6 ms·

How did this PayPal spoof email pass SPF, DKIM and DMARC

269 points by mkj 5y ago

deleted 5y ago
[deleted]
cdot2 5y ago
So essentially they found an old dkim key which had been exposed and used that?
- fogihujy 5y ago
  Looks like it. It's a good idea to take down old keys after they have gone into disuse, to prevent things like this.
  - FDSGSG 5y ago
    It doesn't look like that at all, this is a legit email and there's not been even a hint of evidence to the contrary. https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk) No idea what sent the stackexchange poster down this paranoid rabbit hole, the email doesn't even contain any links.
- tgsovlerkhgsel 5y ago
  Or it's a legit mail. Hard to tell.
  - FDSGSG 5y ago
    Why is it hard to tell? Obviously this is a legit email. https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk)
dgreensp 5y ago
It’s actually a real email PayPal sends.
- forty 5y ago
  That's the very sad thing, it's harder and harder to differentiate phishing from real email campaign, not only because phishing is getting better at imitating real emails, but because real marketing emails are using the same tricks as phishing to have people open the mail and click on links.
  - vmception 5y ago
    Yes and its pervasive because people are willing to blame[/suggest] the victim [was at fault] When much of this stuff is getting more sophisticated and identical to legitimate emails
  - citrin_ru 5y ago
    +many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'm working with email professionally (as sysadmin/SRE) for more than 10 years. Regular email users who are not email expects can either trust all emails or delete most of them. Security trainings which tell don't open suspicious emails are useless because most emails are suspicious. PayPal, many utility providers even some big banks send very suspicious emails. A typical example of fishy but legitimate emails is when company with the main domain example.com send emails from a different but similarly looking domain e. g. example-invoices.com and: whois is hidden using whois privacy, there is no website on this domain (even if there is - why should I trust it?), infrastructure is completely different from the main domain. In other words example-invoices.com have nothing in common with example.com the only way I can think example-invoices.com is legit - they know some personal data of a recipient but if you're paranoid you can expect this to come from a breach which nowadays are common.
    - quitit 5y ago
      When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.
JimWestergren 5y ago
I assume that Paypal has no business interest in making the email and the links in the email seem more legit. Users that think it is phishing will disregard the email and not claim back the money they rightfully own. Info https://www.paypal-community.com/t5/About-Protections-Archive/Unclaimed-Property-Letter/td-p/941204 https://www.paypal-community.com/t5/About-Protections-Archiv...
- throwawayboise 5y ago
  My state (I assume similar in all/most) has laws about how businesses must handle unclaimed funds, eventually if they cannot get a response from the owner of the funds, they get deposited with the state and the owner (or heir) can claim them.
- FDSGSG 5y ago
  What's the problem here? It's really easy to tell that this is a real email. It comes from @paypal.com and has a valid DKIM signature for that domain. This email does not contain any sketchy links, in fact I think the email doesn't contain any links at all! https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk) There's no particular reason to be suspicious of this email, they did everything right.
egberts1 5y ago
I only read non-HTML mail. The rest get deleted.
dsr_ 5y ago
Just because a message is authentic does not mean it is not spam.
elondaits 5y ago
For many weeks now, PayPal has been sending me emails that say they have a U$S 5 reward for me. I have to click a button and the prize is limited to the first 40k people. I assume it’s probably legit. Now… people should NOT click on this kind of email!! Are they so dense? Their security department should have a heart to heart with their marketing department.
- anandrew 5y ago
  > marketing department > heart Um..
- tata71 5y ago
  Stop using PayPal, they've shown they can't be trusted, outright robbing users.
krisrm 5y ago
Is this some legacy infra that Acoustic has "inherited" from silverpop, perhaps? An old-but-valid DKIM key, a private dns entry for a mail2550.paypal-notification.com server, etc?

269 points by mkj 5y ago

deleted 5y ago

[deleted]

cdot2 5y ago

So essentially they found an old dkim key which had been exposed and used that?

fogihujy 5y ago
Looks like it. It's a good idea to take down old keys after they have gone into disuse, to prevent things like this.
- FDSGSG 5y ago
  It doesn't look like that at all, this is a legit email and there's not been even a hint of evidence to the contrary. https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk) No idea what sent the stackexchange poster down this paranoid rabbit hole, the email doesn't even contain any links.
tgsovlerkhgsel 5y ago
Or it's a legit mail. Hard to tell.
- FDSGSG 5y ago
  Why is it hard to tell? Obviously this is a legit email. https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk)

dgreensp 5y ago

It’s actually a real email PayPal sends.

forty 5y ago
That's the very sad thing, it's harder and harder to differentiate phishing from real email campaign, not only because phishing is getting better at imitating real emails, but because real marketing emails are using the same tricks as phishing to have people open the mail and click on links.
- vmception 5y ago
  Yes and its pervasive because people are willing to blame[/suggest] the victim [was at fault] When much of this stuff is getting more sophisticated and identical to legitimate emails
- citrin_ru 5y ago
  +many Very sad that legitimate emails are often so bad that even after researching for 10-15 minutes I cannot be sure if a message is legitimate or not. And I'm working with email professionally (as sysadmin/SRE) for more than 10 years. Regular email users who are not email expects can either trust all emails or delete most of them. Security trainings which tell don't open suspicious emails are useless because most emails are suspicious. PayPal, many utility providers even some big banks send very suspicious emails. A typical example of fishy but legitimate emails is when company with the main domain example.com send emails from a different but similarly looking domain e. g. example-invoices.com and: whois is hidden using whois privacy, there is no website on this domain (even if there is - why should I trust it?), infrastructure is completely different from the main domain. In other words example-invoices.com have nothing in common with example.com the only way I can think example-invoices.com is legit - they know some personal data of a recipient but if you're paranoid you can expect this to come from a breach which nowadays are common.
  - quitit 5y ago
    When businesses out source part of their operations to a 3rd party it's often challenging and slow to get a proper system in place. Instead the 3rd party and company will agree to register a similar looking domain, and thus the problems begin. This is incredibly common with short-lived projects such as a promotional website, or after downsizing with expert services such as legal/financial/support being awarded on contract. It's also very common with local subsidiaries of larger companies. Where the website is run from HQ, and the local regions have no ability whatsoever to plug into that system.

JimWestergren 5y ago

I assume that Paypal has no business interest in making the email and the links in the email seem more legit. Users that think it is phishing will disregard the email and not claim back the money they rightfully own. Info https://www.paypal-community.com/t5/About-Protections-Archive/Unclaimed-Property-Letter/td-p/941204 https://www.paypal-community.com/t5/About-Protections-Archiv...

throwawayboise 5y ago
My state (I assume similar in all/most) has laws about how businesses must handle unclaimed funds, eventually if they cannot get a response from the owner of the funds, they get deposited with the state and the owner (or heir) can claim them.
FDSGSG 5y ago
What's the problem here? It's really easy to tell that this is a real email. It comes from @paypal.com and has a valid DKIM signature for that domain. This email does not contain any sketchy links, in fact I think the email doesn't contain any links at all! https://www.flickr.com/groups/olympus-e500/discuss/72157630856927736/ https://www.flickr.com/groups/olympus-e500/discuss/721576308... (via: alisonkisk) There's no particular reason to be suspicious of this email, they did everything right.

egberts1 5y ago

I only read non-HTML mail. The rest get deleted.

dsr_ 5y ago

Just because a message is authentic does not mean it is not spam.

elondaits 5y ago

For many weeks now, PayPal has been sending me emails that say they have a U$S 5 reward for me. I have to click a button and the prize is limited to the first 40k people. I assume it’s probably legit. Now… people should NOT click on this kind of email!! Are they so dense? Their security department should have a heart to heart with their marketing department.

anandrew 5y ago
> marketing department > heart Um..
tata71 5y ago
Stop using PayPal, they've shown they can't be trusted, outright robbing users.

krisrm 5y ago

Is this some legacy infra that Acoustic has "inherited" from silverpop, perhaps? An old-but-valid DKIM key, a private dns entry for a mail2550.paypal-notification.com server, etc?