1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies
(gist.github.com)
from BrikoX@lemmy.zip to cybersecurity@sh.itjust.works on 12 Oct 2024 15:25
https://lemmy.zip/post/24371543
from BrikoX@lemmy.zip to cybersecurity@sh.itjust.works on 12 Oct 2024 15:25
https://lemmy.zip/post/24371543
1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies - zendesk.md
threaded - newest
That was a fun read.
$50k in bounties at 15! Wow.
I didn’t realize white-hatting was so profitable…
Nor did I.
Yes but usually is not consistent big wins like this
Noting that the only bounties were from some of the many 3rd party companies using Zendesk. Zendesk themselves did NOTHING.
As a commentor there said: “The best way to incentivize malicious activity is not to reward philanthropic behaviour. The next exploit for ZenDesk will be sold directly to the darkweb after having read this.”
I really like reading or watching stuff like this.
Apart from “Bug bounty reports explained”, who hasn’t been that active the last months… What are the best sources for this kind of content?
Lmao, Zendesk made their own post (edit: a troll account linked it acting as them, but the actual Zendesk post is still something else) saying the person who disclosed this violated ethical principles while also saying they (zendesk) discovered this issue.
That looks to be a troll. ZendeskTeam account was created 1 hour ago and is not part of the org.
But the help article linked is pathetic.
Oh, thank god. 🤦 I guess the post itself still stands as terrible though
It’s a terrible way to take your company rank on these security forums.
When a company does that (pretend like they discovered the issue to avoid paying a bounty), they often end up on a shit list where bored hackers pentest them for funsies and then release the vulnerability in the wild.
Source: Im on the team at my job that pays hackers and their streams frequently broadcast shitty companies that refuse to pay.