7 ms·

Information about a recent security incident at Mailchimp

106 points by guiambros 4y ago

guiambros 4y ago
I find it hard to believe it was just 133 accounts. I just got an email saying mine was one of the accounts compromised, even though I haven't used Mailchimp in over 12 years, and don't remember having ever used them for anything material. From what I remember either I deleted the account, or they closed for inactivity, so it's weird they still had my data.
- mrslave 4y ago
  Unless they expressly commit to deleting it, or you were paying per GB for storage, consider it saved forever.
  - blowski 4y ago
    True, although I think the OP was highlighting the oddness of such a minor account being one of those compromised.
    - ThePowerOfFuet 4y ago
      [flagged]
  - password4321 4y ago
    I failed to convince them to undelete my account (the deadline is currently 2 years), but there is an HN support incident: https://news.ycombinator.com/item?id=18715866#18717279 https://news.ycombinator.com/item?id=18715866#18717279 Back in the day I thought "who better to retain a mailing list" but turns out I'd have been best off with a Google Sheet. Now I have to scrounge around in backups to see if I downloaded it anywhere... maybe I should start a support ticket here of my own!
    - davewritescode 4y ago
      > I failed to convince them to undelete my account (the deadline is currently 2 years), but there is an HN support incident: https://news.ycombinator.com/item?id=18715866#18717279 https://news.ycombinator.com/item?id=18715866#18717279. A lot of companies have a habit of keeping data but not migrating dead customers to newer schemas and systems.
  - Pako 4y ago
    GDPR to the rescue! /s
iamacyborg 4y ago
> we take the security of our users’ data seriously Clearly they don’t if staff are able to just access customer accounts. SaaS companies really need to stop giving themselves access to customer accounts.
tybit 4y ago
While they don’t specify it sounds like they don’t even require 2FA to access their systems?
- Eleison23 4y ago
  [dead]
fukawi2 4y ago
Again? This is the third incident in ~12 months IIRC. Is every other company hiding their incidents, or are MC developing a habit of actually not "taking the security of our users' data seriously"?
- LewisVerstappen 4y ago
  Well, considering how absurdly expensive they are compared to other ESPs, the money has to be going somewhere?
  - iamacyborg 4y ago
    They’re expensive for their feature set but cheap compared to most good ESP’s.
- iinnPP 4y ago
  The problem that people are overlooking is the profit motives of the people capable of penetrating systems. These motives are dictated by how companies treat security. By: - Feet dragging on free work or extremely low paid work - Not hiring any competent person or not paying enough to attract that person. - Refusing to fix internal problems that create the issues. The reality is, there are so many more people willing to use technology to scam you than there are people employed to stop those people. Probably because these currently bad people are, by design, hard to discover and thus go unaccounted for entirely. Nobody pays for the skillset and what people hire for clearly doesn't work. Until companies see consequences, nothing will change. So expect this not to change. Why on earth are you giving these companies your money and data anyway? It's truly not difficult to avoid breaches. Do a tiny bit of digging into the security model before you unload your list of customers into their servers. Take some bloody responsibility yourselves too.
  - BrandoElFollito 4y ago
    The third case is very common. I would not even use the word "refuse" Sometimes the legacy system is so legacy that fixing it is a many years project. Sometimes you have such a messy environment that rotating credentials means a general crash. Sometimes you have legacy software that must stay legacy and you cannot patch + that software is so ingrained into your system that you cannot isolate it. Sometimes ... This is all bad design and bad architecture from scratch. Or "good architecture 25 years ago".
InCityDreams 4y ago
>> we take the security of our users’ data seriously I take the war in Ukraine very seriously, and a few other things, but I'm still going on the piss tonight.
mrmincent 4y ago
Funnily enough I’m studying a cyber security course at the moment and had to find examples of social engineering for an activity, and came across this yesterday. I shared it with my classmates and they just couldn’t believe that MailChimp been hit 3 times in a year with what sounds like the same social engineering attack. It does make you wonder when there’s going to be a 4th, I certainly don’t think I’d want my customers contact details in their system at the moment.
- AviationAtom 4y ago
  The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.
  - Enginerrrd 4y ago
    I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)
    - nibbleshifter 4y ago
      Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
      - syrrim 4y ago
        If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
      - AviationAtom 4y ago
        The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.
davewritescode 4y ago
I just don't understand how this keeps happening?
tiffanyh 4y ago
Off topic: what do people think of MailChimps quirky web design. Like it or not?
- DavidIsATool 4y ago
  Jarring, overwhelming, everything is too big, hard to process quickly. Not a fan.
mabbo 4y ago
Do MailChimp employees not need a Yubikey or some other secure OTP generator to access customer data? Or does the attack involve the user sending their OTP as well? Either this is a pretty heavy handed attack, or MailChimp aren't following best practices in terms of security.
- vlovich123 4y ago
  For a corporate setting where you can replace keys easily, I would choose Fido keys and SSO protecting all access into the network instead of OTP/VPN as that is generally immune to social engineering attacks / leaked passwords. Additionally, it’s trivial to manage those keys in a corporate setting centrally. For personal use, I still prefer OTP because I’m not fully comfortable that I won’t lose some key and forget to revoke it everywhere and/or lose permanent access. Phones are getting very good at being that security key with backup but I’m a little hesitant to do that because I’m not sure of the interop story.
  - rmatic 4y ago
    while most implementations don’t require 2 security keys, most services highly suggest that you enroll 2 keys, and that you keep one in a safe place for backup. e.g. Apple’s new icloud Security Keys support requires 2 keys to enroll
    - vlovich123 4y ago
      The likelihood of me keeping track of both well isn’t great. And then of I lose one, how do I go about revoking that from all the services? Not to mention that enrolling 2 keys requires you to have both keys every time you enroll. So I’m not sure how practical that is and how you know when you’ll need both keys. Recovery codes seem like a better option but then you’re stuck figuring out how to keep them around securely… OTP + diligence against social engineering is so far the only thing I’ve found that I trust. It’s not the best but multiple Yubikey’s sounds wrong and impractical as well.
- lfodofod 4y ago
  You just ask the target to install teamviewer or anydesk… These are probably support staffers working from personal computers at home using some sort of remote desktop software, hard to enforce any security policies.
steeleyespan 4y ago
I don’t like Mailchimp, they won’t allow any emails that even seem to mention anything crypto-related. Super annoying.
daneel_w 4y ago
Does the scanning software in the update have any opinions about installations of LibreOffice? Asking because Microsoft really has a strong opinion about not using Microsoft Edge, whose shortcut icon they keep resurrecting from the dead to haunt my desktop. Twice just the past 10 days.
mpclark 4y ago
What are savvy folks using instead of Mailchimp nowadays? I run a B2B news site and use Mailchimp for its daily and weekly newsletters. I like that MC handles the subscriber management and deliverability side of things, but they seem to be moving away from doing email well and towards random value added small biz marketing stuff. And my monthly bill has almost doubled since the Intuit acquisition.
- password4321 4y ago
  2022 Ask HN: What service are you using to send marketing emails? https://news.ycombinator.com/item?id=32535397 https://news.ycombinator.com/item?id=32535397 https://hn.algolia.com/?query=mailchimp%20comments%3E10 https://hn.algolia.com/?query=mailchimp%20comments%3E10 2021 emailoctopus postmark mailersend|lite sendgrid campaign-monitor constant-contact https://news.ycombinator.com/item?id=28516219&p=2#28516522 https://news.ycombinator.com/item?id=28516219&p=2#28516522 2016 (self-hosted): mailtrain dada-mail-project+ses mailwizz! maybe:sendy | mailgun sparkpost https://news.ycombinator.com/item?id=11424189 https://news.ycombinator.com/item?id=11424189 2017 ses sendy mailblast mailgun postmark mailtrain mail-for-good kevy mailget https://news.ycombinator.com/item?id=15493127 https://news.ycombinator.com/item?id=15493127 (+per-recipient customization tools)
- thereal_ba 4y ago
  Aside from the above, Audienceful is a new company in the emailing space as well: https://www.audienceful.com https://www.audienceful.com
Eleison23 4y ago
[dead]

106 points by guiambros 4y ago

I find it hard to believe it was just 133 accounts. I just got an email saying mine was one of the accounts compromised, even though I haven't used Mailchimp in over 12 years, and don't remember having ever used them for anything material. From what I remember either I deleted the account, or they closed for inactivity, so it's weird they still had my data.

mrslave 4y ago
Unless they expressly commit to deleting it, or you were paying per GB for storage, consider it saved forever.
- blowski 4y ago
  True, although I think the OP was highlighting the oddness of such a minor account being one of those compromised.
  - ThePowerOfFuet 4y ago
    [flagged]
- password4321 4y ago
  I failed to convince them to undelete my account (the deadline is currently 2 years), but there is an HN support incident: https://news.ycombinator.com/item?id=18715866#18717279 https://news.ycombinator.com/item?id=18715866#18717279 Back in the day I thought "who better to retain a mailing list" but turns out I'd have been best off with a Google Sheet. Now I have to scrounge around in backups to see if I downloaded it anywhere... maybe I should start a support ticket here of my own!
  - davewritescode 4y ago
    > I failed to convince them to undelete my account (the deadline is currently 2 years), but there is an HN support incident: https://news.ycombinator.com/item?id=18715866#18717279 https://news.ycombinator.com/item?id=18715866#18717279. A lot of companies have a habit of keeping data but not migrating dead customers to newer schemas and systems.
- Pako 4y ago
  GDPR to the rescue! /s

iamacyborg 4y ago

> we take the security of our users’ data seriously Clearly they don’t if staff are able to just access customer accounts. SaaS companies really need to stop giving themselves access to customer accounts.

tybit 4y ago

While they don’t specify it sounds like they don’t even require 2FA to access their systems?

Eleison23 4y ago
[dead]

fukawi2 4y ago

Again? This is the third incident in ~12 months IIRC. Is every other company hiding their incidents, or are MC developing a habit of actually not "taking the security of our users' data seriously"?

LewisVerstappen 4y ago
Well, considering how absurdly expensive they are compared to other ESPs, the money has to be going somewhere?
- iamacyborg 4y ago
  They’re expensive for their feature set but cheap compared to most good ESP’s.
iinnPP 4y ago
The problem that people are overlooking is the profit motives of the people capable of penetrating systems. These motives are dictated by how companies treat security. By: - Feet dragging on free work or extremely low paid work - Not hiring any competent person or not paying enough to attract that person. - Refusing to fix internal problems that create the issues. The reality is, there are so many more people willing to use technology to scam you than there are people employed to stop those people. Probably because these currently bad people are, by design, hard to discover and thus go unaccounted for entirely. Nobody pays for the skillset and what people hire for clearly doesn't work. Until companies see consequences, nothing will change. So expect this not to change. Why on earth are you giving these companies your money and data anyway? It's truly not difficult to avoid breaches. Do a tiny bit of digging into the security model before you unload your list of customers into their servers. Take some bloody responsibility yourselves too.
- BrandoElFollito 4y ago
  The third case is very common. I would not even use the word "refuse" Sometimes the legacy system is so legacy that fixing it is a many years project. Sometimes you have such a messy environment that rotating credentials means a general crash. Sometimes you have legacy software that must stay legacy and you cannot patch + that software is so ingrained into your system that you cannot isolate it. Sometimes ... This is all bad design and bad architecture from scratch. Or "good architecture 25 years ago".

InCityDreams 4y ago

>> we take the security of our users’ data seriously I take the war in Ukraine very seriously, and a few other things, but I'm still going on the piss tonight.

mrmincent 4y ago

Funnily enough I’m studying a cyber security course at the moment and had to find examples of social engineering for an activity, and came across this yesterday. I shared it with my classmates and they just couldn’t believe that MailChimp been hit 3 times in a year with what sounds like the same social engineering attack. It does make you wonder when there’s going to be a 4th, I certainly don’t think I’d want my customers contact details in their system at the moment.

AviationAtom 4y ago
The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.
- Enginerrrd 4y ago
  I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)
  - nibbleshifter 4y ago
    Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
    - syrrim 4y ago
      If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
    - AviationAtom 4y ago
      The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.

davewritescode 4y ago

I just don't understand how this keeps happening?

tiffanyh 4y ago

Off topic: what do people think of MailChimps quirky web design. Like it or not?

DavidIsATool 4y ago
Jarring, overwhelming, everything is too big, hard to process quickly. Not a fan.

mabbo 4y ago

Do MailChimp employees not need a Yubikey or some other secure OTP generator to access customer data? Or does the attack involve the user sending their OTP as well? Either this is a pretty heavy handed attack, or MailChimp aren't following best practices in terms of security.

vlovich123 4y ago
For a corporate setting where you can replace keys easily, I would choose Fido keys and SSO protecting all access into the network instead of OTP/VPN as that is generally immune to social engineering attacks / leaked passwords. Additionally, it’s trivial to manage those keys in a corporate setting centrally. For personal use, I still prefer OTP because I’m not fully comfortable that I won’t lose some key and forget to revoke it everywhere and/or lose permanent access. Phones are getting very good at being that security key with backup but I’m a little hesitant to do that because I’m not sure of the interop story.
- rmatic 4y ago
  while most implementations don’t require 2 security keys, most services highly suggest that you enroll 2 keys, and that you keep one in a safe place for backup. e.g. Apple’s new icloud Security Keys support requires 2 keys to enroll
  - vlovich123 4y ago
    The likelihood of me keeping track of both well isn’t great. And then of I lose one, how do I go about revoking that from all the services? Not to mention that enrolling 2 keys requires you to have both keys every time you enroll. So I’m not sure how practical that is and how you know when you’ll need both keys. Recovery codes seem like a better option but then you’re stuck figuring out how to keep them around securely… OTP + diligence against social engineering is so far the only thing I’ve found that I trust. It’s not the best but multiple Yubikey’s sounds wrong and impractical as well.
lfodofod 4y ago
You just ask the target to install teamviewer or anydesk… These are probably support staffers working from personal computers at home using some sort of remote desktop software, hard to enforce any security policies.

steeleyespan 4y ago

I don’t like Mailchimp, they won’t allow any emails that even seem to mention anything crypto-related. Super annoying.

daneel_w 4y ago

Does the scanning software in the update have any opinions about installations of LibreOffice? Asking because Microsoft really has a strong opinion about not using Microsoft Edge, whose shortcut icon they keep resurrecting from the dead to haunt my desktop. Twice just the past 10 days.

mpclark 4y ago

What are savvy folks using instead of Mailchimp nowadays? I run a B2B news site and use Mailchimp for its daily and weekly newsletters. I like that MC handles the subscriber management and deliverability side of things, but they seem to be moving away from doing email well and towards random value added small biz marketing stuff. And my monthly bill has almost doubled since the Intuit acquisition.

password4321 4y ago
2022 Ask HN: What service are you using to send marketing emails? https://news.ycombinator.com/item?id=32535397 https://news.ycombinator.com/item?id=32535397 https://hn.algolia.com/?query=mailchimp%20comments%3E10 https://hn.algolia.com/?query=mailchimp%20comments%3E10 2021 emailoctopus postmark mailersend|lite sendgrid campaign-monitor constant-contact https://news.ycombinator.com/item?id=28516219&p=2#28516522 https://news.ycombinator.com/item?id=28516219&p=2#28516522 2016 (self-hosted): mailtrain dada-mail-project+ses mailwizz! maybe:sendy | mailgun sparkpost https://news.ycombinator.com/item?id=11424189 https://news.ycombinator.com/item?id=11424189 2017 ses sendy mailblast mailgun postmark mailtrain mail-for-good kevy mailget https://news.ycombinator.com/item?id=15493127 https://news.ycombinator.com/item?id=15493127 (+per-recipient customization tools)
thereal_ba 4y ago
Aside from the above, Audienceful is a new company in the emailing space as well: https://www.audienceful.com https://www.audienceful.com

Eleison23 4y ago

[dead]