Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zendesk was hacked

zendesk.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Zendesk was hacked

#41

Post by bobsoap »

bobsoap wrote: post #9
businessleads wrote: post #2

Wow, all three customers?

My thoughts exactly, lol. The headline is truly hilarious when you consider the typically quite spectacular number of compromised accounts reported in most other high-caliber incidents. Well done Zendesk.

Thanks for the downvotes everyone.

For the record, when I wrote the above comment, the headline of this thread was "Zendesk was hacked, 3 customers affected". It has been changed since, without due notice of course. I wonder why...

Now, my comment looks like I'm a nutjob and have a personal gripe with Zendesk or something.

That the three customers were Twitter, Pinterest and Tumblr didn't come out until later as well.

Carry on.

Re: Zendesk was hacked

#42

Post by viscanti »

unreal37 wrote: post #18
creativityland wrote: post #16

Earlier quoted context omitted.

So what kind of integration did Twitter, Tumblr and Pinterest have with Zendesk? How much of risk are the users are with their passwords?

No password data was stored there - so zero. No passwords, password hashes or encrypted passwords were lost.

But there's a greater than 0% chance that zendesk had an API token for at least one of those services. That could easily allow a hacker to make authenticated requests to those services to gain user info. The fact that usernames and passwords weren't stored on zendesk doesn't mean much, if a hacker can gain full admin access to those other services through an admin token that might have been stored on zendesk.

Re: Zendesk was hacked

#43

Post by jpswade »

lawnchair_larry wrote: post #21

First, thanks for disclosing this. Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to wipe that machine. It's not uncommon for an attacker to leave multiple backdoors. Even if you don't think they got root, you have to wipe it completely.

Destroying data is never a solution.

Re: Zendesk was hacked

#44

Post by klapinat0r »

scorpion032 wrote: post #40
mef wrote: post #10

Earlier quoted context omitted.

If it was, at it occurred after the vulnerabilities were made public, they probably wouldn't say so as it would look pretty bad given the amount of advance warning they had.

Are you suggesting most popular rails (if not all) apps are upgraded by now?

No, but he's suggesting that you should've upgraded by now. It would be difficult to defend such a position: "We didn't upgrade because, well, we didn't think it was a big deal"? There's really no good answer to that question when the exploit has been public for so long (and widely covered in media, and by rails officially).

Re: Zendesk was hacked

#45

Post by [deleted] »

scorpion032 wrote: post #40
mef wrote: post #10

Earlier quoted context omitted.

If it was, at it occurred after the vulnerabilities were made public, they probably wouldn't say so as it would look pretty bad given the amount of advance warning they had.

Are you suggesting most popular rails (if not all) apps are upgraded by now?

[deleted]

Re: Zendesk was hacked

#46

Post by kelnos »

viscanti wrote: post #42
unreal37 wrote: post #18

Earlier quoted context omitted.

No password data was stored there - so zero. No passwords, password hashes or encrypted passwords were lost.

But there's a greater than 0% chance that zendesk had an API token for at least one of those services. That could easily allow a hacker to make authenticated requests to those services to gain user info. The fact that usernames and passwords weren't stored on zendesk doesn't mean much, if a hacker can gain full admin access to those other services through an admin token that might have been stored on zendesk.

I seriously doubt any company (especially the three listed) would give Zendesk admin access to their service. Why would such a thing be necessary, anyway?

Re: Zendesk was hacked

#47

Post by kelnos »

bobsoap wrote: post #41
bobsoap wrote: post #9

Earlier quoted context omitted.

My thoughts exactly, lol. The headline is truly hilarious when you consider the typically quite spectacular number of compromised accounts reported in most other high-caliber incidents. Well done Zendesk.

Thanks for the downvotes everyone. For the record, when I wrote the above comment, the headline of this thread was "Zendesk was hacked, 3 customers affected". It has been changed since, without due notice of course. I wonder why... Now, my comment looks like I'm a nutjob and have a personal gripe with Zendesk or something. That the three customers were Twitter, Pinterest and Tumblr didn't come out until later as well…

The original title still makes perfect sense. Maybe "3 customers" made sense to me because I'm already familiar with Zendesk, but it immediately struck me as a big deal.

Re: Zendesk was hacked

#48

Post by meaty »

DanBlake wrote: post #25

CPanel was also hacked which is a way bigger deal imo- Led to thousands(!) of other server compromises: http://www.webhostingtalk.com/showthread.php?t=1235797

CPanel is always hacked so it's hardly news.

Re: Zendesk was hacked

#49

Post by [deleted] »

jpswade wrote: post #43
lawnchair_larry wrote: post #21

First, thanks for disclosing this. Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to wipe that machine. It's not uncommon for an attacker to leave multiple backdoors. Even if you don't think they got root, you have to wipe it completely.

Destroying data is never a solution.

[deleted]

Re: Zendesk was hacked

#50

Post by inkel »

throaway132 wrote: post #31
dotmanish wrote: post #30

Earlier quoted context omitted.

There's also Detectify : http://detectify.com They are in beta.

Actually, I've had really bad experiences with Detectify. Their results didn't provide anything useful that I couldn't have gotten from something like Nessus. They have a pretty nice design, but not much in the way of actual useful security.

What was their reaction when you sent them this feedback? Assuming, of course, you did send them this feedback.
Post reply on HN