1 bug, $50k in bounties, a Zendesk backdoor

Post by radlad » Sat, Oct 12, 2024, 7:40 PM UTC

nightpool wrote: post #185

radlad wrote: post #126

Earlier quoted context omitted.

It wasn't clear to me as even at that point it was an "H1 Mediator" who responded. Also the bit about SPF, DKIM and DMARC seems to show a misunderstanding of the issue: these are typically excluded because large companies aren't able to do full enforcement on their email domains due to legacy. It's a common bug report. In this case, the problem was that Zendesk wasn't validating emails from external systems.

In this case, that probably means that H1 had a Zoom or Slack convo with the team and is relaying their decision into text instead of making them write it down themselves.

Post by fsckboy » Sat, Oct 12, 2024, 7:42 PM UTC

NicoJuicy wrote: post #71

mmsc wrote: post #57

Earlier quoted context omitted.

It all makes sense if you consider bug bounties are largely: 1) created for the purpose of either PR/marketing, or a checklist ("auditing"), 2) seen as a cheaper alternative to someone who knows anything about security - "why hire someone that actually knows anything about security when we can just pay a pittance to strangers and believe every word they say?" The amusing and ironic thing about the second point is tha…

Our company has a bug bounty program: - handled with priority, but sometimes it takes a couple of weeks for a more definite fix - handled by the security department within the company ( to forward to relevant PO's and to follow up) The unfortunate thing about bug bounties is that you will be hammered with crawlers that would sometimes even resemble a DDOS

Post by DaiPlusPlus » Sat, Oct 12, 2024, 7:46 PM UTC

kozikow wrote: post #193

maeil wrote: post #11

A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. They're putting out a huge sign saying "When you find a vuln, definitely contact all our clients because we won't be giving you a penny!". Incredible. This must be some kind of "damaged ego" or ass-covering, as it's clearly not a rational decision. Edit: Another user here has pointed out th…

> A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. I'll give an "another side" perspective. My company was much smaller. Out of 10+ "I found a vulnerability" emails I got last year, all were something like mass-produced emails generated based on an automated vulnerability scanning tool. Investigating all of those for "is it really an issu…

Post by andai » Sat, Oct 12, 2024, 7:50 PM UTC

achairapart wrote: post #85

bsuvc wrote: post #20

Another example of how weasley Zendesk can be: They created a fake band called "Zendesk Alternative" just in an attempt to pollute the Google results if you search for an alternative to Zendesk. http://zendeskalternative.com/ While not illegal, it shows the way they think, a sort of manipulative pettiness.

Also noted that the song (or "lyrics" at least) has "Open Source" in its title so they can position for the "Zendesk Open Source Alternative" long tail. That's evil!

Post by daghamm » Sat, Oct 12, 2024, 7:59 PM UTC

oarla wrote: post #31

The worse part:"We kindly request you keep this report between you and Zendesk". After being notified of a problem on their side, them ignoring it, now they want to keep things hush hush? That's exactly what the author did in the first place, but they chose to brush it aside. That itself is highly unprofessional. With such an attitude, I'm not surprised that they did not pay out the bounty.