Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

171–180 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#171

Post by saagarjha »

yieldcrv wrote: post #135
eastbound wrote: post #132

Earlier quoted context omitted.

This. Fortunately the law makes it that it’s inconvenient (possible prison time) to use the black market, which is a big thumb on the balance, but bug bounties are also often only $3000…

Which law makes it a criminal sanction to use a black market like darknet marketplaces Software Exploits arent considered arms it is information that can be sold, the liability is on the person that does the unauthorized access, the person that steals data, the person that uses the data Hacking syndicates distribute liability akin to any corporation

CFAA?

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#172

Post by chias »

The dumb thing is that this "out of scope" thing is 100% a Hacker One failure, and exactly the kind of thing I've grown to expect from these triage teams.

"SPF, DKIM, and DMARC issues" is absolutely and positively intended to mean "we don't care if we are missing these headers on our domains", in part because this is 99.9% of drive-by beg bounties (if you are tired of getting "I HAVE FOUND A SERIOUS SECURITY ISSUE IN YOUR WEBSITE" cc'ing security@, legal@, privacy@, and your CEO on a monthly cadence, just set up a DKIM record :P)

Yes, this is technically a bug which is in the space of SPF, DKIM, and/or DMARC. But this is absolutely NOT WHAT THE EXCLUSION IS FOR. Hacker One triage teams should know better, and it's frankly embarrassing that they don't. And it's frankly mortifying that their mediation team also didn't pick up on this.

But it checks out.

This is one of the reasons I will not use Hacker One ever. Bugcrowd is slightly better. Intigriti has (so far) been pretty good. I'm not affiliated with any of them, just have been a customer of all three.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#174

Post by nodamage »

layer8 wrote: post #150
ec109685 wrote: post #143

Earlier quoted context omitted.

The attack requires getting yourself CC’d on a support ticket. In this case to show how bad that is, it was a support ticket that had an oauth ticket to log into slack as “support@company.com”.

From the description, sending an email to support@company.com creates a support ticket, to which you can later latch on by adding a Cc. My understandig is that, at least in order to get the full history of a ticket, including any other emails sent to support-$ticket-ID@company.com, the primary sender needs to be from the company as well. Otherwise, why would you need the Cc hack?

The email sender needs to be spoofed in order to add the CC.

1. Apple sends a legitimate email with a verification code from appleid@id.apple.com to support@company.com, creating a ticket in Zendesk.

2. The attacker then sends an email to support-$ticket-ID@company.com from appleid@id.apple.com (spoofed), attaching their own email address in the CC field.

3. Since the attacker is now CC'ed they can read the entire history of the ticket including the legitimate email Apple sent in (1) containing the verification code.

4. Now that the attacker has verified ownership of the Apple ID with the email address support@company.com they can use that Apple ID to login to any service that grants domain-based access via Sign in With Apple, such as Slack.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#175

Post by Aachen »

beryilma wrote: post #164
IggleSniggle wrote: post #104

Earlier quoted context omitted.

Hour-long meetings about whether the copy should read "data center," "datacenter," "data-center," or whether it is really even correct to say any of these at all. And then negotiating with the design folks to fit in the extra character. Only to throw it all away because nobody thought about the fact that it has to support 5 different languages. I wish I was kidding. Used to work at a place that did crap like that, pu…

I had a similar meeting with documentation folks about "dataset" vs. "data set". With Google trend charts and all... I also wish I was kidding.

It's not weird to pick one and keep a consistent style, for example by looking at Google or at Wikipedia or some other source if the dictionary lists both or neither, but to have meetings about it?!

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#176

Post by yieldcrv »

saagarjha wrote: post #171
yieldcrv wrote: post #135

Earlier quoted context omitted.

Which law makes it a criminal sanction to use a black market like darknet marketplaces Software Exploits arent considered arms it is information that can be sold, the liability is on the person that does the unauthorized access, the person that steals data, the person that uses the data Hacking syndicates distribute liability akin to any corporation

CFAA?

which puts the liability on the person that does the unauthorized access

not about else and especially not for merely browsing or using or buying a legal good from a dark net market

as I wrote

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#177

Post by atum47 »

I once found a neat trick to highjack Facebook accounts; after MSN message died a lot of hotmail accounts were left to die also but a lot of people created their Facebook account using the @hotmail address. I tipped them about that they basically said F you.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#178

Post by Thorrez »

dgoldstein0 wrote: post #153
ec109685 wrote: post #121

Earlier quoted context omitted.

I don’t agree. Bug bounties are taken seriously by at least some companies. Where I have worked, we received very useful reports, some very severe, via HackerOne. The company even ran special sessions where engineers and hackers were brought together to try to maximize the number of bugs found in a few week period. It resulted in more secure software at the end and a community of excited researchers trying to make so…

This feels like a case in the gray area. On the one hand, companies need to declare certain stuff out of scope - whether they know about it and are planning to work on it, or consider it acceptable risk, as the point for the company is to help them improve their security posture within the scope of the resources they have to run the bug bounty program. What's weird here is that the blog author found an email problem…

>Without a broader PoC to show how it could be weaponized, it's hard to say that Zendesk was egregiously wrong here

There was a PoC of how to view someone else's ticket (assuming you know the other person's email and approximately when the ticket was filed).

>it's not crazy to think a security engineer reading the report may assume that stuff would cover their butts

It sounds like they got a report saying "I can spoof an email and view someone else's report". Why would they assume the spam protection would protect them when they have a report saying it's not protecting them?

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#179

Post by XCabbage »

gavingmiller wrote: post #28

The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of repo…

Unauthorized read access to private emails you were never legitimately CCed on already is impact. It should not be necessary to come up with a further exploit daisy chained on top of that in order to be taken seriously. (Otherwise why stop at Slack access? Why is that automatically "impact" if email access isn't?)

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#180

Post by Aachen »

eastbound wrote: post #132
c0balt wrote: post #16

Earlier quoted context omitted.

The black market also exists because the potential payout for serious 0days by official programs is almost always less than what a third-party adversary will pay (if the target(s) for them are worth it).

This. Fortunately the law makes it that it’s inconvenient (possible prison time) to use the black market, which is a big thumb on the balance, but bug bounties are also often only $3000…

> Fortunately the law makes it that it’s inconvenient (possible prison time) to use the black market

Don't forget that most people also simply don't sell bugs. They're not for sale in the first place; the bounty would be a thank-you or nice bonus, not a replacement for selling it

I'm certainly not in a criminal bubble so I can't say how big the other side is, but (as a security consultant who knows a reasonable number of hackers) I doubt that I know anyone who'd choose, after getting no response from the company, to sell a bug for profit to a louche party rather than going full disclosure and warning everyone -- or just doing nothing because it's not like it's their problem

Edit: nvm someone did come to mind. We tried to steer them onto the right path at our weekly CTF team meetings but I'm not sure we succeeded. Anywho, still one to a few dozen

Post reply on HN