Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

241–250 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#241

Post by tredre3 »

bryanrasmussen wrote: post #108
patcon wrote: post #30

Earlier quoted context omitted.

Aaaaaahhh I am on a rollercoaster of customer experience. I am beyond annoyed at Zendesk for stiffing this kid, but actually kinda charmed by this quirky marketing gimmick. But also, SECURITY culture concerns beat culture culture. Companies should def consider ditching them for this lapse and their poor form in making it right. If Zendesk is smart, they should hop on this thread and pay this kid out while everyone is…

>but actually kinda charmed by this quirky marketing gimmick. I'm actually pretty annoyed at the stupidity, it's the kind of thing that even a shitty search engine won't be fooled by and hey when I search for Zendesk alternatives I don't see any brand called Zendesk alternative in first few results. I mean it's like they're too stupid to do what every other weaselly scumbag does, get some fake reviews up comparing yo…

> it's the kind of thing that even a shitty search engine won't be fooled by

Searching `Zendesk alternative` (no s, no quotes):

- Google shows it in the top 5 results.

- Bing shows it on the second page.

- Brave shows it in the middle of the first page.

- DDG doesn't show it.

- Yahoo shows it on page 3

- Yandex doesn't show it

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#242

Post by gavingmiller »

tptacek wrote: post #224
gavingmiller wrote: post #28

The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of repo…

I think this is (descriptively) correct, but it's a difficult point to make in a message board argument because of hindsight bias.

It’s a good callout, shouldn’t have editorialized like that.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#243

Post by to11mtm »

bushido wrote: post #144
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Out of curiosity, do you know of open source projects or any resources that someone less familiar with SSO can use/read to properly implement SSO?

Not the best suggestion but haven't seen others give any yet...

IdentityServer4 [0] is no longer maintained [1] but had SSO support and the source is still on github.

[0] - https://identityserver4.readthedocs.io/en/latest/

[1] - They had to go commercial to stay afloat, there wasn't enough contributions from community/etc. That said it's pretty cheap for what it does in the .NET space.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#246

Post by mozman »

portaouflop wrote: post #228
mozman wrote: post #227

Earlier quoted context omitted.

I use a competitor to HackerOne. I view all submissions pre-triage and would have taken it seriously, even if I made a mistake in program scope. I have paid researchers for bugs out of scope before because they were right.

You can also view all submissions in h1 pre triage. This was incompetence on both h1 and zendesk as gp stated not a limitation of the platform per se.

Sure, that’s why I am not naming a competitor. Security leadership is the biggest wildcard. I always want to do the right thing. Not everyone does.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#247

Post by [deleted] »

ec109685 wrote: post #121
mmsc wrote: post #57

Earlier quoted context omitted.

It all makes sense if you consider bug bounties are largely: 1) created for the purpose of either PR/marketing, or a checklist ("auditing"), 2) seen as a cheaper alternative to someone who knows anything about security - "why hire someone that actually knows anything about security when we can just pay a pittance to strangers and believe every word they say?" The amusing and ironic thing about the second point is tha…

I don’t agree. Bug bounties are taken seriously by at least some companies. Where I have worked, we received very useful reports, some very severe, via HackerOne. The company even ran special sessions where engineers and hackers were brought together to try to maximize the number of bugs found in a few week period. It resulted in more secure software at the end and a community of excited researchers trying to make so…

[deleted]

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#249

Post by jazz9k »

I've been making money finding bugs for H1 and have made >100k.

I finally stopped when two large companies have stopped communicating with me over the last year (all bugs have been triaged on the H1 side).

They owe me a total of around 30k. H1 can't do anything about it. It seems there is no actual contract in place to protect researchers.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#250

Post by hmottestad »

cxcorp wrote: post #72
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

This is very important to keep in mind when implementing OAuth authentication! Not every SSO provider is the same. Even if the SSO provider tells you that the user's email is X, they might not even have confirmed that email address! Don't trust it and confirm the email yourself!

And remember to add a random unique id to the reply-to email, otherwise you’ve fallen into the same trap.
Post reply on HN