3 ms·

If accurate this means any mailgun user can pretend to be another one when sending email out- that's pretty damn bad. Since companies add mailgun to their SPF/D

by tedivm 5y ago

If accurate this means any mailgun user can pretend to be another one when sending email out- that's pretty damn bad. Since companies add mailgun to their SPF/DKIM records it means those spoofed emails will be hard to distinguish as fake.

kxrm 5y ago
I know it's accurate, I had another domain on my machine that was sending email through my account, on accident, and Mailgun did nothing to stop it.
- ecf 5y ago
  Judging by the reputation of the new Mailgun owner, I wouldn’t be surprised to find out this is a feature for scammers, not a bug.
vmception 5y ago
I have been trying to tell people that this is happening for years. More about that spoofers were doing it, not what tools they were using I didn’t know I needed proof because people often resorted to victim blaming even though I never fell for any of the emails
- kxrm 5y ago
  I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account. Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.
  - jrodom 5y ago
    Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.

by tedivm 5y ago

kxrm 5y ago

I know it's accurate, I had another domain on my machine that was sending email through my account, on accident, and Mailgun did nothing to stop it.

ecf 5y ago
Judging by the reputation of the new Mailgun owner, I wouldn’t be surprised to find out this is a feature for scammers, not a bug.

vmception 5y ago

I have been trying to tell people that this is happening for years. More about that spoofers were doing it, not what tools they were using I didn’t know I needed proof because people often resorted to victim blaming even though I never fell for any of the emails

kxrm 5y ago
I think it's difficult to prove, and the only people who care will be the domains owners that are impacted. If you send enough mail, you won't notice a few extra emails going out from another account. Mailgun should have a way to monitor and block this. We used SMTP to interface with Mailgun and frankly, I didn't even think of this as being a vulnerability until I left the service. The DMARC reports just prove it was happening.
- jrodom 5y ago
  Josh/CTO of Mailgun here - I took a look at this case and these messages were being sent from the sandbox feature of our service. The sandbox only allows messages to be sent to "authorized recipients" through an opt-in mechanism, which makes it impractical for spamming and phishing. The purpose of this feature is to allow customers to get comfortable with the interfaces and test the product in a safe way without having to add DKIM/SPF records. I reviewed these messages and confirmed there is no illicit behavior, likely just a misconfiguration from a user of radiotoolbox.