Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

fredbenenson.com

Post reply on HN
Print view View original

111–120 of 152 posts

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#111

Post by TZubiri »

rphillips wrote: post #91

If using GSuite then head to the Gmail admin panel and create a compliance rule with 2 regex expressions. 1. Add expressions to: If ALL of the following match the message. 2. Expression 1: Type: Advanced content match Location: Full headers Match type: Matches regex (?im)^from:\s SendGrid(?:\s+\w+) \s* \r\n]+>+$ 3. Expression 2: Type: Advanced content match Location: Sender header Match type: Not matches regex (?i)^[…

Making a custom rule for a specific sender feels like fighting a fire with a glass of water.

It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider).

The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught by SPF/DKIM.

Most of the time the user doesn't need to do much, you can just be weary of sender domains, and report the email as phishing and help blacklist that specific IP address/domain. Similar to how in medicine sometimes the physician tells you to drink water and rest, no medicine needed, just let the immune system do its thing.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#112

Post by cheschire »

epistasis wrote: post #107
cheschire wrote: post #102

Earlier quoted context omitted.

So you’re suggesting the sender use the + modifier on the from address?

Here's the suggestion: >Use @ as your email address when signing up, and check the To header when receiving emails. The user of the webservice specifies a unique email per webservice; knowledge of that unique email address serves as a hint that the email came from someone that has discovered that email address, i.e. the webservice itself.

Right, so 99% of the time that’s a spammer that is going to use that discovered email. I updated my message to specify other illegitimate sources to cover that less than 1%

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#113

Post by creeble »

scosman wrote: post #105

SendGrid phishing emails are some of the best phishing emails. I get emails that there's elevated error rates on an API (`/v1/send`). Looks very legit, good design, reasonable call to action, some urgency which makes me want to click. They know from MX records I send email with Sendgrid, so it's well targeted. Easy catch when I see the domain, but other than that it's the best I've seen in years.

I've been getting them for weeks and never noticed they were phishing.

I only used a SendGrid account briefly, as a potential backup to my current outgoing transaction mail provider. Sent exactly 5 test emails I think.

The ICE one this morning gave me pause, but only about 2s before I deleted it and moved on with my busy day of reading HN posts.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#114

Post by krapp »

barbazoo wrote: post #17
etyp wrote: post #13

Earlier quoted context omitted.

There is a chance that the title here was intentionally worded to answer a question people are likely to search for, then actually answer their concerns.

Then the "alternative AI-generated title next to the original title" would say so.

HN would never do that, it would violate the minimalism of the site.

Most people aren't even aware that their posted URLs can be changed or their titles re-edited automatically because the UI doesn't give affordances for anything. You're just expected to notice and edit it out within the edit window (which there also isn't an affordance for.)

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#115

Post by tonymet »

It would be good to hold carriers accountable for fishing and spam. Sendgrid , Twilio and other saas messaging carriers need to do a better job with integrity. I don’t expect them to carry the whole burden, but some negative incentive to promote investment . It could be as simple as enforcing sender pays metering . We all know spam is 60+ % of traffic, so sender pays would drive down spam very quickly

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#116

Post by layer8 »

zahlman wrote: post #71
layer8 wrote: post #62

Earlier quoted context omitted.

Use @ as your email address when signing up, and check the To header when receiving emails. And/or, long-press or right-click on any link to inspect the linked domain.

What fraction of people do you suppose actually have a to do this with? Even some highly technically inclined people (like myself) can be entirely ignorant of the process. It's not as if consumer ISPs provide the service.

The process isn’t difficult and worth acquainting yourself with.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#117

Post by rezonant »

TZubiri wrote: post #111
rphillips wrote: post #91

If using GSuite then head to the Gmail admin panel and create a compliance rule with 2 regex expressions. 1. Add expressions to: If ALL of the following match the message. 2. Expression 1: Type: Advanced content match Location: Full headers Match type: Matches regex (?im)^from:\s SendGrid(?:\s+\w+) \s* \r\n]+>+$ 3. Expression 2: Type: Advanced content match Location: Sender header Match type: Not matches regex (?i)^[…

Making a custom rule for a specific sender feels like fighting a fire with a glass of water. It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider). The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught…

As explained in the article, the scammers are using compromised Sendgrid domains to send the phishing emails. This means the emails are going to pass SPF/DKIM. Those domains are apparently owned by legitimate businesses which are actual Sendgrid customers. The phishers just compromised their account and API credentials

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#118

Post by Izkata »

1-more wrote: post #110
bell-cot wrote: post #92

Earlier quoted context omitted.

Is actual party membership required? Or, in effect, are you just required to claim either that you're more of a cat person, or that you're more of a dog person?

Yeah it's the latter. The US does not have party membership the way that, say, the UK does. In many states, it's open primary. In Colorado, for instance, I get mailed Democratic and Republican primary ballots and can vote by mailing in either one. I think you get neither counted if you mail in both, but I have no idea; I've never tried it. The last time anyone tried to poison a presidential election by promoting a we…

For an alternate example, in Illinois you choose one at primary election time and only get that one. This year the options are Democrat, Republican, Libertarian, and Non-Partisan (which means only the referendums, not the elections).

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#119

Post by rezonant »

creeble wrote: post #113
scosman wrote: post #105

SendGrid phishing emails are some of the best phishing emails. I get emails that there's elevated error rates on an API (`/v1/send`). Looks very legit, good design, reasonable call to action, some urgency which makes me want to click. They know from MX records I send email with Sendgrid, so it's well targeted. Easy catch when I see the domain, but other than that it's the best I've seen in years.

I've been getting them for weeks and never noticed they were phishing. I only used a SendGrid account briefly, as a potential backup to my current outgoing transaction mail provider. Sent exactly 5 test emails I think. The ICE one this morning gave me pause, but only about 2s before I deleted it and moved on with my busy day of reading HN posts.

That would seem to imply they weren't checking MX as I presume you have removed Sendgrid from your SPF allowed senders policy by now.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#120

Post by ZoneZealot »

rezonant wrote: post #117
TZubiri wrote: post #111

Earlier quoted context omitted.

Making a custom rule for a specific sender feels like fighting a fire with a glass of water. It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider). The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught…

As explained in the article, the scammers are using compromised Sendgrid domains to send the phishing emails. This means the emails are going to pass SPF/DKIM. Those domains are apparently owned by legitimate businesses which are actual Sendgrid customers. The phishers just compromised their account and API credentials

SendGrid's platform doesn't need to be the sender of these emails at all. It's just classic phishing, the emails can pass SPF, DKIM and DMARC as all of these rely on DNS resource records to be created on the RFC5321.MailFrom and/or RFC5322.From domain. Which is under control of the spammer. It's not pretending to be from sendgrid.com, if it was then these measures would help.
Post reply on HN