3 ms·
> $0 due to email spoofing being out of scope. Strictly, $0 because he disclosed to customers. But he only disclosed to customers since Zendesk said it was out
by renewiltord 2y ago
> $0 due to email spoofing being out of scope.
Strictly, $0 because he disclosed to customers. But he only disclosed to customers since Zendesk said it was out of scope.
- jeroenhd 2y agoHackerOne declared the issue out of scope so I don't see why disclosure would make a difference here. Had this person not notified different companies, they still wouldn't get a dime from HackerOne. Bad showings all around, for both HackerOne and Zendesk.
- mmsc 2y ago>HackerOne declared the issue out of scope so I don't see why disclosure would make a difference here. Indeed, but just you wait for Zendesk to say "well, _we_ didn't mark it out of scope!" as if delegating it to h1 renegades all responsibility.
- justusthane 2y agoThey did, though. The post also quotes a response from Zendesk declaring it out of scope.
- cjbprime 2y ago(There's a not-very-convincing argument that they declared the ability to view support tickets as out of scope, but were not given a chance to assess the Slack takeover exploit's scope.)
- nodamage 2y agoThe Slack takeover exploit is a problem on Slack's end (and sounds more like a configuration issue than a bug) so Zendesk would not be responsible for that anyway though.
- a_dabbler 2y agoI disagree, the problem is clearly on Zendesks end.
- nodamage 2y agoDon't get me wrong, Zendesk definitely has their own separate problem: you should not be able to CC yourself onto an existing support ticket by emailing a guessable ticket ID. But simultaneously you should not be able to get into a company Slack by simply having an account with a @company.com email address created by a third-party SSO provider. In other words, even in Zendesk fixed their problem, Slack would still have a problem on their end.