Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

fredbenenson.com

Post reply on HN
Print view View original

121–130 of 152 posts

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#121

Post by pests »

epistasis wrote: post #85
layer8 wrote: post #62

Earlier quoted context omitted.

Use @ as your email address when signing up, and check the To header when receiving emails. And/or, long-press or right-click on any link to inspect the linked domain.

If you don't control your own domain fully, almost all email services let you do: user+servicetag@domain.com And have it go to user@domain.com with the servicetag still in the To: field. At least, I have never encountered a problem with this.

Some sites (hulu maybe? iirc) strip off the + and treat it as a bare email, with dedupe checks and all that.

Spammers won't respect the + either, they will clean their list of any +tags before sending.

The best I've actually come across is to abuse gmails period policy. I haven't seen sites dedupe this or perform any other checks or manipulation.

If you have enough letters in your alias you can treat the possible period locations as binary. For example, pests@ would have 4 edible spots, so I could make 16 different dot addresses: pests@, pest.s@, pes.ts@, pes.t.s@, pe.sts@, pe.st.s@, [...], p.e.s.t.s@

Then you can just remember/record the decimal ID you used per site.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#122

Post by rphillips »

TZubiri wrote: post #111
rphillips wrote: post #91

If using GSuite then head to the Gmail admin panel and create a compliance rule with 2 regex expressions. 1. Add expressions to: If ALL of the following match the message. 2. Expression 1: Type: Advanced content match Location: Full headers Match type: Matches regex (?im)^from:\s SendGrid(?:\s+\w+) \s* \r\n]+>+$ 3. Expression 2: Type: Advanced content match Location: Sender header Match type: Not matches regex (?i)^[…

Making a custom rule for a specific sender feels like fighting a fire with a glass of water. It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider). The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught…

The first rule doesn't match a specific sender. Run it through a re2 regex tester.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#123

Post by technothrasher »

zahlman wrote: post #73
SketchySeaBeast wrote: post #30

Earlier quoted context omitted.

I don't know if the fact that it fully slipped into the absurd or the fact that it probably still worked on people is sadder. I do love the idea of voter registration oscillating back and fourth at 20 minutes intervals forever. Would make voting in the primaries way more exciting as the voter base kept flipping.

To me as a Canadian, the absurd part is that ordinary people are expected to have "registered" with a party (as opposed to registering with the independent organization that runs elections, like we do; they automate getting most of the voter roll from Revenue Canada, but this requires your explicit consent on the tax form).

I've never once registered with a party in the US. I always check "independent" on my voter registration. But I'm in a state with open primaries, so I can still vote in one or the other primary, even though I'm not registered with the party.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#124

Post by schnable »

buellerbueller wrote: post #78
LorenzoGood wrote: post #76

Earlier quoted context omitted.

This is just for primaries, you register to vote with the state as well.

Still absurd that "free" "democratic" elections are allowed to require party membership, even for the primary.

What's the purpose of a primary election? It's to select a party's candidate for a general election. It's not very obvious that this should even be a democratic process, but if it is, why shouldn't party members be the ones selecting their own candidates?

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#125

Post by schnable »

bdcravens wrote: post #77

I received one, though it was for adding a footer honoring MLK. I kinda thought it was odd, but did't think much of it, since I'm apparently not in the group that would be offended in any way. I wonder if the variation they use is random, or in any way location-based to maximize response (I'm in Texas). I've also received a bunch of API failure phishing emails, as well as some implying we needed to change our auth to…

I think the main motivator is that most people/businesses would not want their transactional emails to include political at all.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#126

Post by epistasis »

pests wrote: post #121
epistasis wrote: post #85

Earlier quoted context omitted.

If you don't control your own domain fully, almost all email services let you do: user+servicetag@domain.com And have it go to user@domain.com with the servicetag still in the To: field. At least, I have never encountered a problem with this.

Some sites (hulu maybe? iirc) strip off the + and treat it as a bare email, with dedupe checks and all that. Spammers won't respect the + either, they will clean their list of any +tags before sending. The best I've actually come across is to abuse gmails period policy. I haven't seen sites dedupe this or perform any other checks or manipulation. If you have enough letters in your alias you can treat the possible per…

> Spammers won't respect the + either, they will clean their list of any +tags before sending.

That's the entire point, if you get an email from the site but it doesn't include your +servicename tag then you immediately can immediately tell it's a phishing attempt or spam. If the tag is there it's not a 100% guarantee that it's legit, but absence of the tag is a big red flag.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#127

Post by schnable »

educasean wrote: post #52

Is this an education problem? Should the general public be more diligent in checking the sender domain of the emails they read? Is this a UX issue? Should email clients highlight and emphasize the sender domain more than their display name?

> Should the general public be more diligent in checking the sender domain of the emails they read?

yes

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#128

Post by Tossrock »

pixl97 wrote: post #99
kgeist wrote: post #60

I wonder why Gmail and other email providers don't just run an LLM/ML pipeline to detect phishing emails. It seems that matching an email's content with the sender's domain (and possibly analyzing the content behind links) would be enough to show, with high certainty, a warning like "Beware: this looks like a phishing email." Is it too expensive? Too many false positives?

>LLM/ML pipeline to detect phishing emails. I think you're about 20 years behind the times if you think they don't. There are a whole lot of problems with it when you start pressing the finer details like you list. For example, just look at the legit emails banks send out. They will tell you not to click links claiming to be your bank, then include links (claiming to be your bank) for more information. Simply put the…

It's true that a lot of established ML techniques were first popularized to fight spam (ie bayesian filtering), but it might also be the case that they're not applying the full might of eg Gemini-3-Pro to every email received. I suspect Gemini-3-Pro would do an effectively perfect job of determining if something is phishing, with negligible values in the false quadrants of the confusion matrix, but it's probably too expensive to use in that way. Which is why things like this can still slip through.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#129

Post by pests »

epistasis wrote: post #126
pests wrote: post #121

Earlier quoted context omitted.

Some sites (hulu maybe? iirc) strip off the + and treat it as a bare email, with dedupe checks and all that. Spammers won't respect the + either, they will clean their list of any +tags before sending. The best I've actually come across is to abuse gmails period policy. I haven't seen sites dedupe this or perform any other checks or manipulation. If you have enough letters in your alias you can treat the possible per…

> Spammers won't respect the + either, they will clean their list of any +tags before sending. That's the entire point, if you get an email from the site but it doesn't include your +servicename tag then you immediately can immediately tell it's a phishing attempt or spam. If the tag is there it's not a 100% guarantee that it's legit, but absence of the tag is a big red flag.

You can't tell who it came from though, unlike my method at least.

Also, the +tag could get lost though just normal data clean up / normalization.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#130

Post by TZubiri »

rezonant wrote: post #117
TZubiri wrote: post #111

Earlier quoted context omitted.

Making a custom rule for a specific sender feels like fighting a fire with a glass of water. It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider). The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught…

As explained in the article, the scammers are using compromised Sendgrid domains to send the phishing emails. This means the emails are going to pass SPF/DKIM. Those domains are apparently owned by legitimate businesses which are actual Sendgrid customers. The phishers just compromised their account and API credentials

There's some confusion here, there is a secondary compromise, but it's not very relevant.

The actual origin of the email: theraoffice.com

The fake origin of the email: SendGrid

There is a mismatch there, easy to detect. SendGrid was not compromised, and nothing was sent in the name of sendgrid or whatever.

Now the domain theraoffice might have been registered by an attacker, warmed up with some small fake traffic, and aged. Or it might have been compromised.

The previous email could have used sendgrid or mailchimp or google workspace, that's not very relevant. The SPF and DKIM would always pass, because SPF and DKIM verifies that the owner of theraoffice.com is the one sending the emails.

There might be a connection with SendGrid, but it's not at all accurately explained in the article, it may be as simple as SendGrid being a common phishing target of attackers just because they can get access to more email infrastructure for magnifying their reach, like a self-replicating virus.

Post reply on HN