7 ms·
DocuSign email address database breached and used for phishing campaign
- gogopuppygogo 9y agoLooks like it took them about six days to figure out why their customers were getting spammed. It'd be helpful if they could outline what the "non-core system that allows us to communicate service-related announcements to users via email" actually was. Was this a Mailchimp account that got hacked into or did they have something they managed?
- closeparen 9y agoEmails and email addresses are very different in the context of DocuSign. The former includes the text of contracts. The latter is just a list of people who have ever given or received a job offer.
- runesoerensen 9y agoThanks, I've updated the title to specify user email addresses to avoid any confusion
- krallja 9y agoI have also used DocuSign to buy a house and receive stock options. It's used all over the edges of the legal system.
- gloverkcn 9y agoSomeone asked me to pay a bill using docusign and entering my credit card information into one of those free text boxes They couldn't understand why I refused to do it.
- cottsak 9y agoApparently it's as safe as entering credit card details into another online merchants form who is PCI compliant. https://support.docusign.com/en/answers/00004343 https://support.docusign.com/en/answers/00004343
- tyingq 9y agoIt doesn't really spell out, though, how they differentiate CC info and avoid storing it with the rest of the data in the pdf form. There's just some hand wavy language about "Bank-grade Security". I suspect this means they store the CC data, which would be significantly different from how must online merchants operate.
- Drisc0 9y agoAs someone who has worked on a similar product, I would imagine they only store a token given to them by their payment gateway. The actual CC information is held by the PCI compliant payment gateway, while Docusign can use the token to charge a card without storing compromising information.
- tyingq 9y agoWould be good if that were spelled out though. From the outside, you click a link and see a pre-filled PDF, as both the end user and the person that sent the form. There's no obvious magic that it's auto-detecting cc like data and storing it differently than the other fields in the pdf.
- chatmasta 9y agoWith credit cards, you personally do not have much to worry about, since your card issuer holds the ultimate liability for any fraud that occurs. Just be careful to use a credit card (attached to a reversible ledger) and not a debit card (attached to a less-reversible cash account).
- cottsak 9y agoSure they're different but make no mistake: emails being breached are a big deal! This is an appropriate response https://twitter.com/troyhunt/status/864315287092342785 https://twitter.com/troyhunt/status/864315287092342785
- cavisne 9y agoAs troy hunt himself wrote... https://www.troyhunt.com/im-sorry-but-your-email-address-is-not/ https://www.troyhunt.com/im-sorry-but-your-email-address-is-... This is annoying but not a big deal or a privacy breach, DocuSign is so prevalent your email being in there means basically nothing.
- cottsak 9y agoDisagree https://www.troyhunt.com/im-sorry-but-your-email-address-is-not/#comment-3307908846 https://www.troyhunt.com/im-sorry-but-your-email-address-is-...
- peteretep 9y agoThis incorrectly assumes it's much more valuable to only spam people with access to a service than just a list of people, and I doubt that holds in practice
- cottsak 9y agoRead the comment again. It's about phishing specifically. Not generic spam. And it absolutely holds in practise that interaction rates go up for phishing messages when the user has a legitimate account with the service being impersonated.
- pmiller2 9y agoI fail to see how slightly wider dissemination of a bit of info I post publicly on my profile at this very web site constitutes a privacy or security risk to me.
- Kiro 9y agoJob offer? DocuSign is used for all kind of things.
- posixplz 9y agoEmails from DocuSign do not contain the text of the contract. They contain a link to the contract and its text. I've signed a bunch of contracts via DocuSign and that's the consistent pattern I've observed.
- KirinDave 9y agoThanks Every Employer I've Had In the Past 6 Years For Putting My Email In A Service I'd Never Want Otherwise. Also Thanks Me for just using docusign w/ our employees when I was in charge.
- Xylakant 9y agoI strictly started handing out "companyname@mypersonaldomain.tld" as email when interacting with companies. That at least makes routing the inevitable spam to the trash bin slightly easier when a breach occurs. It also provides an indicator of who has (in)voluntarily given away my data.
- Avalyst 9y agoI do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character
- Xylakant 9y agoThe other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.
- Avalyst 9y agoYep, it's not foolproof but it's better than nothing. And considering that the number of people using it aren't that many (I guess) spammers wouldn't bother
- corobo 9y agoIf I were a spammer I'd loop through my email address list and strip out + and anything between it and @
- darkhorn 9y ago
- janwillemb 9y agoIn my opinion they're doing well taking responsibility like this and communicating honestly and openly. You can always disagree on how far the openness should go, but I've seen far less openness and far less communication (as in approaching zero), so they deserve some credit doing it this way.
- deleted 9y ago[deleted]
- janwillemb 9y agoOne of the reasons is that they want to warn against phishing mails which seem to be actively sent to the breached addresses.
- stevecalifornia 9y agoCalifornia requires notification of things like email.
- partycoder 9y agoThe phishing emails had the color scheme changed, making them very phony and easy to classify.
- welpwelp 9y agoThey still got me! :>
- lihan 9y agoAre there more to email addresses that were leaked? how do we know they did not?
- Kenji 9y ago>The emails “spoofed” the DocuSign brand in an attempt to trick recipients into opening an attached Word document that, when clicked, installs malicious software. I love how nothing changed about this malware payload delivery in about 2 decades.
- annnnd 9y ago> Ensure your anti-virus software is enabled and up to date Uh, really, endorsing antivirus? They could at least have written something like "Ensure your system is properly secured" if they felt they need to stress that out.
- jrochkind1 9y agoAnd ~90% of the recipients would think "ensure my system is properly secured? How the heck do I do that?"
- rkeene2 9y agoWell, atleast now they are THINKING about how they might do that rather relying on the mystical protection spell of antivirus which usually reduces the security posture of the machine.
- withinrafael 9y agoI'm not sure DocuSign has a full handle on what happened here yet. I received six (6) DocuSign emails, half of which used a convincing subject derived from actual DocuSign documents I have signed or processed through the system. Perhaps a coincidence? Or these hackers gained access to more than just "email addresses".
- secfirstmd 9y agoHmmm yes I have received a few and if I recall, some of them had titles very similar to docusign documents I was previously sent. Exact titles similar to this: "Accounting Invoice 630761 Document Ready for Signature"
- user5994461 9y agoThe postmortem states that the phishing campaign used only a few patterns. "Delete any emails with the subject line, “Completed: [domain name] – Wire transfer for recipient-name Document Ready for Signature” and “Completed [domain name/email address] – Accounting Invoice [Number] Document Ready for Signature”. These emails are not from DocuSign. They were sent by a malicious third party and contain a link to malware spam." Did you received phishing with other subjects?
- koolba 9y agoAs a general rule, if you receive an email referencing wire transfers, it's probably bogus.
- defined 9y agoOk, they deserve credit for openness, definitely. Is it just me that feels this way, or should they not also apologize for the leak (which appears to have been from one of their systems)? I didn't see an actual apology.
- aerovistae 9y agoWow, I just signed up for this today. Unbelievable. The timing.
- graystevens 9y agoThis is the exact reason I started building Breach Canary[0], so that businesses can be alerted as soon as their user data is used in a way they wouldn't expect it to be. We produce authentic users with real working email addresses and phone numbers, so that as soon as they are contacted, you know someone has a copy of your userbase and is using it for reason x. We have already started seeing a tonne of DocuSign phishing emails as others have mentioned. They were already a popular target for phishing users but now with very realistic documents the users are expecting? Nightmare. [0] https://BreachCanary.com https://BreachCanary.com
- timvdalen 9y agoThe second Get early access box says 'Entry your e-mail address' instead of 'Enter'. Looks cool though, I subscribed to the list.
- graystevens 9y agoThank you, I'll fix that now :) Serves me right for rushing out a landing page, after reading all the "you should start marketing yesterday" comments on startups! Edit: fixed
- Kiro 9y agoI presume canary is an established term in this context but since I don't know what it is I don't understand your service. It sounds good though.
- graystevens 9y agoApologies, you're right, it's not really covered as it's a bit of a niche industry term. It relates back to the days of coal mines, and the birds being used as an early warning system - https://en.m.wiktionary.org/wiki/canary_in_a_coal_mine https://en.m.wiktionary.org/wiki/canary_in_a_coal_mine
- SimbaOnSteroids 9y ago
- rodionos 9y agoIt's good to see major security issues featured on HN. As a consumer, I typically react by resetting credentials, checking configurations etc. I'm not involved in the IT security field so HN serves is one of the early warning systems for me.
- logicallee 9y agoI would like to urge the Google team to solve one aspect of this problem, forever. It takes no more than 20 minutes to prototype and then approximately 1 day to fully test the final solution that is necessary on their end to keep compromised emails from being fully compromised addresses forever, without any chance for you to ever know at any point in the future where mail REALLY comes from. Here is a description: 1 - Currently they (Google) correctly do 99% by allowing you to type a + after your email address to create a new inbox that is marked in a special way. For example if your address is jsmith747@gmail.com then you can give the company jsmith747+docusign@gmail.com when you sign up - that inbox goes to you and when you start receicing spam in the future to "jsmith747+docusign" you can tell how they got it. The phishing mails associated with this breach would have gone to the same place. 2. The one and only problem with this, which currently has a "security through obscurity" solution, is that anyone can run a regex and remove +docusign to get at the primary, main inbox: jsmith747@gmail.com 3. The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example "j45rsdfjdocusign" which is linked to jsmith747 in a single direction. Sending mail is not necessary. This must be enabled through the Gmail interface for signed-in users who wish to create a new inbox. They must be able to generate an inbox there, which thereafter goes to the inbox. 4. Spammers have no way to programmatically get the original underlying address when going through a list. When they get to j45rsdfjdocusign there is no regex they can apply to get the original. 5. If in the future j45rsdfjdocusign starts getting spammed, etc, you can add a filter. There's no special authentication around it, anyone signed into their inbox should be able to do do it. They already have the infrastructure up for it around their + coding shceme. To emphasize how important it is, here is a comment from this thread: >The phishing emails had the color scheme changed, making them very phony and easy to classify. Today. Under the current status quo, if in 48 months a much more legitimate-looking mail is sent to any of the same addresses, none of the recipients have any way to know the source of those addresses. However, after solving this security issue, in 48 months anyone receiving even a very convincing phishing email could know instantly "oh, that is that compromised docusign account" -- that is, if they haven't taken a moment to redirect that inbox to the trash already via a filter. I urge Google, who has very talented engineers, to implement the correct solution today. Don't wait. You won't get a better example of how important this is, than what's been going on. There are no policy implications as you already do it via the + trick. I hope you go the extra mile and add a small step to finish solving the problem. Thank you.
- marenkay 9y agoBeen receiving fishing mails for this myself and I highly doubt this has just been about email addresses, as the mail subjects contained titles of signed documents.
- icantdrive55 9y agoAnd that explains why I'm getting emails from Princess of whatever country. I had this one email reserved for important things; no more. (I had a feeling this company was just too slick for its own good.)
- westoque 9y agoSince there are now many occurrences of data breaches out there. I cannot stress enough the importance of a password manager and diversify-ing your passwords. This one I learned from Troy Hunt and never looked back. https://www.troyhunt.com/only-secure-password-is-one-you-cant/ https://www.troyhunt.com/only-secure-password-is-one-you-can...
- mariusmg 9y agoI've got a ton of these phishing email in the last week. They were all pointing to a russian website. Pretty bad security fuckup by Docusign.
- welpwelp 9y agoI did get an email from them which looked actually legit and opened it. It redirected me to a 404. Is there a chance I could've been compromised in any way? I'm guessing they couldn't have gotten much more than my IP address, maybe some cookies, all my passwords, private life?
- wjke2i9 9y agoIt amazes me that Facebook allows you to get pgp encrypted emails delivered from them[1], but docusign, a company whose only job is secure document signing via secret links in an email, does not. [1] https://www.facebook.com/notes/protect-the-graph/securing-email-communications-from-facebook/1611941762379302/ https://www.facebook.com/notes/protect-the-graph/securing-em...
- m103forme 9y agoI've been getting these fake DocuSign phishing emails for the last 2 weeks.