Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DocuSign email address database breached and used for phishing campaign

trust.docusign.com

Post reply on HN
Print view View original

111–120 of 141 posts

Re: DocuSign email address database breached and used for phishing campaign

#111

Post by glenneroo »

JabavuAdams wrote: post #93
pwg wrote: post #78

Earlier quoted context omitted.

> The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example "j45rsdfjdocusign" which is linked to jsmith747 in a single direction. When hosting your own email on your own domain you get this benefit out of the box now, without waiting for google to add it for you. I've been doing this for years, each different company gets a unique email address. Real easy to see…

That solves this one issue, but now you're fully responsible for your email server's security. While this may be a feature for some, for the general (developer) public, it's a bug.

Many cheap hosting services offer catch-all email option for your domains, and my own experiences using various services says it's generally included in the price i.e. "free".

Re: DocuSign email address database breached and used for phishing campaign

#112

Post by jrs235 »

smhenderson wrote: post #94
withinrafael wrote: post #32

I'm not sure DocuSign has a full handle on what happened here yet. I received six (6) DocuSign emails, half of which used a convincing subject derived from actual DocuSign documents I have signed or processed through the system. Perhaps a coincidence? Or these hackers gained access to more than just "email addresses".

At my work we too have received dozens of phishing emails purportedly from DocuSign. Most are getting caught but a few are making it to people's inbox. Which is terrible because a lot of my coworkers use DocuSign and think nothing of clicking on a link in one of these rather convincing emails.

As a real estate agent DocuSign is used immensely. Not just by agents, but the documents are sent to customers and clients who are probably more susceptible to these types of scams. Sigh.

Re: DocuSign email address database breached and used for phishing campaign

#113

Post by lanaius »

jrs235 wrote: post #112
smhenderson wrote: post #94

Earlier quoted context omitted.

At my work we too have received dozens of phishing emails purportedly from DocuSign. Most are getting caught but a few are making it to people's inbox. Which is terrible because a lot of my coworkers use DocuSign and think nothing of clicking on a link in one of these rather convincing emails.

As a real estate agent DocuSign is used immensely. Not just by agents, but the documents are sent to customers and clients who are probably more susceptible to these types of scams. Sigh.

Wife and I just closed on our home - good thing this didn't happen DURING the process as we got a ton of DocuSign requests.

Re: DocuSign email address database breached and used for phishing campaign

#114

Post by Drisc0 »

tyingq wrote: post #104
cottsak wrote: post #8

Earlier quoted context omitted.

Apparently it's as safe as entering credit card details into another online merchants form who is PCI compliant. https://support.docusign.com/en/answers/00004343

It doesn't really spell out, though, how they differentiate CC info and avoid storing it with the rest of the data in the pdf form. There's just some hand wavy language about "Bank-grade Security". I suspect this means they store the CC data, which would be significantly different from how must online merchants operate.

As someone who has worked on a similar product, I would imagine they only store a token given to them by their payment gateway. The actual CC information is held by the PCI compliant payment gateway, while Docusign can use the token to charge a card without storing compromising information.

Re: DocuSign email address database breached and used for phishing campaign

#115

Post by rkeene2 »

jrochkind1 wrote: post #99
annnnd wrote: post #28

> Ensure your anti-virus software is enabled and up to date Uh, really, endorsing antivirus? They could at least have written something like "Ensure your system is properly secured" if they felt they need to stress that out.

And ~90% of the recipients would think "ensure my system is properly secured? How the heck do I do that?"

Well, atleast now they are THINKING about how they might do that rather relying on the mystical protection spell of antivirus which usually reduces the security posture of the machine.

Re: DocuSign email address database breached and used for phishing campaign

#116

Post by Avalyst »

darkhorn wrote: post #64
corobo wrote: post #46

Earlier quoted context omitted.

If I were a spammer I'd loop through my email address list and strip out + and anything between it and @

Actually most of the web sites do not accept the + character.

Actually my experience is the opposite :)

Re: DocuSign email address database breached and used for phishing campaign

#117

Post by Avalyst »

Xylakant wrote: post #44
Avalyst wrote: post #40

Earlier quoted context omitted.

I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character

The other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.

Yep, it's not foolproof but it's better than nothing. And considering that the number of people using it aren't that many (I guess) spammers wouldn't bother

Re: DocuSign email address database breached and used for phishing campaign

#118

Post by lorenzhs »

dspillett wrote: post #84
wiredfool wrote: post #70

Earlier quoted context omitted.

A catchall on my domain was all fun and games till the second dictionary spam run.

I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall (company@sub.domain.tld). Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

Lots of sites also strip the "sub." part from the domain. I have no idea why they think this is a good idea, but a friend of mine does this and he's got at least ten companies in his main domain's alias table because they silently stripped the "sub." part.

Re: DocuSign email address database breached and used for phishing campaign

#119

Post by linsomniac »

dspillett wrote: post #84
wiredfool wrote: post #70

Earlier quoted context omitted.

A catchall on my domain was all fun and games till the second dictionary spam run.

I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall (company@sub.domain.tld). Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

Gmail allows you to do extension addresses like "myname+company@gmail.com", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?"

The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.

Re: DocuSign email address database breached and used for phishing campaign

#120

Post by lorenzhs »

wiredfool wrote: post #106
jawns wrote: post #100

Earlier quoted context omitted.

The way I get around that is by having a static keyword that must also appear on the user side of the email address. So, if I'm dealing with Walmart, I would give them: [keyword].walmart@example.com or walmart.[keyword]@example.com Then I configure my catch-all settings to reject any email addresses that don't have that keyword. Of course, the keyword is not secret, so it's possible for someone to infer what I'm doin…

Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver. (fwiw, this domain is almost 20 years old, so that's forever in internet years)

I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;)

https://www.fastmail.com/help/receive/domains.html

https://www.fastmail.com/help/receive/domains-setup-mxonly.h...

https://www.fastmail.com/help/receive/alias-catchall.html

https://www.fastmail.com/help/receive/addressing.html

https://www.fastmail.com/help/receive/domains-advanced.html

Post reply on HN