Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

431–437 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#431

Post by wutwutwat »

quacksilver wrote: post #324
eatbots wrote: post #64

Reported this exact bug to Zendesk, Apple, and Slack in June 2024, both through HackerOne and by escalating directly to engs or PMs at each company. I doubt we were the first. That is presumably the reason they failed to pay out. The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted i…

I do web app testing and report a similar issue as a risk rather often to my clients. You can replace Google below with many other identity providers. Imagine Bob works at Example Inc. and has email address bob@example.com Bob can get a Google account with primary email address bob@example.com. He can legitimately pass verification. Bob then gets fired for fraud or sexual harassment or something else gross misconduct…

This is why you store and match on the sso provider’s uuid, not on the email address. Emails are not a unique identifier and never have been. Someone can delete their email account and later someone else can sign up and claim the same email. Anyone matching on email addresses is doing it wrong. I’ve tried to argue this to management at companies I’ve worked at in the past, but most see my concern as paranoid.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#432

Post by Avamander »

portaouflop wrote: post #422
Avamander wrote: post #377

Earlier quoted context omitted.

This is a common problem with HackerOne and the likes. It's absolutely awful for anything even a tiny bit more unique or rare.

Blame beg bounty hunters for this

Beg bounty hunters are not to blame for utterly abysmal responses by these platforms. Especially after they ghost the researcher and then moan about publication.

Proper response would be to update your program to triage these vulns and thank the researcher for not going public straight away. This current approach is burning a tremendous amount of goodwill.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#433

Post by portaouflop »

Avamander wrote: post #432
portaouflop wrote: post #422

Earlier quoted context omitted.

Blame beg bounty hunters for this

Beg bounty hunters are not to blame for utterly abysmal responses by these platforms. Especially after they ghost the researcher and then moan about publication. Proper response would be to update your program to triage these vulns and thank the researcher for not going public straight away. This current approach is burning a tremendous amount of goodwill.

You can’t triage them yourself is the point because you get two dozen bogus beg bounty’s each day - this is a full time job! So you need such a platform, etc.pp.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#434

Post by thrdbndndn »

dclowd9901 wrote: post #347
gavingmiller wrote: post #28

The piece the author is missing, and why zendesk likely ignored this is impact, and it's something I continually see submissions lacking. As a researcher, if you can't demonstrate impact of your vulnerability, then it looks like just another bug. A public program like zendesk is going to be swamped with reports, and they're using hackerone triagers to augment that volume. The triage system reads through a lot of repo…

The dude demonstrated the ability to infiltrate a client’s Slack instance via their vulnerability. If that’s not enough to make the hairs on your neck stand on end as an engineer, go fucking do something else.

He didn't demonstrate this in his initial report to Zendesk.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#435

Post by m11a »

paulpauper wrote: post #427
m11a wrote: post #386

Earlier quoted context omitted.

Doubtful. It's probably just incompetence, rather than malice. The incident almost certainly cost Zendesk more in (according to the gist) lost contracts and reputational damage than it would've cost to pay the security researcher a bounty.

Or just fix the problem and not pay the bounty. Why pay at all if you can find a way not to?

Risk of bad rep when the researcher reports to HN or makes some noise. Then future security researchers don’t try find issues on your platform, and it’s more insecure as a result.

For a sensible large company, it’s not worth being stingy over (relative) pennies. They waste money like it’s water. They might as well spend where it matters. Bug bounties won’t even show on their bottom line, but cleanup for an exploited issue will.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#436

Post by jejeyyy77 »

tptacek wrote: post #220
jejeyyy77 wrote: post #199

Earlier quoted context omitted.

it never made sense to me why these white-hat hackers don't require payment before disclosing the vulnerability

Bug bounty people do this all the time. It's almost always a sign that your bug is something silly, like DKIM. Later I wrote this comment before rereading the original post and realizing that they had literally submitted a DKIM report (albeit a rare instance of a meaningful one). Just to be clear: in my original comment, I did not mean to suggest this bug was silly; only that in the world of security bug bounties, DK…

what does it mean to say a bug is silly?

only thing that matters is the severity and what it allows the attackers to do.

Post reply on HN