Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

311–320 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#311

Post by mkl »

josu wrote: post #141
bsuvc wrote: post #20

Another example of how weasley Zendesk can be: They created a fake band called "Zendesk Alternative" just in an attempt to pollute the Google results if you search for an alternative to Zendesk. http://zendeskalternative.com/ While not illegal, it shows the way they think, a sort of manipulative pettiness.

I have a similar conspiracy theory for DDG, the rapper. I used to go to DuckDuckGo by typing "ddg" in Google. Now, it's all mentions to DDG the rapper.

ddg.gg will take you straight there and is just as quick to type (of course, it's simpler to set it as default).

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#312

Post by barbs »

bsuvc wrote: post #3

It sounds like the author got stiffed by Zendesk on this bug, $0 due to email spoofing being out of scope. The $50k was from other bug bounties he was awarded on hackerone. It's too bad Zendesk basically said "thanks" but then refused to pay anything. That's a good way to get people not to bother with your big bounty program. It is often better to build goodwill than to be a stickler for rules and technicalities. Sid…

Mind giving details abut the interview? Must've been pretty bad!

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#313

Post by danpalmer »

This matches my experience with Zendesk. We did an integration at my previous company and they were incredibly naive with respect to email setup. We had quite strict requirements around deliverability in particular, and having the Zendesk setup play nicely with our email domain setup that was tuned for deliverability. Sadly Zendesk were unable to engage with the issue beyond "just forward emails from your gmail support inbox" which was a long way behind where we were.

For a company built on email, they're not good at it.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#314

Post by lathiat »

dewey wrote: post #112
bsuvc wrote: post #20

Another example of how weasley Zendesk can be: They created a fake band called "Zendesk Alternative" just in an attempt to pollute the Google results if you search for an alternative to Zendesk. http://zendeskalternative.com/ While not illegal, it shows the way they think, a sort of manipulative pettiness.

That sounds more like an April Fool's Day joke than something malicious. These were still fun sometimes back in the days (2016). I wouldn't read too much into this because one unmaintained old website will not going to make or break the SEO game of others.

I love the old school logos for Twitter, MySpace, Facebook, etc in the footer.

Takes me back to a more innocent time of the Internet.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#315

Post by IAmGraydon »

mtlynch wrote: post #61
bsuvc wrote: post #20

Another example of how weasley Zendesk can be: They created a fake band called "Zendesk Alternative" just in an attempt to pollute the Google results if you search for an alternative to Zendesk. http://zendeskalternative.com/ While not illegal, it shows the way they think, a sort of manipulative pettiness.

I think that's pretty funny and not particularly malevolent. It's a fake alt rock band called Zendesk. It's obviously tongue-in-cheek and not going to deceive anyone. Also, anytime I search for "X alternative" the results are all AI-generated garbage anyway, so I'd welcome something quirky and original like this in my results.

> It's obviously tongue-in-cheek and not going to deceive anyone.

Yes, that’s it. They paid their marketing team to do this to be funny.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#316

Post by saagarjha »

yieldcrv wrote: post #281
saagarjha wrote: post #272

Earlier quoted context omitted.

That’s not how this works.

How does it work, I didnt get another answer from an LLM which pretty much never respond without elaborating

You will typically be held liable for who you are selling your bugs to. If your bug ends up in the wrong hands you can’t just say “but I deal with everyone”.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#318

Post by wilsonnb3 »

marcellus23 wrote: post #310
lathiat wrote: post #309

Earlier quoted context omitted.

I think what he means is, if you have an @gmail.com account via Google, that is pretty good proof of control. But if you have any other e-mail (e.g. a custom domain) via Google, it's not. Similar with Apple, if you were signing in with an @icloud.com, it's pretty good proof, but if you have an Apple ID with a third-party e-mail it's not proof of current control of that e-mail. That's my guess.

That helps, but I still don't have a full picture. What's the threat here? Is it that: if a hacker gains temporary access to Bob's email bob@example.com, they can create an Apple account attached to it, and use that account to sign in with a service ABC, then that hacker gains access to Bob's private info in service ABC? But if the hacker already has email access, can't he just log into service ABC directly anyway? A…

> Also, is it impossible to have a Google account with a non-gmail address?

You can have your own domain if it is a workspace account

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#319

Post by bitexploder »

bushido wrote: post #144
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

Out of curiosity, do you know of open source projects or any resources that someone less familiar with SSO can use/read to properly implement SSO?

Use OIDC. It is based on Oauth. I would fiddle with implementing basic Oauth clients first. Like a Spotify playlist fetcher or something. Just to start getting a feel for the flows and things you would be concerned with.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#320

Post by hinkley »

to11mtm wrote: post #236
hinkley wrote: post #168

Earlier quoted context omitted.

Big companies are places where you get kudos for only taking two weeks to solve a problem you’ve solved elsewhere in two days. To an extent it’s Little’s Law. The latency requires more “CPUs” to handle the traffic.

This is super loud to me RN because some of these "big" companies are case studies in Mythical Man Month's "N channels of communication" as well as weird flashbacks to discussions on costs context switching and schedulers in various CS courses.

It's throughput versus responsiveness.

If you can't get one story through in a week, you start a bunch of them so one finishes every few days.

Post reply on HN