Sendgrid under siege from hacked accounts

Re:Sendgrid under siege from hacked accounts by jbverschoor on Saturday August 29, 2020 @02:11PM (#24318169)

Well, I've tried contacting sendgrid about phishing emails that look like they're from @sendgrid.com , using their own server. The SPF records match, so it isn't marked as junk mail.

It's similar to the github pages exploit from years ago, which is why we now have github.com and gitub.io

The purpose of these mails is of course to get credentials and spam some more.

At first I checked for a bounty, but as this is a "configuration error" (SPF), there is no bounty.

Then I sent it by mail, but yeah.. No reply.

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by perennate on Saturday August 29, 2020 @07:59PM (#24320268)

Same -- I got several e-mails with subject "The following services failed to auto-renew and are about to expire" that I almost believed were real because they came from an actual sendgrid server (wrqvpkzw.outbound-mail.sendgrid.net [149.72.49.233]).

If SendGrid can't develop simple filters to deter phishing e-mails sent through their platform targeting their own service, then obviously they're going to end up with a lot of users being hacked.

I mean seriously, why would an e-mail provider like this allow e-mails to be sent from "[email protected]" and "[email protected]"??

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by nodesocket on Saturday August 29, 2020 @03:13PM (#24318680)

Can you elaborate how a 3rd party is able to send e-mail from @sendgrid.com?

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by jbverschoor on Saturday August 29, 2020 @04:17PM (#24319125)

Simple. Their ip addresses of their client/guest-servers are whitelisted in the SPF records. So anyone can impersonate them.

Not 100% sure if that was the case now, as I can't find the email anymore, but I've been getting them from both sendgrid and mailgun.

Mailgun's SPF (was at least):

  v=spf1 include:spf1.mailgun.org include:spf2.mailgun.org include:_spf.google.com include:aspmx.pardot.com include:mail.zendesk.com include:spf.mailjet.com ~all

  spf1.mailgun.org: v=spf1 ip4:104.130.122.0/23 ip4:146.20.112.0/26 ip4:141.193.32.0/23 ip4:161.38.192.0/20 ~all

  v=spf1 ip4:209.61.151.0/24 ip4:166.78.68.0/22 ip4:198.61.254.0/23 ip4:192.237.158.0/23 ip4:23.253.182.0/23 ip4:104.130.96.0/28 ip4:146.20.113.0/24 ip4:146.20.191.0/24 ip4:159.135.224.0/20 ip4:69.72.32.0/20 ~all

In the mailgun case I received mails from for example 198.61.254.24 with from: [email protected]

This is actually part of a bigger issue, where lots of people use the same email service to send out emails. In theory that should work with gmail or office365, but iirc gmail forces your from sometimes, and google+ms probably thought about this, right? ;)

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by monadic2 on Saturday August 29, 2020 @10:15PM (#24320812)

I'm surprised they give clients access to their own DKIM.

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by perennate on Monday August 31, 2020 @11:10AM (#24332247)

It doesn't pass DKIM. But the fact that it's sent through Sendgrid's platform gives the e-mail credibility. Because no one expects Sendgrid to allow random customers to set e-mail (not necessarily envelope) from address to @sendgrid.com.

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by monadic2 on Tuesday September 01, 2020 @12:55PM (#24343844)

Based on my experience with sendgrid it's par for the course.

[ Parent | on HN ]

Re:Sendgrid under siege from hacked accounts by XCSme on Saturday August 29, 2020 @08:45PM (#24320449)

Someone sent spam emails using my domain name, so I looked a bit into it and made a summary of what I learned: https://www.usertrack.net/blog/stop-others-use-your-domain-e...

[ Parent | on HN ]