Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DocuSign email address database breached and used for phishing campaign

trust.docusign.com

Post reply on HN
Print view View original

41–50 of 141 posts

Re: DocuSign email address database breached and used for phishing campaign

#41

Post by secfirstmd »

withinrafael wrote: post #32

I'm not sure DocuSign has a full handle on what happened here yet. I received six (6) DocuSign emails, half of which used a convincing subject derived from actual DocuSign documents I have signed or processed through the system. Perhaps a coincidence? Or these hackers gained access to more than just "email addresses".

Hmmm yes I have received a few and if I recall, some of them had titles very similar to docusign documents I was previously sent.

Exact titles similar to this: "Accounting Invoice 630761 Document Ready for Signature"

Re: DocuSign email address database breached and used for phishing campaign

#42

Post by c22 »

Xylakant wrote: post #30
KirinDave wrote: post #12

Thanks Every Employer I've Had In the Past 6 Years For Putting My Email In A Service I'd Never Want Otherwise. Also Thanks Me for just using docusign w/ our employees when I was in charge.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actual company's name as an alias in my client.

Re: DocuSign email address database breached and used for phishing campaign

#43

Post by janwillemb »

c22 wrote: post #42
Xylakant wrote: post #30

Earlier quoted context omitted.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actua…

They often ask me: do you work for too?

Re: DocuSign email address database breached and used for phishing campaign

#44

Post by Xylakant »

Avalyst wrote: post #40
Xylakant wrote: post #30

Earlier quoted context omitted.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character

The other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.

Re: DocuSign email address database breached and used for phishing campaign

#45

Post by Xylakant »

janwillemb wrote: post #43
c22 wrote: post #42

Earlier quoted context omitted.

I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actua…

They often ask me: do you work for too?

or "you can't have that email address, that's our companies name."

Re: DocuSign email address database breached and used for phishing campaign

#46

Post by corobo »

Avalyst wrote: post #40
Xylakant wrote: post #30

Earlier quoted context omitted.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character

If I were a spammer I'd loop through my email address list and strip out + and anything between it and @

Re: DocuSign email address database breached and used for phishing campaign

#47

Post by lorenzhs »

c22 wrote: post #42
Xylakant wrote: post #30

Earlier quoted context omitted.

I strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.

I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actua…

AliExpress does this, they don't accept "aliexpress@foo.bar". I suppose it's meant to stop you from providing "foo@aliexpress.com", implemented lazily by rejecting anything that contains the substring "aliexpress".

Best response I've received when giving an email address of the form "company@mydoma.in" to a representative in person was "oh you work here too?". The concept of catch-all domains is so foreign to most laypeople that it takes quite some explaining ("I get everything that's sent to any address at that domain", "no it's not expensive at all", "it helps me automatically sort my email").

Re: DocuSign email address database breached and used for phishing campaign

#49

Post by logicallee »

I would like to urge the Google team to solve one aspect of this problem, forever.

It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from. Here is a description:

1 - Currently they (Google) correctly do 99% by allowing you to type a + after your email address to create a new inbox that is marked in a special way. For example if your address is jsmith747@gmail.com then you can give the company jsmith747+docusign@gmail.com when you sign up - that inbox goes to you and when you start receicing spam in the future to "jsmith747+docusign" you can tell how they got it. The phishing mails associated with this breach would have gone to the same place.

2. The one and only problem with this, which currently has a "security through obscurity" solution, is that anyone can run a regex and remove +docusign to get at the primary, main inbox: jsmith747@gmail.com

3. The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example "j45rsdfjdocusign" which is linked to jsmith747 in a single direction. Sending mail is not necessary. This must be enabled through the Gmail interface for signed-in users who wish to create a new inbox. They must be able to generate an inbox there, which thereafter goes to the inbox.

4. Spammers have no way to programmatically get the original underlying address when going through a list. When they get to j45rsdfjdocusign there is no regex they can apply to get the original.

5. If in the future j45rsdfjdocusign starts getting spammed, etc, you can add a filter.

There's no special authentication around it, anyone signed into their inbox should be able to do do it. They already have the infrastructure up for it around their + coding shceme.

To emphasize how important it is, here is a comment from this thread:

>The phishing emails had the color scheme changed, making them very phony and easy to classify.

Today. Under the current status quo, if in 48 months a much more legitimate-looking mail is sent to any of the same addresses, none of the recipients have any way to know the source of those addresses.

However, after solving this security issue, in 48 months anyone receiving even a very convincing phishing email could know instantly "oh, that is that compromised docusign account" -- that is, if they haven't taken a moment to redirect that inbox to the trash already via a filter.

I urge Google, who has very talented engineers, to implement the correct solution today. Don't wait. You won't get a better example of how important this is, than what's been going on. There are no policy implications as you already do it via the + trick.

I hope you go the extra mile and add a small step to finish solving the problem. Thank you.

Re: DocuSign email address database breached and used for phishing campaign

#50

Post by Kiro »

graystevens wrote: post #39

This is the exact reason I started building Breach Canary[0], so that businesses can be alerted as soon as their user data is used in a way they wouldn't expect it to be. We produce authentic users with real working email addresses and phone numbers, so that as soon as they are contacted, you know someone has a copy of your userbase and is using it for reason x. We have already started seeing a tonne of DocuSign phis…

I presume canary is an established term in this context but since I don't know what it is I don't understand your service. It sounds good though.
Post reply on HN