Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

fredbenenson.com

Post reply on HN
Print view View original

101–110 of 152 posts

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#101

Post by pixl97 »

sakopov wrote: post #33

Is this a new trend in phishing emails? They appear to be using legitimate domains to bypass spam detection. Usually the domains are associated with legitimate companies who are completely oblivious. I always wondered how this works. Is it a broken contact form somewhere?

One way is to look for companies that have SPF records (or whatever the system is these days) that contain ranges/names of large providers like sendgrid. Then they test sending mails with those large providers names under said system until they get ones that go out, and launch a campaign.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#102

Post by cheschire »

epistasis wrote: post #98
cheschire wrote: post #89

Earlier quoted context omitted.

And then the spammers (or other illegitimate source) just add this to their processing… ^([^@+]+)\+[^@]*(@.*)$

The use case here is using a unique email address to help verify the sender of the email, it's not connected to spam usage.

So you’re suggesting the sender use the + modifier on the from address?

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#103

Post by SketchySeaBeast »

zahlman wrote: post #73
SketchySeaBeast wrote: post #30

Earlier quoted context omitted.

I don't know if the fact that it fully slipped into the absurd or the fact that it probably still worked on people is sadder. I do love the idea of voter registration oscillating back and fourth at 20 minutes intervals forever. Would make voting in the primaries way more exciting as the voter base kept flipping.

To me as a Canadian, the absurd part is that ordinary people are expected to have "registered" with a party (as opposed to registering with the independent organization that runs elections, like we do; they automate getting most of the voter roll from Revenue Canada, but this requires your explicit consent on the tax form).

This would kind of be the same as us (I'm Canadian too) registering with the NDP so we can vote for the next leader. But the level of lying on display here is just insane.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#104

Post by zahlman »

LorenzoGood wrote: post #76
zahlman wrote: post #73

Earlier quoted context omitted.

To me as a Canadian, the absurd part is that ordinary people are expected to have "registered" with a party (as opposed to registering with the independent organization that runs elections, like we do; they automate getting most of the voter roll from Revenue Canada, but this requires your explicit consent on the tax form).

This is just for primaries, you register to vote with the state as well.

In Canada, those votes happen independently as decided (deemed necessary) internally by the party, and public participation is much less common.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#105

Post by scosman »

SendGrid phishing emails are some of the best phishing emails. I get emails that there's elevated error rates on an API (`/v1/send`). Looks very legit, good design, reasonable call to action, some urgency which makes me want to click. They know from MX records I send email with Sendgrid, so it's well targeted. Easy catch when I see the domain, but other than that it's the best I've seen in years.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#106

Post by yunwal »

mothballed wrote: post #87
lbotos wrote: post #82

Earlier quoted context omitted.

How do you envision this working without the "opposing party" poisoning the vote to get a weaker opponent?

Can't they do that now? If I think my chosen primary guy is winning in a landslide I could just register for another party I don't like and vote for someone who I think is easier to beat.

You would still forfeit the ability to vote in your primary though. I do think there are people that do this, but most people want to vote in their primary regardless of whether it's a landslide.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#107

Post by epistasis »

cheschire wrote: post #102
epistasis wrote: post #98

Earlier quoted context omitted.

The use case here is using a unique email address to help verify the sender of the email, it's not connected to spam usage.

So you’re suggesting the sender use the + modifier on the from address?

Here's the suggestion:

>Use @ as your email address when signing up, and check the To header when receiving emails.

The user of the webservice specifies a unique email per webservice; knowledge of that unique email address serves as a hint that the email came from someone that has discovered that email address, i.e. the webservice itself.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#108

Post by yabones »

kgeist wrote: post #60

I wonder why Gmail and other email providers don't just run an LLM/ML pipeline to detect phishing emails. It seems that matching an email's content with the sender's domain (and possibly analyzing the content behind links) would be enough to show, with high certainty, a warning like "Beware: this looks like a phishing email." Is it too expensive? Too many false positives?

They do - well sort of.

The most essential check is SPF and DKIM which authenticate if the message has come from an authorized server. The problem is that most mail services are too lenient with mismatched sender identification. On one hand, people would be quite vocal about their mail provider sending way too much legitimate (but slightly misconfigured) mail to the spam folder. However it allows situations like to happen where the FROM header, the "From:" address, and the return path are all different.

Most mail systems have several stages of filters, and the first ones (checking authentication) are quite basic. After that, attachments, links, and contents are checked for known malware. Machine learning might kick in after this, if certain criteria are met. Mail security is very complicated and works well except for the times it falls flat on its face like this.

https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#109

Post by iamacyborg »

SoftTalker wrote: post #80
detourdog wrote: post #79

I can't think of one email I received from sendgrid I would consider legitimate. Anytime I receive an email distributed by sendgrid I have found it actually had no value to me. Sometimes it's from a business I have dealt with but I never wanted or was interested in the content.

Same impression. SendGrid, MailChimp, any of those are just enabling spam at the end of the day.

In the same way that all software engineers are building harmful products, yes, sure.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#110

Post by 1-more »

bell-cot wrote: post #92
buellerbueller wrote: post #78

Earlier quoted context omitted.

Still absurd that "free" "democratic" elections are allowed to require party membership, even for the primary.

Is actual party membership required? Or, in effect, are you just required to claim either that you're more of a cat person, or that you're more of a dog person?

Yeah it's the latter. The US does not have party membership the way that, say, the UK does. In many states, it's open primary. In Colorado, for instance, I get mailed Democratic and Republican primary ballots and can vote by mailing in either one. I think you get neither counted if you mail in both, but I have no idea; I've never tried it.

The last time anyone tried to poison a presidential election by promoting a weaker candidate on the other side in the US, it was the Democrats boosting Trump in 2016. It did not work out.

Post reply on HN