3 ms·

Regarding authenticity, from the TechCrunch article about this: > The networking company quickly followed its email with a post on its community pages confirmi

by nh2 6y ago

Regarding authenticity, from the TechCrunch article about this: > The networking company quickly followed its email with a post on its community pages confirming that the email was authentic, after several complained that the email sent to customers included typos. Indeed: How am I supposed to know whether this email is really from Ubiquiti? * There was apparently no official press release. * All links in the email, including the "Change password" button, are to e.g. `https://ui.us8.list-manage.com/track/click?u=somehexnumber&id=morehex&e=morehex https://ui.us8.list-manage.com/track/click?u=somehexnumber&i...`. * The delivering server is `mail42.atl11.rsgsv.net`, which the TLD of which doesn't seem to resolve in my browser to provide hints. * Various news sites that reported this either just referred to "emails people got", screenshots random people got via Twitter, or link to the Mailchimp site, for which I'm not sure how to verify whether the "ubnt" account actually belongs to Ubiquiti. Given this, how shall the normal affected user figure out that this isn't well-executed phishing? It seems companies could do a much better job making it obvious that their emails are legit. Especially if they were just breached, and "Change password" buttons are involved.

judge2020 6y ago
The real kicker is that the sender is no-reply@ubnt.com - why is it not @ui.com?
- archon810 6y ago
  ubnt.com is another one of their domains.
  - judge2020 6y ago
    My point is that it's very confusing when their main domain is ui.com and auth server is account.ui.com - there's seemingly no customer-facing reference to that domain.
  - Daho0n 6y ago
    Silly, I instantly thought "Ubuntu".
- cyberpunk 6y ago
  Generally you maybe don't want to include mailchimp's MX's in your SPF for your main corp domain, it's common to send such things either from a delegated (in dns terms) subdomain (e.g: mailings.ui.com which mailchimp can then manage the spf/dkim/etc records for) or more simply by just using one of your other domains..
dawnerd 6y ago
Yeah I was really suspect seeing two buttons like that in the email. They didn't really think that one through.
cutthegrass2 6y ago
The best user behaviour on receiving a potentially 'fishy' email is to not click any inks, but to go directly to the site in question and change your password, if you feel the email is genuine in anyway.
stronglikedan 6y ago
I missed a mortgage payment, because my mortgage company launched their "new" website as a subdomain on a primary domain that wasn't registered to them. They sent an email from that same domain, directing people to the new site. I tried to verify the authenticity of the email with their customer service team, but, crickets. No one bothered contacting me until they wanted to chase me down for the payment, at which point, I told them what a horrible practice it was, and insisted they remove the late fee. They did remove the fee, but the site and all related emails still look like phishing attempts. Not surprising really, given that the majority of companies double-down on stupid when called out for their blunders.
peeters 6y ago
The "change password" button leading to an opaque tracker is inexcusable. That said, the "safe" way to handle this is the same way you do with cold calls. Ignore any calls to action in the email, go to Ubiquiti's website on your own, and change your password. If it was a phishing attempt, worst case, you updated your password which is not a bad practice every once in a while.

by nh2 6y ago

judge2020 6y ago

The real kicker is that the sender is no-reply@ubnt.com - why is it not @ui.com?

archon810 6y ago
ubnt.com is another one of their domains.
- judge2020 6y ago
  My point is that it's very confusing when their main domain is ui.com and auth server is account.ui.com - there's seemingly no customer-facing reference to that domain.
- Daho0n 6y ago
  Silly, I instantly thought "Ubuntu".
cyberpunk 6y ago
Generally you maybe don't want to include mailchimp's MX's in your SPF for your main corp domain, it's common to send such things either from a delegated (in dns terms) subdomain (e.g: mailings.ui.com which mailchimp can then manage the spf/dkim/etc records for) or more simply by just using one of your other domains..

dawnerd 6y ago

Yeah I was really suspect seeing two buttons like that in the email. They didn't really think that one through.

cutthegrass2 6y ago

The best user behaviour on receiving a potentially 'fishy' email is to not click any inks, but to go directly to the site in question and change your password, if you feel the email is genuine in anyway.

stronglikedan 6y ago

I missed a mortgage payment, because my mortgage company launched their "new" website as a subdomain on a primary domain that wasn't registered to them. They sent an email from that same domain, directing people to the new site. I tried to verify the authenticity of the email with their customer service team, but, crickets. No one bothered contacting me until they wanted to chase me down for the payment, at which point, I told them what a horrible practice it was, and insisted they remove the late fee. They did remove the fee, but the site and all related emails still look like phishing attempts. Not surprising really, given that the majority of companies double-down on stupid when called out for their blunders.

peeters 6y ago

The "change password" button leading to an opaque tracker is inexcusable. That said, the "safe" way to handle this is the same way you do with cold calls. Ignore any calls to action in the email, go to Ubiquiti's website on your own, and change your password. If it was a phishing attempt, worst case, you updated your password which is not a bad practice every once in a while.