Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

291–300 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#291

Post by bsbsjsusj »

eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Django all auth seems to know this with social provider specific email settings.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#294

Post by yelnatz »

joshdavham wrote: post #256

Slightly off topic, but why does it always seem to be teenagers who are the most talented at finding exploits?

Kids who are smart and curious have already been exposed to the internet since they were 8/9 years old. So a few years of learning they're already knowledgeable by the time they're in their teens.

No responsibilities and all the time in the world to learn with the right circumstances, they can go far.

Older devs who are experts in this area are already busy making money and working on their employer's security.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#295

Post by thekevan »

austinkhale wrote: post #266
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Presumably one of the PMs you’re referring to has posted this article for additional information. Feels like they’re doubling down on their initial position. https://support.zendesk.com/hc/en-us/articles/8187090244506-...

So when the researcher said it was a bug, they said, "No, it's fine. No bug bounty, sorry."

THEN the researcher eventually goes public.

Later, Zendesk announces the bug and the fix and says there will be no bug bounty because the researcher went public.

Is that how it went? I mean if so, that's one way to save on bug bounties.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#297

Post by sumedh »

thekevan wrote: post #295
austinkhale wrote: post #266

Earlier quoted context omitted.

Presumably one of the PMs you’re referring to has posted this article for additional information. Feels like they’re doubling down on their initial position. https://support.zendesk.com/hc/en-us/articles/8187090244506-...

So when the researcher said it was a bug, they said, "No, it's fine. No bug bounty, sorry." THEN the researcher eventually goes public. Later, Zendesk announces the bug and the fix and says there will be no bug bounty because the researcher went public. Is that how it went? I mean if so, that's one way to save on bug bounties.

> THEN the researcher eventually goes public.

He should have said since its not going to be fixed, he will just inform the individual companies.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#298

Post by LilBytes »

bushido wrote: post #144
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Out of curiosity, do you know of open source projects or any resources that someone less familiar with SSO can use/read to properly implement SSO?

Keycloak (Java) and Zitadel (Go) are my recommendations.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#299

Post by aftbit »

layer8 wrote: post #90
aftbit wrote: post #53

Wait... it looks like Zendesk only fixed the issue of Apple account verification emails being added to tickets, not actually the underlying issue? >In addition to this, we also implemented filters to automatically suspend the following classes of emails: User verification emails sent by Apple based on the Reply-To and Message-Id header values Non-transactional emails from from googleworkspace-noreply@google.com Over…

Only the customer domain owners can fix the underlying issue, which is a missing SPF/DMARC configuration.

Zendesk could refuse to allow "ticket collaboration" if customers had a missing or insufficiently secure SPF/DMARC configuration, or at least make customers check a box that says "Tickets may leak their contents to anyone who can send emails".

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#300

Post by kidbomb »

"Create an Apple account with support@company.com email"

Wait - how is that workflow possible and supported?

In my head, authorization under @company.com would be delegated to a central directory, instead of relying on Apple ID. It is effectively an authentication bypass.

Post reply on HN