1 bug, $50,000+ in bounties, how Zendesk intentionally left a backdoor in hundreds of Fortune 500 companies - zendesk.md
Noting that the only bounties were from some of the many 3rd party companies using Zendesk. Zendesk themselves did NOTHING.
As a commentor there said: “The best way to incentivize malicious activity is not to reward philanthropic behaviour. The next exploit for ZenDesk will be sold directly to the darkweb after having read this.”
$50k in bounties at 15! Wow.
I didn’t realize white-hatting was so profitable…
Yes but usually is not consistent big wins like this
Nor did I.
Lmao, Zendesk made their own post (edit: a troll account linked it acting as them, but the actual Zendesk post is still something else) saying the person who disclosed this violated ethical principles while also saying they (zendesk) discovered this issue.
That looks to be a troll. ZendeskTeam account was created 1 hour ago and is not part of the org.
But the help article linked is pathetic.
Oh, thank god. 🤦 I guess the post itself still stands as terrible though
It’s a terrible way to take your company rank on these security forums.
When a company does that (pretend like they discovered the issue to avoid paying a bounty), they often end up on a shit list where bored hackers pentest them for funsies and then release the vulnerability in the wild.
Source: Im on the team at my job that pays hackers and their streams frequently broadcast shitty companies that refuse to pay.
I really like reading or watching stuff like this.
Apart from “Bug bounty reports explained”, who hasn’t been that active the last months… What are the best sources for this kind of content?
That was a fun read.
