5 ms·

Thanks for the insight, I can imagine it was quite an impressive refactoring effort! > In addition, we also paid out $5,000 for this bounty, even though the m

Thanks for the insight, I can imagine it was quite an impressive refactoring effort! > In addition, we also paid out $5,000 for this bounty, even though the main fault that lead to RCE was due to a bug in Electron You seem to imply that because the bug was in a library that you use as opposed to code your own developers wrote, that it's gracious of you to even pay out $5000 for this bounty. Surely that's not actually what you're saying and I'm merely misunderstanding you? Regardless of who wrote the bug, Discord ships the binary and the impact of the vulnerability remains the same.

moocowtruck 6y ago
Surely you misheard. I'm sure they didn't say that because they ship a RCE it is someone else's fault. /s
jhgg 6y ago
I'm sensing a trend in the replies here, which is that this was too low a pay out, perhaps we should have a discussion about what is a worthy payout, because we based this off of what we saw other companies paying out. Our bug bounty page on H1 (invite only currently) lists critical vulnerabilities at $3,000 for a bounty, we decided to up the pay-out to $5,000 for the thorough report on the exploit - even though the vulnerability was not in our code, we paid extra (from our perspective...) because the vulnerability did after all ship in our software. I compared this to similar payouts for RCE's, for example, slack paid out $1750 for a similar RCE earlier this year, due to lack of context isolation (https://hackerone.com/reports/783877 https://hackerone.com/reports/783877) - although this did get published after we paid bounty - so it did not influence our decision. Clearly there is some discussion to be had about what is fair. For context (which might be missing), this was not a 0-click drive-by RCE, and to exploit involved 4-clicks you had to be sent the embed, (1) click the "play" button to launch the iframe [we never load iframes with 0click], (2) click play within sketch-fab to load the 3d model, (3) click a small "1", and then (4) click a "+" in the tooltip that pops up in order to trigger the exploit. I'm curious if anyone has prior art or opinions on what would be a more appropriate bounty?
- aboringusername 6y ago
  The questions you need to ask are what is the cost of the alternative? What is the cost in the exploit being used in the wild? What is the cost of the PR shitstorm that would come your way? How much business could you lose? Customer confidence? Is this an exploit that could be devastating to your continued operations? Would it lead to legal action? What are your duties to inform customers/users/legal bodies? Will there be any fines involved? You may need to retain an expert PR firm to handle the communication to the world to put a good spin on the story, another cost. Did you breach GDPR? Does the data that could have been leaked reveal business practices you'd rather keep secret? Is there any kind of internal risk of leakage? How far does the exploit go? Can it be combined with other exploits that could be used to gain access to internal systems? The industry has collectively decided that exploits have a value and I'm not sure these factors are taken into account. You should look at examples of companies that have suffered an attack and look the damaged caused (for example, Experian, Blackbaud come to mind) to understand the impact it can have. How much does it cost to have a CEO tweet the stock price is "too high imo" and causes a dip? That may cost him potential investors to think again. Of course, you can't know that person who was just about to give you $50,000 worth of business decided not to because of how you handled the situation but it's always a possibility. I know I've made (small) decisions like this because I didn't like how it was handled or didn't agree with some of the details, and I no longer consider myself a possible customer as a result.
- ve55 6y ago
  The reason I'd personally say it's unfair is because Discord should do their own fair calculations, not just copy what another low-paying company pay may have given before. Discord is valued at several billion dollars, and their last funding round was over a hundred million. They are a key component in the lives of at least a hundred million people. Given this, $5,000 is, in my opinion, negligible, and the proper payout would have been at least double. Given that Discord permanently stores so many chat logs, personal information, analytics, etc, there should be no higher priority than maximizing security and user trust, and $5K would make me, as a potential user, think it's a second priority.

moocowtruck 6y ago

Surely you misheard. I'm sure they didn't say that because they ship a RCE it is someone else's fault. /s

jhgg 6y ago

I'm sensing a trend in the replies here, which is that this was too low a pay out, perhaps we should have a discussion about what is a worthy payout, because we based this off of what we saw other companies paying out. Our bug bounty page on H1 (invite only currently) lists critical vulnerabilities at $3,000 for a bounty, we decided to up the pay-out to $5,000 for the thorough report on the exploit - even though the vulnerability was not in our code, we paid extra (from our perspective...) because the vulnerability did after all ship in our software. I compared this to similar payouts for RCE's, for example, slack paid out $1750 for a similar RCE earlier this year, due to lack of context isolation (https://hackerone.com/reports/783877 https://hackerone.com/reports/783877) - although this did get published after we paid bounty - so it did not influence our decision. Clearly there is some discussion to be had about what is fair. For context (which might be missing), this was not a 0-click drive-by RCE, and to exploit involved 4-clicks you had to be sent the embed, (1) click the "play" button to launch the iframe [we never load iframes with 0click], (2) click play within sketch-fab to load the 3d model, (3) click a small "1", and then (4) click a "+" in the tooltip that pops up in order to trigger the exploit. I'm curious if anyone has prior art or opinions on what would be a more appropriate bounty?

aboringusername 6y ago
The questions you need to ask are what is the cost of the alternative? What is the cost in the exploit being used in the wild? What is the cost of the PR shitstorm that would come your way? How much business could you lose? Customer confidence? Is this an exploit that could be devastating to your continued operations? Would it lead to legal action? What are your duties to inform customers/users/legal bodies? Will there be any fines involved? You may need to retain an expert PR firm to handle the communication to the world to put a good spin on the story, another cost. Did you breach GDPR? Does the data that could have been leaked reveal business practices you'd rather keep secret? Is there any kind of internal risk of leakage? How far does the exploit go? Can it be combined with other exploits that could be used to gain access to internal systems? The industry has collectively decided that exploits have a value and I'm not sure these factors are taken into account. You should look at examples of companies that have suffered an attack and look the damaged caused (for example, Experian, Blackbaud come to mind) to understand the impact it can have. How much does it cost to have a CEO tweet the stock price is "too high imo" and causes a dip? That may cost him potential investors to think again. Of course, you can't know that person who was just about to give you $50,000 worth of business decided not to because of how you handled the situation but it's always a possibility. I know I've made (small) decisions like this because I didn't like how it was handled or didn't agree with some of the details, and I no longer consider myself a possible customer as a result.
ve55 6y ago
The reason I'd personally say it's unfair is because Discord should do their own fair calculations, not just copy what another low-paying company pay may have given before. Discord is valued at several billion dollars, and their last funding round was over a hundred million. They are a key component in the lives of at least a hundred million people. Given this, $5,000 is, in my opinion, negligible, and the proper payout would have been at least double. Given that Discord permanently stores so many chat logs, personal information, analytics, etc, there should be no higher priority than maximizing security and user trust, and $5K would make me, as a potential user, think it's a second priority.