1 bug, $50k in bounties, a Zendesk backdoor • Hacker News Board

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#131

Post by ec109685 » Sat, Oct 12, 2024, 5:10 PM UTC

eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Not only is Apple non-directory, they are non-discretionary as well, so foisted on services and handled poorly as a result.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#132

Post by eastbound » Sat, Oct 12, 2024, 5:10 PM UTC

c0balt wrote: post #16

paulpauper wrote: post #9

Earlier quoted context omitted.

That is why a black market exists for this stuff.

The black market also exists because the potential payout for serious 0days by official programs is almost always less than what a third-party adversary will pay (if the target(s) for them are worth it).

This. Fortunately the law makes it that it’s inconvenient (possible prison time) to use the black market, which is a big thumb on the balance, but bug bounties are also often only $3000…

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#133

Post by failedrequest » Sat, Oct 12, 2024, 5:13 PM UTC

Zendesk handles customer data and says its a great customer support platform.

The irony is that they have the worst support and one of the worst response times to issues reported. You will find many experiences on LinkedIn reporting this.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#134

Post by layer8 » Sat, Oct 12, 2024, 5:14 PM UTC

madisp wrote: post #119

layer8 wrote: post #88

Earlier quoted context omitted.

Requiring their customers to implement SPF and DMARC as a hard technical requirement is probably bad for business. And as mentioned in TFA, they do note issues regarding SPF/DMARC in their policy.

I think in this case it's the customers of their customers, e.g. people sending emails to support@acme-corp.com. In that light requiring all emails coming into support@acme-corp.com to have SPF and DMARC is bad for business indeed, not only for Zendesk but probably also for the fictional ACME corp. EDIT: they absolutley should not use an autoincrementing int as a "support-chain token" though, that's a workaround they…

I’m not clear on that. If the support requestor doesn’t need to be from the company, then I don’t understand why the email sender has to be spoofed in the first place.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#135

Post by yieldcrv » Sat, Oct 12, 2024, 5:16 PM UTC

eastbound wrote: post #132

c0balt wrote: post #16

Earlier quoted context omitted.

The black market also exists because the potential payout for serious 0days by official programs is almost always less than what a third-party adversary will pay (if the target(s) for them are worth it).

This. Fortunately the law makes it that it’s inconvenient (possible prison time) to use the black market, which is a big thumb on the balance, but bug bounties are also often only $3000…

Which law makes it a criminal sanction to use a black market like darknet marketplaces

Software Exploits arent considered arms it is information that can be sold, the liability is on the person that does the unauthorized access, the person that steals data, the person that uses the data

Hacking syndicates distribute liability akin to any corporation

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#136

Post by TZubiri » Sat, Oct 12, 2024, 5:16 PM UTC

dewey wrote: post #117

zer0x4d wrote: post #114

Earlier quoted context omitted.

Never said that, but a competent engineer should be able to build like 75% of the main functionality of Zendesk over a weekend. Now, I understand there's probably a lot more to it which is why I would expect it to be a company of around 50 engineers and 150 business/marketing/etc and that's being generous. The hill I'd die on is that, with money not being a scarce resource and a technically feasible challenge present…

That’s a very HN take but the reality is that the tech is usually never the hard part. Selling, supporting, legal, all the certifications and enterprise contracts you have to do for a product like that are the hard part.

Valuable? Yes Tiring? Sure Hard? I guess

You have to admit it's a very social job, talking with lots and lots and lots of people

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#137

Post by cjbprime » Sat, Oct 12, 2024, 5:17 PM UTC

jeroenhd wrote: post #52

renewiltord wrote: post #24

Earlier quoted context omitted.

> $0 due to email spoofing being out of scope. Strictly, $0 because he disclosed to customers. But he only disclosed to customers since Zendesk said it was out of scope.

HackerOne declared the issue out of scope so I don't see why disclosure would make a difference here. Had this person not notified different companies, they still wouldn't get a dime from HackerOne. Bad showings all around, for both HackerOne and Zendesk.

(There's a not-very-convincing argument that they declared the ability to view support tickets as out of scope, but were not given a chance to assess the Slack takeover exploit's scope.)

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#138

Post by ec109685 » Sat, Oct 12, 2024, 5:17 PM UTC

gavingmiller wrote: post #28

The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of repo…

The researcher showed how they could hop onto any Zendesk support ticket thread with zero authentication, so that should have been enough given Zendesk was exposing customer data via that attack path.

Clearly Zendesk needs to change things so that the email address that is created for a ticket isn’t guessable.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#139

Post by cjbprime » Sat, Oct 12, 2024, 5:19 PM UTC

layer8 wrote: post #90

aftbit wrote: post #53

Wait... it looks like Zendesk only fixed the issue of Apple account verification emails being added to tickets, not actually the underlying issue? >In addition to this, we also implemented filters to automatically suspend the following classes of emails: User verification emails sent by Apple based on the Reply-To and Message-Id header values Non-transactional emails from from googleworkspace-noreply@google.com Over…

Only the customer domain owners can fix the underlying issue, which is a missing SPF/DMARC configuration.

That doesn't sound right. Aren't these @zendesk.com addresses?

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#140

Post by wredue » Sat, Oct 12, 2024, 5:19 PM UTC

pphysch wrote: post #99

zer0x4d wrote: post #60

Earlier quoted context omitted.

This is worse than Docusign. What do 6000 people at Zendesk do? It's a simple ticket management software with maybe 10 features

If it's anything like ServiceNow, they have insane feature bloat and poor overall software architecture.

Every single click in ServiceNow takes a full 2 seconds to do anything. For a ticketing system. Insane.

What’s more insane is that it is still better than the vast majority of ticketing software. I don’t know what it is about ticketing and Helpdesk that it ALwAYs ends up like that.