21–30 of 55 posts
I have no idea if they fixed this and they gave me a t-shirt.
Sendgrid allowed attackers to social engineer control of my company's account and intercept password resets, despite an explicit warning from us a week prior (we received a chat transcript of the failed attempt and let them know that it was not us and someone was actively trying to social engineer access to our account). Then they had the gall to try to convince me on the phone that it must have been my fault (after…
It's just me, or $10k is far from being generous?
Honest question: Do bug bounties with such low bounties really do more good than harm? A bug bounty incentivizes people to look for bugs. But when you find an interesting bug like this you have the option of either having the possibility of making millions from the social engineering possibilities alone, or claiming the bug bounty and get $10k. Of course claiming the bounty is the moral thing to do, but some people w…
There isn't really a market for most XSS, CSRF or even RCEs bugs for web properties. Getting the bounty payout for a bug from the owner is often the best deal available. I think the only exception to the no-market situation is browser RCEs and smart phone OS jailbreaks.
This is a lot like a bug I found in Heroku's system a few years ago. Basically, if someone doesn't claim the wildcard subdomain for their primary domain and has a wildcard SSL cert anyone could (can?) claim subdomains. A quick google search yielded hundreds of exploitable domains. At the time it seemed like a pretty big vector for phishing. I have no idea if they fixed this and they gave me a t-shirt.
(I used to help maintain the system responsible for this, but don't work there anymore.)
This is a lot like a bug I found in Heroku's system a few years ago. Basically, if someone doesn't claim the wildcard subdomain for their primary domain and has a wildcard SSL cert anyone could (can?) claim subdomains. A quick google search yielded hundreds of exploitable domains. At the time it seemed like a pretty big vector for phishing. I have no idea if they fixed this and they gave me a t-shirt.
I had same experience with Salesforce
Sendgrid allowed attackers to social engineer control of my company's account and intercept password resets, despite an explicit warning from us a week prior (we received a chat transcript of the failed attempt and let them know that it was not us and someone was actively trying to social engineer access to our account). Then they had the gall to try to convince me on the phone that it must have been my fault (after…
As a former customer (it has admittedly been a few years) I'm not surprised. Sendgrid's entire business is based on price. Emails are one of the few costs that don't really scale that well. They cost a lot more than people think they should. When I list did a cost analysis they beat out a lot of other providers. I haven't used them in years, so I'm not sure if they are still the low cost leader, but they are definite…
[1] http://blog.pentestnepal.tech/post/150381068912/how-i-snoope...
[2] http://mxtoolbox.com/SuperTool.aspx?action=mx%3aslack.com&ru...