6 ms·

I'm frequently impressed with spammer ingenuity. We had a similar thing happen at a previous job. Users could sign up for a free trial for our software using a

I'm frequently impressed with spammer ingenuity. We had a similar thing happen at a previous job. Users could sign up for a free trial for our software using a web form. The form had fields like "email address" and "name" so we could follow up with the user. Scammers would fill in a victim's email address and some scummy website in the "name" field, resulting in our servers sending the victim an email starting with something like, "Hello, Click Here For Free Money FreeMoney.com," followed by the rest of our marketing copy. Never would've thought to use the form that way...

cuu508 4y ago
I run a SaaS where users can create projects and invite other users into their projects. When a user gets invited, the SaaS them an email notification "You've been invited to project such-and-such". So a spammer created a project, they put their spam message in the project's name, and started to go through their victim list, inviting each into their project. I suppose that's one way to send an email :-)
- judge2020 4y ago
  With SPF/DKIM enabling authenticated email, domain reputation is at a premium these days, especially if scammers want to end up in gmail inboxes.
  - chrishynes 4y ago
    Most spam I get to my gmail inbox nowadays is itself from an @gmail.com address :-/
    - jjav 4y ago
      Indeed. Nearly 100% of the phishing we get at my employer (which I monitor) is from gmail.com addresses.
      - londons_explore 4y ago
        It's because Mike Hearn retired from the Google anti-abuse team - their bot protections went downhill from there, and now bulk Google accounts sell for a few cents each. It's easy to make money when you can send out thousands of spam emails, each with hundreds of recipients, for under a cent.
        kccqzy 4y ago
        And where do those bulk Google accounts come from? Compromised accounts due to weak/leaked passwords, without 2FA. What does Google do about them? Making it harder to log in to dormant accounts from new devices and locations. What's the result? Periodic HN complaints on someone unable to access their decade-old dormant account, or an active account with a truly forgotten password, etc. Anti-abuse is hard. Damned if you do something, damned if you don't.
        londons_explore 4y ago
        They could do far more things to solve this issue... For dormant account reactivation, they can ask the user for lots of details that are in the account. For example, "please type in email addresses of as many people as possible that you have sent emails to from this account". Which cities have you previously logged into this account from? All info would be optional, but the more the user provides the quicker they're going to get in. When the user has provided enough information to be fairly sure that it's a real user attempting to login, then start a 7 day countdown. During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account. Hire attackers to try and break into old accounts, and use their input to find the likelihood of each type of information being correctly given by the real account owner and an attacker.
        sacrosancty 4y ago
        God no. I don't think you've thought of the edge cases at all. I have a 2nd email address I use for emergencies and almost never log in, but when I need it, I'm going to need it straight away, not in a week. Also, gmail should never ever by emailing your contacts! It has no idea what your relationship with them is or what information about your actions you want to keep secret from them.
    - xorcist 4y ago
      And Facebook, for some reason. Which is weird as I've never signed up for any Facebook owned service. Never looked into how they do it, but they keep coming.
shaftway 4y ago
I had a form like that. You put in your email and it sends an email from us@foo.com, to us@foo.com, and to them@whatever.com. We had internal mailing lists for clients, including something like all-clients@foo.com, but they were locked down so only certain people could send to them. Turns out us@foo.com was one of those people, and so someone would spam all of our clients by putting their return address as all-clients@us.com. We just took the form down and posted our email address.
- rtkwe 4y ago
  Alternatively don't accept any internal @foo.com email addresses in your contact us form unless you're an email provider would work too.
  - jrumbut 4y ago
    Have you ever seen anyone do that though? The only real solution is not allowing contact form emails to be customized with free text input. I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).
    - rtkwe 4y ago
      > Have you ever seen anyone do that though? I don't know I haven't really probed random contact forms to see if they block this kind of thing. There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.
      - jrumbut 4y ago
        It's definitely evil genius stuff. I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list. Might be enough names you can profitably do it by hand.
SoftTalker 4y ago
Never trust user input. If a user input value will be used on a page or email or other output, it will be abused once this is discovered. You must sanity check. Edit: this was already pointed out downthread. Missed it before I posted.
- dylan604 4y ago
  The fact that in 2022 user input sanitation is still such a low hanging fruit for attackers shows that you cannot preach this loud enough or often enough.
Mordisquitos 4y ago
As someone with the unfortunate privilege of having an early GMail address with ${FIRST_NAME}.${LAST_NAME}@gmail.com, the fact that your description of the first email you would send your ostensible customers does not sound like a straightforward confirmation email is already a red flag.
- coldpie 4y ago
  I don't think it's unreasonable for even a confirmation email to address the user by their chosen name, but yeah, I guess you're right. This is why we can't have nice things :(
misterbwong 4y ago
Add me to the chorus of people that are impressed/scared by spammers. In a previous life, I worked at a semi-well-known auto publisher site where scammers literally stood up a copy of almost _the entire site_ (ads, functionality, and all) in order to execute an auto escrow scam. We know of at least one instance where a user in the UK was scammed out of ~$10,000-ish using this method. Democratization of technology at its best (worst?) I guess...
ww520 4y ago
It doesn't help that dark patterns used by well known websites normalizing the problems. That other day I got a credit card charge notification of $154 from my bank about a charge from Amazon. I didn't buy anything from Amazon recently. I also didn't get any email from Amazon about a bill or a purchase. Logged on to Amazon, looked through the order history, looked through AWS billing, and didn't see any recent charges. I thought my card was stolen and got a fraudulent charge. By chance I looked into the Prime membership page. An obscure page listed the recent Prime charges. Yep, it's the Prime membership charge. The amount looked odd because tax was added to it, where the old charges were like $119 or $139. Amazon employs a dark pattern of not sending to the users any notification on the Prime renewal, no billing statement, no invoice, no email, just a silent charge on the credit card. I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.
- rexf 4y ago
  I've had similar experiences where I got charged by amazon for Prime & wasn't sure what it was. They certainly make it hard to find your payment history for Prime renewal.
- fennecfoxy 4y ago
  In the UK (and plenty of other countries, I'm sure) I get a notification for every payment from my banking app and/or Google Wallet (usually both, since I use GPay a lot).
- makeitdouble 4y ago
  That Prime silent charge problem is also problematic after credit card changes and other adjustments. Saw the other day a charge get refused on a credit card I cancelled. 3DSecure is mandatory on it, so I kinda panicked thinking I got phished somewhere, but no, it was just Amazon reusing their authorization to charge a year later. I would have actually updated my info if I had a heads up, but now that my membership has been canceled following the charge refusal, it's kind of an occasion to let it go.
- toomanydoubts 4y ago
  >I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors. Lucky you who was able to get through the dark patterns in the unsubscribe page. I got one extra charge because the first time I tried, I fell for one of their dark patterns and believed it was canceled while it wasn't.
tetetetetete 4y ago
Another pain in the ass one is creating google docs and sharing them, gets past spam.
simonebrunozzi 4y ago
Power of incentives at play. e.g. this (and many others) AMA on Reddit [0] [0]: https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_ama/ https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_...

cuu508 4y ago

I run a SaaS where users can create projects and invite other users into their projects. When a user gets invited, the SaaS them an email notification "You've been invited to project such-and-such". So a spammer created a project, they put their spam message in the project's name, and started to go through their victim list, inviting each into their project. I suppose that's one way to send an email :-)

judge2020 4y ago
With SPF/DKIM enabling authenticated email, domain reputation is at a premium these days, especially if scammers want to end up in gmail inboxes.
- chrishynes 4y ago
  Most spam I get to my gmail inbox nowadays is itself from an @gmail.com address :-/
  - jjav 4y ago
    Indeed. Nearly 100% of the phishing we get at my employer (which I monitor) is from gmail.com addresses.
    - londons_explore 4y ago
      It's because Mike Hearn retired from the Google anti-abuse team - their bot protections went downhill from there, and now bulk Google accounts sell for a few cents each. It's easy to make money when you can send out thousands of spam emails, each with hundreds of recipients, for under a cent.
      - kccqzy 4y ago
        And where do those bulk Google accounts come from? Compromised accounts due to weak/leaked passwords, without 2FA. What does Google do about them? Making it harder to log in to dormant accounts from new devices and locations. What's the result? Periodic HN complaints on someone unable to access their decade-old dormant account, or an active account with a truly forgotten password, etc. Anti-abuse is hard. Damned if you do something, damned if you don't.
        londons_explore 4y ago
        They could do far more things to solve this issue... For dormant account reactivation, they can ask the user for lots of details that are in the account. For example, "please type in email addresses of as many people as possible that you have sent emails to from this account". Which cities have you previously logged into this account from? All info would be optional, but the more the user provides the quicker they're going to get in. When the user has provided enough information to be fairly sure that it's a real user attempting to login, then start a 7 day countdown. During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account. Hire attackers to try and break into old accounts, and use their input to find the likelihood of each type of information being correctly given by the real account owner and an attacker.
        sacrosancty 4y ago
        God no. I don't think you've thought of the edge cases at all. I have a 2nd email address I use for emergencies and almost never log in, but when I need it, I'm going to need it straight away, not in a week. Also, gmail should never ever by emailing your contacts! It has no idea what your relationship with them is or what information about your actions you want to keep secret from them.
  - xorcist 4y ago
    And Facebook, for some reason. Which is weird as I've never signed up for any Facebook owned service. Never looked into how they do it, but they keep coming.

shaftway 4y ago

I had a form like that. You put in your email and it sends an email from us@foo.com, to us@foo.com, and to them@whatever.com. We had internal mailing lists for clients, including something like all-clients@foo.com, but they were locked down so only certain people could send to them. Turns out us@foo.com was one of those people, and so someone would spam all of our clients by putting their return address as all-clients@us.com. We just took the form down and posted our email address.

rtkwe 4y ago
Alternatively don't accept any internal @foo.com email addresses in your contact us form unless you're an email provider would work too.
- jrumbut 4y ago
  Have you ever seen anyone do that though? The only real solution is not allowing contact form emails to be customized with free text input. I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).
  - rtkwe 4y ago
    > Have you ever seen anyone do that though? I don't know I haven't really probed random contact forms to see if they block this kind of thing. There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.
    - jrumbut 4y ago
      It's definitely evil genius stuff. I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list. Might be enough names you can profitably do it by hand.

SoftTalker 4y ago

Never trust user input. If a user input value will be used on a page or email or other output, it will be abused once this is discovered. You must sanity check. Edit: this was already pointed out downthread. Missed it before I posted.

dylan604 4y ago
The fact that in 2022 user input sanitation is still such a low hanging fruit for attackers shows that you cannot preach this loud enough or often enough.

Mordisquitos 4y ago

As someone with the unfortunate privilege of having an early GMail address with ${FIRST_NAME}.${LAST_NAME}@gmail.com, the fact that your description of the first email you would send your ostensible customers does not sound like a straightforward confirmation email is already a red flag.

coldpie 4y ago
I don't think it's unreasonable for even a confirmation email to address the user by their chosen name, but yeah, I guess you're right. This is why we can't have nice things :(

misterbwong 4y ago

Add me to the chorus of people that are impressed/scared by spammers. In a previous life, I worked at a semi-well-known auto publisher site where scammers literally stood up a copy of almost _the entire site_ (ads, functionality, and all) in order to execute an auto escrow scam. We know of at least one instance where a user in the UK was scammed out of ~$10,000-ish using this method. Democratization of technology at its best (worst?) I guess...

ww520 4y ago

It doesn't help that dark patterns used by well known websites normalizing the problems. That other day I got a credit card charge notification of $154 from my bank about a charge from Amazon. I didn't buy anything from Amazon recently. I also didn't get any email from Amazon about a bill or a purchase. Logged on to Amazon, looked through the order history, looked through AWS billing, and didn't see any recent charges. I thought my card was stolen and got a fraudulent charge. By chance I looked into the Prime membership page. An obscure page listed the recent Prime charges. Yep, it's the Prime membership charge. The amount looked odd because tax was added to it, where the old charges were like $119 or $139. Amazon employs a dark pattern of not sending to the users any notification on the Prime renewal, no billing statement, no invoice, no email, just a silent charge on the credit card. I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.

rexf 4y ago
I've had similar experiences where I got charged by amazon for Prime & wasn't sure what it was. They certainly make it hard to find your payment history for Prime renewal.
fennecfoxy 4y ago
In the UK (and plenty of other countries, I'm sure) I get a notification for every payment from my banking app and/or Google Wallet (usually both, since I use GPay a lot).
makeitdouble 4y ago
That Prime silent charge problem is also problematic after credit card changes and other adjustments. Saw the other day a charge get refused on a credit card I cancelled. 3DSecure is mandatory on it, so I kinda panicked thinking I got phished somewhere, but no, it was just Amazon reusing their authorization to charge a year later. I would have actually updated my info if I had a heads up, but now that my membership has been canceled following the charge refusal, it's kind of an occasion to let it go.
toomanydoubts 4y ago
>I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors. Lucky you who was able to get through the dark patterns in the unsubscribe page. I got one extra charge because the first time I tried, I fell for one of their dark patterns and believed it was canceled while it wasn't.

tetetetetete 4y ago

Another pain in the ass one is creating google docs and sharing them, gets past spam.

simonebrunozzi 4y ago

Power of incentives at play. e.g. this (and many others) AMA on Reddit [0] [0]: https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_ama/ https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_...