231–240 of 437 posts
Earlier quoted context omitted.
I have a similar conspiracy theory for DDG, the rapper. I used to go to DuckDuckGo by typing "ddg" in Google. Now, it's all mentions to DDG the rapper.
https://duck.com works. Ironically, the domain was given to DDG from Google.
And this is how whitehats get turned into blackhats and just choose to use this information to perform social engineering or exploit devices.
Earlier quoted context omitted.
"If you won't illustrate the impact of our mistake, we aren't obligated to listen to you" is peak CYA
Not even close to the point I was making: If you want to get taken seriously, write to audience.
A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. They're putting out a huge sign saying "When you find a vuln, definitely contact all our clients because we won't be giving you a penny!". Incredible. This must be some kind of "damaged ego" or ass-covering, as it's clearly not a rational decision. Edit: Another user here has pointed out th…
> A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. I'll give an "another side" perspective. My company was much smaller. Out of 10+ "I found a vulnerability" emails I got last year, all were something like mass-produced emails generated based on an automated vulnerability scanning tool. Investigating all of those for "is it really an issu…
Earlier quoted context omitted.
Apple and Google weren’t involved as email sender addresses.
Read the repro steps again: > Create an Apple account with support@company.com email and request a verification code, Apple sends verification code from appleid@id.apple.com to support@company.com and Zendesk automatically creates a ticket It's a clever attack.
const sendmail = require('sendmail')();
// Assuming the ticket you created in step #2 was assigned a ticket ID of #453
// verification email landed somewhere near there
const range = [448, 457];
for (let i = range[0]; i Earlier quoted context omitted.
If you google "Zendesk annual revenue" you will find that perhaps many of those 6000 employees are doing something after all.
Big companies are places where you get kudos for only taking two weeks to solve a problem you’ve solved elsewhere in two days. To an extent it’s Little’s Law. The latency requires more “CPUs” to handle the traffic.
Earlier quoted context omitted.
Only the customer domain owners can fix the underlying issue, which is a missing SPF/DMARC configuration.
That doesn't sound right. Aren't these @zendesk.com addresses?
Earlier quoted context omitted.
That doesn't sound right. Aren't these @zendesk.com addresses?
The spoofed addresses were support@company.com, is my understanding. Zendesk is very well aware of SPF/DMARC, from their support pages.
https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b...
Ah, yes, why do laymen always think this?
I mean, I get it, Krupp and mining towns used to be a thing, so it is possible.
But every big company should build a ticketing system? Why not an email solution, OS, network routers too?
Earlier quoted context omitted.
Read the repro steps again: > Create an Apple account with support@company.com email and request a verification code, Apple sends verification code from appleid@id.apple.com to support@company.com and Zendesk automatically creates a ticket It's a clever attack.
I agree with your point, but that email's not the best example because it would have passed SPF/DMARC/DKIM. It's a step or two later that involved sending a spoofed email from appleid@id.apple.com : const sendmail = require('sendmail')(); // Assuming the ticket you created in step #2 was assigned a ticket ID of #453 // verification email landed somewhere near there const range = [448, 457]; for (let i = range[0]; i