1 bug, $50k in bounties, a Zendesk backdoor
gist.github.com
1 bug, $50k in bounties, a Zendesk backdoor
1–10 of 437 posts
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#2The edited title on HN is incomprehensible.
The original is:
”1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies”
A better edit might be something like:
“The $50k bug where Zendesk backdoored Fortune 500 companies”
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#3It sounds like the author got stiffed by Zendesk on this bug, $0 due to email spoofing being out of scope.
The $50k was from other bug bounties he was awarded on hackerone.
It's too bad Zendesk basically said "thanks" but then refused to pay anything. That's a good way to get people not to bother with your big bounty program. It is often better to build goodwill than to be a stickler for rules and technicalities.
Side note: I'm not too surprised, as I had one of the worst experiences ever interviewing with Zendesk a few years back. I have never come away from an interview hating a company, except for Zendesk.
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#4I hate that Zendesk refused to pay out for this bug. The author made a good faith effort to report it. The author also tried to escalate it.
After they decided not to work on it, they later came back and asked him for more information and treat it like a bug...
Author should have gotten a reward. Did everything right if Zendesk claims it's not a in scope bug.
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#5lol $0 Companies cutting corners on security also skimp on paying bounties. No surprise there. The only possible exception are crypto bounties. Those are much bigger and a greater willingness to pay due to the stakes.
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#6It's unbelievable that he received no bounty from Zendesk on this one. If it was out of scope, then surely he could have published it anywhere?
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#7I hate that Zendesk refused to pay out for this bug. The author made a good faith effort to report it. The author also tried to escalate it. After they decided not to work on it, they later came back and asked him for more information and treat it like a bug... Author should have gotten a reward. Did everything right if Zendesk claims it's not a in scope bug.
That is how it works. Do nothing so that the researcher breaks the rules innadvetedly as an excuse to not pay, and then fix the problem.
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#8It's owned by private equity. Slowly cutting costs and bleeding the brand dry
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#9It sounds like the author got stiffed by Zendesk on this bug, $0 due to email spoofing being out of scope. The $50k was from other bug bounties he was awarded on hackerone. It's too bad Zendesk basically said "thanks" but then refused to pay anything. That's a good way to get people not to bother with your big bounty program. It is often better to build goodwill than to be a stickler for rules and technicalities. Sid…
That is why a black market exists for this stuff.
Re: 1 bug, $50k in bounties, a Zendesk backdoor
#10A demonstration of the ol’ adage that in order to solve a problem, make it someone else’s problem.