Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1 bug, $50k in bounties, a Zendesk backdoor

gist.github.com

Post reply on HN
Print view View original

81–90 of 437 posts

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#81

Post by vitus »

aftbit wrote: post #53

Wait... it looks like Zendesk only fixed the issue of Apple account verification emails being added to tickets, not actually the underlying issue? >In addition to this, we also implemented filters to automatically suspend the following classes of emails: User verification emails sent by Apple based on the Reply-To and Message-Id header values Non-transactional emails from from googleworkspace-noreply@google.com Over…

Yeah. Zendesk only put a bandaid in place to prevent this particular attack vector for the Slack infiltration attack, and did nothing for the initially reported issue.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#82

Post by layer8 »

bsuvc wrote: post #3

It sounds like the author got stiffed by Zendesk on this bug, $0 due to email spoofing being out of scope. The $50k was from other bug bounties he was awarded on hackerone. It's too bad Zendesk basically said "thanks" but then refused to pay anything. That's a good way to get people not to bother with your big bounty program. It is often better to build goodwill than to be a stickler for rules and technicalities. Sid…

> due to email spoofing being out of scope.

I believe their logic was that only the domain owner can adequately prevent email spoofing by proper SPF/DMARC configuration, and that it’s the customers’ fault if they don’t do that. Which isn’t entirely wrong.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#83

Post by ericbarrett »

This was a great writeup, really clear and engagingly written, about an interesting and subtle bug. If the author hadn't mentioned they were 15 I would have assumed it was from a seasoned security professional.

To Daniel/hackermondev: whatever you're doing, keep it up!

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#84

Post by j0hnyl »

mmsc wrote: post #57
maeil wrote: post #11

A $1.3 billion revenue company being too tight to pay this after all, even on their 2nd chance, is so short-sighted it's absurd. They're putting out a huge sign saying "When you find a vuln, definitely contact all our clients because we won't be giving you a penny!". Incredible. This must be some kind of "damaged ego" or ass-covering, as it's clearly not a rational decision. Edit: Another user here has pointed out th…

It all makes sense if you consider bug bounties are largely: 1) created for the purpose of either PR/marketing, or a checklist ("auditing"), 2) seen as a cheaper alternative to someone who knows anything about security - "why hire someone that actually knows anything about security when we can just pay a pittance to strangers and believe every word they say?" The amusing and ironic thing about the second point is tha…

It's incredibly hard and resource intensive to run a bounty program, so anyone doing it for shortcuts or virtue signaling will quickly realize if they're not mature enough to run one.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#85

Post by achairapart »

bsuvc wrote: post #20

Another example of how weasley Zendesk can be: They created a fake band called "Zendesk Alternative" just in an attempt to pollute the Google results if you search for an alternative to Zendesk. http://zendeskalternative.com/ While not illegal, it shows the way they think, a sort of manipulative pettiness.

Also noted that the song (or "lyrics" at least) has "Open Source" in its title so they can position for the "Zendesk Open Source Alternative" long tail.

That's evil!

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#87

Post by j0hnyl »

zer0x4d wrote: post #60
gavingmiller wrote: post #25

Earlier quoted context omitted.

zendesk is 6k employees, they have general council on staff

This is worse than Docusign. What do 6000 people at Zendesk do? It's a simple ticket management software with maybe 10 features

If you google "Zendesk annual revenue" you will find that perhaps many of those 6000 employees are doing something after all.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#88

Post by layer8 »

mmsc wrote: post #42

From what I can tell, the vulnerability wasn't even fixed: they just.. changed their spam filter? Whatever that means. So for this to work still, you need to bypass a spam filter. They should just force DMARC and SPF like Google has done, and say "your fault if you misconfigure". Also default-off for the CC thing would be a good idea, too, with a warning of what could happen if they turn it on. Alternatively making a…

Requiring their customers to implement SPF and DMARC as a hard technical requirement is probably bad for business. And as mentioned in TFA, they do note issues regarding SPF/DMARC in their policy.

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#89

Post by belter »

bsuvc wrote: post #3

It sounds like the author got stiffed by Zendesk on this bug, $0 due to email spoofing being out of scope. The $50k was from other bug bounties he was awarded on hackerone. It's too bad Zendesk basically said "thanks" but then refused to pay anything. That's a good way to get people not to bother with your big bounty program. It is often better to build goodwill than to be a stickler for rules and technicalities. Sid…

Seems a pattern: https://www.reddit.com/r/sales/comments/1eck30a/terrible_zen...

Re: 1 bug, $50k in bounties, a Zendesk backdoor

#90

Post by layer8 »

aftbit wrote: post #53

Wait... it looks like Zendesk only fixed the issue of Apple account verification emails being added to tickets, not actually the underlying issue? >In addition to this, we also implemented filters to automatically suspend the following classes of emails: User verification emails sent by Apple based on the Reply-To and Message-Id header values Non-transactional emails from from googleworkspace-noreply@google.com Over…

Only the customer domain owners can fix the underlying issue, which is a missing SPF/DMARC configuration.
Post reply on HN