Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

fredbenenson.com

Post reply on HN
Print view View original

91–100 of 152 posts

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#91

Post by rphillips »

If using GSuite then head to the Gmail admin panel and create a compliance rule with 2 regex expressions.

1. Add expressions to: If ALL of the following match the message.

2. Expression 1: Type: Advanced content match Location: Full headers Match type: Matches regex (?im)^from:\sSendGrid(?:\s+\w+)\s*\r\n]+>+$

3. Expression 2: Type: Advanced content match Location: Sender header Match type: Not matches regex (?i)^[A-Za-z0-9._%+-]+@(sendgrid\.com|twilio\.com)$

Set the rule to reject or quarantine. Users will not see the messages unless the attackers change the From header.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#92

Post by bell-cot »

buellerbueller wrote: post #78
LorenzoGood wrote: post #76

Earlier quoted context omitted.

This is just for primaries, you register to vote with the state as well.

Still absurd that "free" "democratic" elections are allowed to require party membership, even for the primary.

Is actual party membership required?

Or, in effect, are you just required to claim either that you're more of a cat person, or that you're more of a dog person?

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#93

Post by lagniappe »

plorkyeran wrote: post #90
detourdog wrote: post #79

I can't think of one email I received from sendgrid I would consider legitimate. Anytime I receive an email distributed by sendgrid I have found it actually had no value to me. Sometimes it's from a business I have dealt with but I never wanted or was interested in the content.

Do you specifically go out of your way to check who sent every transactional email you receive and take notes on which email sending service your order confirmation was sent by? That would be a very weird thing to do and would be the only way to know that.

Weird? Do you know where you are? We're all nerds here, in many shades of what you label as 'weird'.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#94

Post by Terretta »

roboror wrote: post #83
zahlman wrote: post #71

Earlier quoted context omitted.

What fraction of people do you suppose actually have a to do this with? Even some highly technically inclined people (like myself) can be entirely ignorant of the process. It's not as if consumer ISPs provide the service.

Sub-addressing (doing tag+handle@domain.com) is supported by many email services but + may be flagged as an illegal character.

at least hotmail, gmail, apple's various mail, though with apple just using hide my email is that whole idea fully and beautifully automated for normies

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#95

Post by Terretta »

agwa wrote: post #54

2FA doesn't stop phishing unless it's WebAuthn. But SendGrid, which is owned by Twilio, only supports 2FA based on SMS or the Authy App (which is also made by Twilio): https://www.twilio.com/docs/sendgrid/ui/account-and-settings... It seems like Twilio has a conflict of interest that prevents them from offering WebAuthn, as that would be a tacit admission that their SMS and Authy products are not actually that secure…

rich irony that twilio numbers don't qualify to receive SMS codes when senders check if it's a virtual number (the regulated aka important ones do check)

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#96

Post by detourdog »

plorkyeran wrote: post #90
detourdog wrote: post #79

I can't think of one email I received from sendgrid I would consider legitimate. Anytime I receive an email distributed by sendgrid I have found it actually had no value to me. Sometimes it's from a business I have dealt with but I never wanted or was interested in the content.

Do you specifically go out of your way to check who sent every transactional email you receive and take notes on which email sending service your order confirmation was sent by? That would be a very weird thing to do and would be the only way to know that.

When I receive email that is not from someone I know or understand why I receive it I check the source.

I don’t like receiving email that are not directly relevant to me.

This does mean that if it’s an order confirmation I wouldn’t check. So I may not know of legitimate emails from sendgrid only the illegitimate.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#97

Post by detourdog »

lagniappe wrote: post #93
plorkyeran wrote: post #90

Earlier quoted context omitted.

Do you specifically go out of your way to check who sent every transactional email you receive and take notes on which email sending service your order confirmation was sent by? That would be a very weird thing to do and would be the only way to know that.

Weird? Do you know where you are? We're all nerds here, in many shades of what you label as 'weird'.

True this is HN. I’m being curiosity shamed:). Most of the phishing attempts I get are Gmail.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#98

Post by epistasis »

cheschire wrote: post #89
epistasis wrote: post #85

Earlier quoted context omitted.

If you don't control your own domain fully, almost all email services let you do: user+servicetag@domain.com And have it go to user@domain.com with the servicetag still in the To: field. At least, I have never encountered a problem with this.

And then the spammers (or other illegitimate source) just add this to their processing… ^([^@+]+)\+[^@]*(@.*)$

The use case here is using a unique email address to help verify the sender of the email, it's not connected to spam usage.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#99

Post by pixl97 »

kgeist wrote: post #60

I wonder why Gmail and other email providers don't just run an LLM/ML pipeline to detect phishing emails. It seems that matching an email's content with the sender's domain (and possibly analyzing the content behind links) would be enough to show, with high certainty, a warning like "Beware: this looks like a phishing email." Is it too expensive? Too many false positives?

>LLM/ML pipeline to detect phishing emails.

I think you're about 20 years behind the times if you think they don't.

There are a whole lot of problems with it when you start pressing the finer details like you list. For example, just look at the legit emails banks send out. They will tell you not to click links claiming to be your bank, then include links (claiming to be your bank) for more information.

Simply put the rules block too much corporate email because people that write corporate email do lots of dumb things with the email system.

Re: SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack

#100

Post by citizenpaul »

martey wrote: post #22

" The fundamental issue is that SendGrid’s business model depends on making it easy for legitimate businesses to send email at scale. " I disagree with this conclusion, if not only because other email service providers don't have this issue. It wouldn't surprise me if something was broken with SendGrid's internal infrastructure. I used to be a SendGrid customer until my deliverability started being affected by this i…

>closed my SendGrid account ....continued to send me monthly invoices

I used to run IT for a medium company. The amount of times I saw this with various SaaS companies was troubling. We had hundreds of services some as small as a single manager that demanded X and company wide tools. It was frequently a several months long hassle to get them to stop billing us when we cut ties with them. I wish I kept personal records now it was a minority but definitely in the 15%'ish range.

Post reply on HN