Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

261–270 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#261

Post by codetrotter »

ec109685 wrote: post #130
realusername wrote: post #29

Earlier quoted context omitted.

Interesting technique but on my side I see it at the very bottom of the second page of Google so I don't think it's very effective.

It’s from 2016, so probably lost its mojo.

They need to get the band back together! Release a new album, and go on a world wide reunion tour. And in 2026 they’ve got to release a Best of Zendesk Alternative remastered album.

And in 2027, Zendesk finds that the strategy worked. A little too well! Now the top search result for Zendesk is the rock band, and if you ask an AI about Zendesk, the AI starts yappin about a rock band too! Hahaha

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#262

Post by tgsovlerkhgsel »

jazz9k wrote: post #249

I've been making money finding bugs for H1 and have made >100k. I finally stopped when two large companies have stopped communicating with me over the last year (all bugs have been triaged on the H1 side). They owe me a total of around 30k. H1 can't do anything about it. It seems there is no actual contract in place to protect researchers.

Same experience where I reported a bug, the company ghosted me, and H1 did not even allow disclosure through their platform.

I generally refuse to go through platforms now (also because I really hate being subject to the psychological pressure of a "social credit system", even though I understand why the platforms do it), so if your company doesn't have an alternative reporting form, or refuses bug bounty payouts when a valid issue was reported directly through them instead of through a platform (hello, Backblaze!), I'm not doing free labor for you and you will likely hear about the bug when either someone else finds it or I include it in a public write-up (if it's a bug affecting multiple companies).

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#265

Post by tryauuum »

radlad wrote: post #240
Thorrez wrote: post #235

Earlier quoted context omitted.

I agree with your point, but that email's not the best example because it would have passed SPF/DMARC/DKIM. It's a step or two later that involved sending a spoofed email from appleid@id.apple.com : const sendmail = require('sendmail')(); // Assuming the ticket you created in step #2 was assigned a ticket ID of #453 // verification email landed somewhere near there const range = [448, 457]; for (let i = range[0]; i

This is exactly my point: if Apple has SPF/DKIM/DMARC configured correctly, then Zendesk should be validating the email sender. That they didn't is technically an SPF/DKIM/DMARC issue - a bug in Zendesk - but it is not a customer misconfiguration issue.

if someone's reading this thread: yes, apple does have dmarc / spf

    $ dig id.apple.com TXT +short
    "v=spf1 include:_spf-txn.apple.com include:_spf-mkt.apple.com include:_spf.apple.com include:icloud.com ~all"
    $ dig _dmarc.id.apple.com TXT +short
    "v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;"

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#266

Post by austinkhale »

eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Presumably one of the PMs you’re referring to has posted this article for additional information. Feels like they’re doubling down on their initial position.

https://support.zendesk.com/hc/en-us/articles/8187090244506-...

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#267

Post by tryauuum »

radlad wrote: post #200
layer8 wrote: post #152

Earlier quoted context omitted.

Apple and Google weren’t involved as email sender addresses.

Read the repro steps again: > Create an Apple account with support@company.com email and request a verification code, Apple sends verification code from appleid@id.apple.com to support@company.com and Zendesk automatically creates a ticket It's a clever attack.

I wonder how redirects from support@company.com to zendesk work? if it's via MX records pointing to zendesk that it's zendesk's fault for not checking DMARC If it's another type of redirect then yes, you can blame customers for not verifying DMARC

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#268

Post by paulddraper »

bryanrasmussen wrote: post #108
patcon wrote: post #30

Earlier quoted context omitted.

Aaaaaahhh I am on a rollercoaster of customer experience. I am beyond annoyed at Zendesk for stiffing this kid, but actually kinda charmed by this quirky marketing gimmick. But also, SECURITY culture concerns beat culture culture. Companies should def consider ditching them for this lapse and their poor form in making it right. If Zendesk is smart, they should hop on this thread and pay this kid out while everyone is…

>but actually kinda charmed by this quirky marketing gimmick. I'm actually pretty annoyed at the stupidity, it's the kind of thing that even a shitty search engine won't be fooled by and hey when I search for Zendesk alternatives I don't see any brand called Zendesk alternative in first few results. I mean it's like they're too stupid to do what every other weaselly scumbag does, get some fake reviews up comparing yo…

> wouldn't be fooled

So no harm, no foul, right?

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#269

Post by yieldcrv »

r-w wrote: post #226
yieldcrv wrote: post #176

Earlier quoted context omitted.

which puts the liability on the person that does the unauthorized access not about else and especially not for merely browsing or using or buying a legal good from a dark net market as I wrote

Accessory?

Relies on intent of the seller, who would need to be found via a valid subpoena that needs to pass a threshold of cause

who would then argue they also sold it to security researchers, journalists and assumed everyone was or didnt discriminate or have any intent at all

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#270

Post by hmottestad »

tryauuum wrote: post #265
radlad wrote: post #240

Earlier quoted context omitted.

This is exactly my point: if Apple has SPF/DKIM/DMARC configured correctly, then Zendesk should be validating the email sender. That they didn't is technically an SPF/DKIM/DMARC issue - a bug in Zendesk - but it is not a customer misconfiguration issue.

if someone's reading this thread: yes, apple does have dmarc / spf $ dig id.apple.com TXT +short "v=spf1 include:_spf-txn.apple.com include:_spf-mkt.apple.com include:_spf.apple.com include:icloud.com ~all" $ dig _dmarc.id.apple.com TXT +short "v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;"

And it’s still out of scope for the HackerOne bug bounty program.
Post reply on HN