41–50 of 55 posts
Sendgrid allowed attackers to social engineer control of my company's account and intercept password resets, despite an explicit warning from us a week prior (we received a chat transcript of the failed attempt and let them know that it was not us and someone was actively trying to social engineer access to our account). Then they had the gall to try to convince me on the phone that it must have been my fault (after…
I found this write-up a bit confusing and hard to follow. The vulnerability is that any SendGrid user could configure a webhook callback which would POST back all received emails for any domain which had its MX set to 'mx.sendgrid.net'. OP exploited this against Uber to receive copies of their emails. Presumably there was no way to tell from one account that another account is web-hooking your email out from under yo…
Earlier quoted context omitted.
It is not listed as an in-scope domain on Uber's bug bounty policy. You would have to argue that the access was unintentional - that you believed you had authorization to access the server from Uber and that Uber had the ability to assign that authorization on behalf of SendGrid.
That is a bit tricky. You could argue that the MX records for a domain that is "in scope" (www.uber.com) are in play. They don't specifically say you can only follow CNAME and A records...and you do have to follow CNAME for some of the listed domains.
Honest question: Do bug bounties with such low bounties really do more good than harm? A bug bounty incentivizes people to look for bugs. But when you find an interesting bug like this you have the option of either having the possibility of making millions from the social engineering possibilities alone, or claiming the bug bounty and get $10k. Of course claiming the bounty is the moral thing to do, but some people w…
So, on the balance, you are increasing motivation for people who are not willing to harm for cash while leaving the motivation of the willing unchanged. I would be tempted to argue that it is flat out unwise to NOT run a bug bounty program, although it would be much smarter to offer larger bounties. I could make an argument for bounties exceeding the projected amount the vulnerability would be worth on the black market, I think, but that's a different subject.
Earlier quoted context omitted.
Who would you recommend then?
I'm not the person you asked but I too have had bad experiences with SendGrid. It really depends on which aspect of SendGrid we're talking about. Transactional e-mail? Mailgun is a easy to use API on top of Amazon's SES. You can even set up incoming e-mail hooks e.g. "When a new e-mail arrives, POST the contents to this address and attach any attachments on the e-mail as file uploads." Newsletters? Drip campaigns? I…
Earlier quoted context omitted.
That is a bit tricky. You could argue that the MX records for a domain that is "in scope" (www.uber.com) are in play. They don't specifically say you can only follow CNAME and A records...and you do have to follow CNAME for some of the listed domains.
Unfortunately, the law simply does not care about technical details. If you were being prosecuted for this sort of thing and you brought and expert witness or testified yourself about a technical justification such as this, you would be accused of attempting to bamboozle the court with fancy technical wording and it would not go well for you. You might even get found to be in contempt of court. Even the very simple f…
It isn't a trick...Some of the approved domains have no IP addresses directly associated with them. You have to traverse a reference to another domain name, not on the list, to get to an actual IP address.
Now if that traversal is by something called a CNAME or something called an MX, does it matter?
Earlier quoted context omitted.
Why does this comment appear on every bug bounty HN thread? Straight from the horse's mouth [0]: The black market is very unlikely to be a place you could sell a bug in a specific website or service. It is not “worth millions”. Please stop repeating this. [0] - https://medium.com/@collingreene/to-the-bounty-hunters-9259b...
What a cute strawman (and completely incorrect strawman from the wrong horse at that, this is Trumpist drivel from the guy who runs the actual bug bounty who of course has some acute rationalizations for underpaying for some of the most intricate technical work in the industry). Nobody said it was "worth millions" but I have second-degree connections in Scandinavia that would pay 10x, like I said ($100,000). @colling…
https://www.united.com/web/en-US/content/Contact/bugbounty.a...
Don't these companies get that researchers need to live?!
Honest question: Do bug bounties with such low bounties really do more good than harm? A bug bounty incentivizes people to look for bugs. But when you find an interesting bug like this you have the option of either having the possibility of making millions from the social engineering possibilities alone, or claiming the bug bounty and get $10k. Of course claiming the bounty is the moral thing to do, but some people w…
I think it's hard to monetize most bug bounty bugs. There isn't really a market for most XSS, CSRF or even RCEs bugs for web properties. Getting the bounty payout for a bug from the owner is often the best deal available. I think the only exception to the no-market situation is browser RCEs and smart phone OS jailbreaks.
Earlier quoted context omitted.
I think it's hard to monetize most bug bounty bugs. There isn't really a market for most XSS, CSRF or even RCEs bugs for web properties. Getting the bounty payout for a bug from the owner is often the best deal available. I think the only exception to the no-market situation is browser RCEs and smart phone OS jailbreaks.
Right, and this one could have easily been monetized because it allows attackers to intercept and read any one of SendGrid's customer's private internal emails!
This vulnerability only allows you to intercept future incoming emails that are delivered to sendgrid domains. Even if it did allow access to all of their customers internal emails there aren't many buyers (and no obvious marketplaces) out there for that kind of access.
The risk is simply too high, if you're Lyft (for example) being caught with that access (even if it was never used) would be a possible terminal event for the company. Purchasers would be buying a giant liability and a small competitive advantage.
Maybe there are shady companies or criminal groups who would be interested in the access but even then I feel $10k would be roughly how much money they'd be willing to spend (considering the same amount of money could also buy thousands of verified credit cards or a million email addresses at legitimate providers).
This is a lot like a bug I found in Heroku's system a few years ago. Basically, if someone doesn't claim the wildcard subdomain for their primary domain and has a wildcard SSL cert anyone could (can?) claim subdomains. A quick google search yielded hundreds of exploitable domains. At the time it seemed like a pretty big vector for phishing. I have no idea if they fixed this and they gave me a t-shirt.
I can't recall all the exact details, but there is some validation logic in place along the lines of "if there's a wildcard domain installed then newly added subdomains must be on the same account as the wildcard's owner". You could give it a shot, but I don't think this attack would work. (I used to help maintain the system responsible for this, but don't work there anymore.)
edit: here's what we sent to heroku https://gist.github.com/bdittmer/6461b7a5093acd7d6263