Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NameCheap's email hacked to send Metamask, DHL phishing emails

bleepingcomputer.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#21

Post by ginja »

NamecheapCEO wrote: post #5
splittydev wrote: post #4

Seems like the hackers also had access to at least some customer data. Several people I know who were also Namecheap clients, including me, received those emails. Whether that data was also stored with the upstream provider remains to be seen. Might be an even bigger deal.

A third part email provider we use for our newsletter was impacted. Our own systems and customer accounts were not breached.

What customer information did you store with that provider? Just names and emails, or was there anything else that attackers may have been able to access?

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#22

Post by walrus01 »

NamecheapCEO wrote: post #18

To be clear, the issue was with a 3rd party provider that we use to send our newsletter. None of our own systems or customer accounts where breached. I sent a follow up email to all users that were affected. The domains linked in the original phishing emails were also disabled. I apologize for this issue and to anyone it may have affected. We have also taken immediate steps to insure it will not happen again.

Can you please clarify how exactly the decision making process occurred to give a 3rd party email provider a copy of your private DKIM signing key for the domain "namecheap.com" ?

The emails could not have gone out with DKIM-signature and successfully validated by openDKIM at my receiving MX/SMTPD against the public half of the key in your DNS TXT record for your DKIM key, unless you had given them access to the private key.

Did the persons who are responsible for creating and maintaining your DKIM public/private key pair and its selectors directly give the key to some third party (sendgrid, mailchimp, whatever) type email newsletter services, or were they ordered to do so by somebody else in Namecheap management?

Or, did the persons responsible for your authoritative DNS zone for namecheap.com insert an additional DNS TXT record for the DKIM key used by a 3rd party service?

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#23

Post by oneplane »

walrus01 wrote: post #22
NamecheapCEO wrote: post #18

To be clear, the issue was with a 3rd party provider that we use to send our newsletter. None of our own systems or customer accounts where breached. I sent a follow up email to all users that were affected. The domains linked in the original phishing emails were also disabled. I apologize for this issue and to anyone it may have affected. We have also taken immediate steps to insure it will not happen again.

Can you please clarify how exactly the decision making process occurred to give a 3rd party email provider a copy of your private DKIM signing key for the domain "namecheap.com" ? The emails could not have gone out with DKIM-signature and successfully validated by openDKIM at my receiving MX/SMTPD against the public half of the key in your DNS TXT record for your DKIM key, unless you had given them access to the priv…

While I don't know the details of the third party at name cheap, it's pretty common to have a bunch of third parties with their own DKIM keys and just trusting and including their public keys on your DNS zone. Nobody sends all their own mail, your service desk, support software, ticketing system, alerting system, collaboration provider all have DKIM keys and SPF records you're adding to your zone and they just control the keys for their own input.

This means that if they get pwned, it's their ability to send mail on your behalf that gets abused, not some key stealing and DKIM impersonation (and why would they bother if a perfectly fine emailing system is already open and ready to spam the crap out of everyone).

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#24

Post by clarifyitto »

NamecheapCEO wrote: post #18

To be clear, the issue was with a 3rd party provider that we use to send our newsletter. None of our own systems or customer accounts where breached. I sent a follow up email to all users that were affected. The domains linked in the original phishing emails were also disabled. I apologize for this issue and to anyone it may have affected. We have also taken immediate steps to insure it will not happen again.

So… What happened? Did you get your keys stolen out of a CI or something? It just seems suspicious that you’d be the only business affected by this 3rd party provider.

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#25

Post by 28mm »

oneplane wrote: post #23
walrus01 wrote: post #22

Earlier quoted context omitted.

Can you please clarify how exactly the decision making process occurred to give a 3rd party email provider a copy of your private DKIM signing key for the domain "namecheap.com" ? The emails could not have gone out with DKIM-signature and successfully validated by openDKIM at my receiving MX/SMTPD against the public half of the key in your DNS TXT record for your DKIM key, unless you had given them access to the priv…

While I don't know the details of the third party at name cheap, it's pretty common to have a bunch of third parties with their own DKIM keys and just trusting and including their public keys on your DNS zone. Nobody sends all their own mail, your service desk, support software, ticketing system, alerting system, collaboration provider all have DKIM keys and SPF records you're adding to your zone and they just contro…

I received one of the phishing messages as well as the follow up / apology. An interesting wrinkle is that both were handled by sendgrid and used the same dkim selector. I would guess that a set of sendgrid api credentials shared with some 3rd party service was compromised.

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#26

Post by walrus01 »

LAC-Tech wrote: post #10

God damn it, my main business email account is namecheap. I am so sick of them, they let so much spam in to my inboxes as well. If I have a domain from namecheap, and an email address with that domain, can I transfer it to something solid like outlook or gmail? My idea of how email works is really fuzzy.

1) you will need to point the DNS MX records to office365 or gsuite or fastmail or any other service

2) sign up with that service and input the domain name, do the rest of the configuration.

There is a huge blurry overlap between domain registrar and hosting services these days. It sounds like you are using Namecheap for both. I would highly recommend using domain registrars as ONLY domain registrars and having other things hosted elsewhere.

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#27

Post by iinnPP »

LAC-Tech wrote: post #10

God damn it, my main business email account is namecheap. I am so sick of them, they let so much spam in to my inboxes as well. If I have a domain from namecheap, and an email address with that domain, can I transfer it to something solid like outlook or gmail? My idea of how email works is really fuzzy.

I just wanted to add another note in favor of Fastmail. I switched from Gmail this year as part of an early new year's resolution and have been far happier with their service thus far. Especially with how aliases are handled.

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#28

Post by oneplane »

28mm wrote: post #25
oneplane wrote: post #23

Earlier quoted context omitted.

While I don't know the details of the third party at name cheap, it's pretty common to have a bunch of third parties with their own DKIM keys and just trusting and including their public keys on your DNS zone. Nobody sends all their own mail, your service desk, support software, ticketing system, alerting system, collaboration provider all have DKIM keys and SPF records you're adding to your zone and they just contro…

I received one of the phishing messages as well as the follow up / apology. An interesting wrinkle is that both were handled by sendgrid and used the same dkim selector. I would guess that a set of sendgrid api credentials shared with some 3rd party service was compromised.

I've seen it even worse:

  - One of our domains had a DKIM trust with Mailgun (3rd party)
  - Mailgun was integrated with a planning service (4th party?)
  - Planning service was integrated with a CRM (5th party?)
  - CRM was integrated with a website (6th party?)
Website got pwned, spam ensues using the entire chain all the way back to our domain. This was a while ago but I think the website was pwned, leaked API credentials for the CRM, those were locked to only read the address book for sources (not even destinations! but '*' was allowed...) but because the software was crap the planning/calendaring service was registered as a 'source', which included API creds. The planning service itself was pretty good, no further grab-keys-via-API, but using what was already allowed you could send raw MIME messages and it would just use the Mailgun API it had access to.

Luckily for me, I was on a prometheus spree and had an exporter grab the Mailgun metrics every few minutes (Ironically to support the CRM team because they didn't have any good metrics of their own and did like to blame everyone else), so while it was configured to look for dips, it also triggered on spikes because those tend to end with dips too.

I think in the end nobody learned from it because every team/vendor covered their ass with "well we only run it in datacenters with firewalls so this is the cloud at fault" and I don't think anyone got flak for it (but some definitely deserved a fair bit).

Re: NameCheap's email hacked to send Metamask, DHL phishing emails

#29

Post by TylerE »

iinnPP wrote: post #27
LAC-Tech wrote: post #10

God damn it, my main business email account is namecheap. I am so sick of them, they let so much spam in to my inboxes as well. If I have a domain from namecheap, and an email address with that domain, can I transfer it to something solid like outlook or gmail? My idea of how email works is really fuzzy.

I just wanted to add another note in favor of Fastmail. I switched from Gmail this year as part of an early new year's resolution and have been far happier with their service thus far. Especially with how aliases are handled.

If only their app and spam filtering weren’t garbage. I made the move from gmail a while ago but it’s been kinda meh tbh.
Post reply on HN