6y ago
Thanks for the insight, I can imagine it was quite an impressive refactoring effort! > In addition, we also paid out $5,000 for this bounty, even though the main fault that lead to RCE was due to a bug in Electron You seem to imply that because the bug was in a library that you use as opposed to code your own developers wrote, that it's gracious of you to even pay out $5000 for this bounty. Surely that's not actually what you're saying and I'm merely misunderstanding you? Regardless of who wrote the bug, Discord ships the binary and the impact of the vulnerability remains the same.
- moocowtruck 6y ago
  Surely you misheard. I'm sure they didn't say that because they ship a RCE it is someone else's fault. /s
- jhgg 6y ago
  I'm sensing a trend in the replies here, which is that this was too low a pay out, perhaps we should have a discussion about what is a worthy payout, because we based this off of what we saw other companies paying out. Our bug bounty page on H1 (invite only currently) lists critical vulnerabilities at $3,000 for a bounty, we decided to up the pay-out to $5,000 for the thorough report on the exploit - even though the vulnerability was not in our code, we paid extra (from our perspective...) because the vulnerability did after all ship in our software. I compared this to similar payouts for RCE's, for example, slack paid out $1750 for a similar RCE earlier this year, due to lack of context isolation (https://hackerone.com/reports/783877 https://hackerone.com/reports/783877) - although this did get published after we paid bounty - so it did not influence our decision. Clearly there is some discussion to be had about what is fair. For context (which might be missing), this was not a 0-click drive-by RCE, and to exploit involved 4-clicks you had to be sent the embed, (1) click the "play" button to launch the iframe [we never load iframes with 0click], (2) click play within sketch-fab to load the 3d model, (3) click a small "1", and then (4) click a "+" in the tooltip that pops up in order to trigger the exploit. I'm curious if anyone has prior art or opinions on what would be a more appropriate bounty?
  - aboringusername 6y ago
tines 6y ago
> 9:21 PM on July 16, 2020 we received a very detailed report from Masato outlining this exploit. > 9:34 PM: Ticket acknowledged - and we began a deploy that would disable sketchfab embeds within the app, to remediate this known attack vector. Did you have time to verify the claims in the bug report in this short window?
- time0ut 6y ago
  It wouldn't take long to confirm that XSS vulnerability, which, by itself, would warrant disabling embeds from that domain.
Zenbit_UX 6y ago
It's cool you guy fixed it so fast and deserve some good PR here for that but I'm surprised you paid out $5k for an RCE. That's unspeakably cheap for something that could have fucked over many of your users. I work at a very small company, so small that a security researcher would never accidentally stumble on our products to test them and if my boss asked me what would be an appropriate pay out for this, I'd say easily $25k, but more likely 30-35k if we can afford it. What you guys have accomplished here is set a precedence that you pay so little that researchers should either a) not bother with discord or b) should sell on the darknet. As a discord app user, I'm very concerned about both of those cases.
- walls 6y ago
  The bug was in Electron, not Discord. That Discord gave anything for a third-party dependency is pretty good.
  - sleepybrett 6y ago
    Given that discord chose electron as a dependency it's at least partially their responsibility. They are putting their users at risk for choosing that dependency.
  - Pfhreak 6y ago
    You own your dependencies. An end user shouldn't be expected to investigate and trust your entire supply chain, they expect you to do that. Imagine if a food company was like, "Oh, well, the marble dust sold to us as flour was from a supplier so we're not really responsible."
- PragmaticPulp 6y ago
  The issue is that the bug was technically in a 3rd-party dependency: > even though the main fault that lead to RCE was due to a bug in Electron (CVE-2020-15174) This may seem like an irrelevant detail if you’ve never operated a bug bounty program before, but you have to consider the incentives. Paying researchers for bugs in 3rd-party open source software creates misaligned incentives. If you’re a security researcher and you discover a security bug in Electron, you have two choices: 1) Follow proper protocol to create a CVE, coordinate a fix, and properly disclose the issue through appropriate channels. 2) Keep the vulnerability secret and unfixed while you shop it around bug bounty programs looking for kind companies who will pay out for 3rd-party issues. To maximize profits, it’s important that you keep the security issue unfixed and secret as long as possible while you work your way across bug bounty programs. The second option is a little publicized negative externality of bug bounty programs that don’t draw the line at 3rd-party dependencies. I’ve even had bug bounty participants beg us to not fix upstream code yet because they were still trying to collect bounties from other companies. This is also why it’s important to have your security team read every CVE immediately and check against your software. It’s also why bug bounty programs don’t pay out as much, or even at all, for security issues that come from popular 3rd-party dependencies used across the industry.
dancemethis 6y ago
bad to business when... "people unauthorized by Discord" get CE, eh? hope the OpenFeint 2.0 privacy scandal bursts soon. users had enough data stolen.
anticensor 6y ago
Can you remove the logo loop when Discord goes offline and allow it to cache at least a screenful of messages? It is pretty annoying as it is now.

by jhgg 6y ago

elktea 6y ago

Thanks for the explanation. Would you say security issues are the main reasons you update? I open Discord once or twice a week and I feel like there's always an update or 3 waiting.

jhgg 6y ago
No. The vast majority of our updates are just new features & bugfixes of existing features.

breakingcups 6y ago

Thanks for the insight, I can imagine it was quite an impressive refactoring effort! > In addition, we also paid out $5,000 for this bounty, even though the main fault that lead to RCE was due to a bug in Electron You seem to imply that because the bug was in a library that you use as opposed to code your own developers wrote, that it's gracious of you to even pay out $5000 for this bounty. Surely that's not actually what you're saying and I'm merely misunderstanding you? Regardless of who wrote the bug, Discord ships the binary and the impact of the vulnerability remains the same.

moocowtruck 6y ago
Surely you misheard. I'm sure they didn't say that because they ship a RCE it is someone else's fault. /s
jhgg 6y ago
I'm sensing a trend in the replies here, which is that this was too low a pay out, perhaps we should have a discussion about what is a worthy payout, because we based this off of what we saw other companies paying out. Our bug bounty page on H1 (invite only currently) lists critical vulnerabilities at $3,000 for a bounty, we decided to up the pay-out to $5,000 for the thorough report on the exploit - even though the vulnerability was not in our code, we paid extra (from our perspective...) because the vulnerability did after all ship in our software. I compared this to similar payouts for RCE's, for example, slack paid out $1750 for a similar RCE earlier this year, due to lack of context isolation (https://hackerone.com/reports/783877 https://hackerone.com/reports/783877) - although this did get published after we paid bounty - so it did not influence our decision. Clearly there is some discussion to be had about what is fair. For context (which might be missing), this was not a 0-click drive-by RCE, and to exploit involved 4-clicks you had to be sent the embed, (1) click the "play" button to launch the iframe [we never load iframes with 0click], (2) click play within sketch-fab to load the 3d model, (3) click a small "1", and then (4) click a "+" in the tooltip that pops up in order to trigger the exploit. I'm curious if anyone has prior art or opinions on what would be a more appropriate bounty?
- aboringusername 6y ago

tines 6y ago

> 9:21 PM on July 16, 2020 we received a very detailed report from Masato outlining this exploit. > 9:34 PM: Ticket acknowledged - and we began a deploy that would disable sketchfab embeds within the app, to remediate this known attack vector. Did you have time to verify the claims in the bug report in this short window?

time0ut 6y ago
It wouldn't take long to confirm that XSS vulnerability, which, by itself, would warrant disabling embeds from that domain.

Zenbit_UX 6y ago

It's cool you guy fixed it so fast and deserve some good PR here for that but I'm surprised you paid out $5k for an RCE. That's unspeakably cheap for something that could have fucked over many of your users. I work at a very small company, so small that a security researcher would never accidentally stumble on our products to test them and if my boss asked me what would be an appropriate pay out for this, I'd say easily $25k, but more likely 30-35k if we can afford it. What you guys have accomplished here is set a precedence that you pay so little that researchers should either a) not bother with discord or b) should sell on the darknet. As a discord app user, I'm very concerned about both of those cases.

walls 6y ago
The bug was in Electron, not Discord. That Discord gave anything for a third-party dependency is pretty good.
- sleepybrett 6y ago
  Given that discord chose electron as a dependency it's at least partially their responsibility. They are putting their users at risk for choosing that dependency.
- Pfhreak 6y ago
  You own your dependencies. An end user shouldn't be expected to investigate and trust your entire supply chain, they expect you to do that. Imagine if a food company was like, "Oh, well, the marble dust sold to us as flour was from a supplier so we're not really responsible."
PragmaticPulp 6y ago
The issue is that the bug was technically in a 3rd-party dependency: > even though the main fault that lead to RCE was due to a bug in Electron (CVE-2020-15174) This may seem like an irrelevant detail if you’ve never operated a bug bounty program before, but you have to consider the incentives. Paying researchers for bugs in 3rd-party open source software creates misaligned incentives. If you’re a security researcher and you discover a security bug in Electron, you have two choices: 1) Follow proper protocol to create a CVE, coordinate a fix, and properly disclose the issue through appropriate channels. 2) Keep the vulnerability secret and unfixed while you shop it around bug bounty programs looking for kind companies who will pay out for 3rd-party issues. To maximize profits, it’s important that you keep the security issue unfixed and secret as long as possible while you work your way across bug bounty programs. The second option is a little publicized negative externality of bug bounty programs that don’t draw the line at 3rd-party dependencies. I’ve even had bug bounty participants beg us to not fix upstream code yet because they were still trying to collect bounties from other companies. This is also why it’s important to have your security team read every CVE immediately and check against your software. It’s also why bug bounty programs don’t pay out as much, or even at all, for security issues that come from popular 3rd-party dependencies used across the industry.

dancemethis 6y ago

bad to business when... "people unauthorized by Discord" get CE, eh? hope the OpenFeint 2.0 privacy scandal bursts soon. users had enough data stolen.

anticensor 6y ago

Can you remove the logo loop when Discord goes offline and allow it to cache at least a screenful of messages? It is pretty annoying as it is now.