My browser got hacked and it cost me $2,000

Summary

In this video, the presenter discusses a security vulnerability in the Arc browser, exploited by hacker Eva, allowing arbitrary JavaScript execution using only a user ID. The flaw was due to improper permissions in Firebase's Firestore database. After Eva's discovery, the browser company responded quickly, patched the issue, and increased the bounty from $2,000 to $20,000. The video also commends the company's transparency and commitment to improving security.

Takeaways

• 🌐 The speaker uses a unique browser called Arc, which is Chrome-based but with a different workflow.
• 👨‍💻 Hacker Eva exploited a vulnerability in Arc's use of Firebase, allowing her to run arbitrary JavaScript on the speaker's browser.
• 🔑 A user's ID was all that was needed to exploit the browser, which was obtained through a referral link.
• 🛠️ The exploit involved Arc Boosts, a feature that allows users to customize websites with custom CSS and JavaScript.
• 🔒 The security flaw was due to improper permissions settings in Firebase, which did not restrict the Creator ID field properly.
• 💸 The initial bounty offered by Arc for this exploit was $2,000, which the speaker considered insultingly low and decided to match.
• 📈 In response to the incident, Arc increased the bounty to $20,000 and offered Eva a job.
• 🔄 Arc committed to moving off Firebase for new features and conducting an internal audit of their Firebase ACL rules.
• 🔄 The company also planned to conduct external security audits and start a bug bounty program to address further vulnerabilities.
• 📢 The speaker publicly acknowledged the issue and praised Eva's work in making the web safer.

The video is abnormal, and we are working hard to fix it.
Please replace the link and try again.