11 ms·
SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack
- nashashmi 9mo agoFirst thought... Why would ICE need donations? I then realized how unrecognizable scams have become to me now. Older people are going to be in a worse position.
- david_shaw 9mo agoYou can donate to reduce the national debt, so it's not that far out of the realm of possibility that federal agencies would solicit donations, too. https://www.pay.gov/public/form/start/23779454 https://www.pay.gov/public/form/start/23779454
- amw 9mo agoDonating to reduce the government debt is such a wildly dumb thing to exist. The US is currency sovereign! It has no risk of default on any debt denominated in USD! The only reason a site like this exists is for politicians to distract from the fact that the budget of a nation with currency sovereignty does not actually have to raise revenues with taxes in order to spend money on services (and thus, be an excuse to cut services).
- nashashmi 9mo agoYeah donating for the debt is equivalent to literally burning money. The us’s biggest debt buyer is the US fed reserve. Bonds offered to foreign buyers absorbs loose worldwide cash. The supply of dollars is always less than demand because petroleum must be traded in dollars. And demand exceeds supply because IMF loans are denominated in dollars, plus interest, meaning that demand perpetually keeps going up because the interest keeps rising, simply because the clock ticks. So what is the point of the debt? To convince govt should not be too big nor suck up to many of the worldwide human capital resources.
- john-h-k 9mo ago> The only reason a site like this exists is for politicians to distract from the fact that the budget of a nation with currency sovereignty does not actually have to raise revenues with taxes in order to spend money on services (and thus, be an excuse to cut services). This is not a mainstream view. This _is_ a view of MMT, which is rejected by the majority of current economists, and this context is probably important to people seeing this when it’s just presented as a well known fact > In a 2019 survey of top U.S. economists not a single respondent agreed with the basic aspects of MMT https://en.wikipedia.org/wiki/Modern_Monetary_Theory https://en.wikipedia.org/wiki/Modern_Monetary_Theory
- deleted 9mo ago[deleted]
- afavour 9mo agoBefore anyone launches themselves into the sky: the title is clickbait. This is about phishing attempts that use ICE to persuade you to click. Sendgrid the company is not emailing about supporting ICE. But technically Sendgrid the infrastructure is.
- ExpertAdvisor01 9mo agoYeah I noticed the same thing with other providers. Especially with ones that provide free trials.
- isk517 9mo agoAlso they are using variants of the same scam to target a variety of groups
- sys32768 9mo agoI think HN should embrace AI to the point of having an alternative AI-generated title next to the original title, to reduce clickbait and reduce the global rage index.
- etyp 9mo agoThere is a chance that the title here was intentionally worded to answer a question people are likely to search for, then actually answer their concerns.
- barbazoo 9mo agoThen the "alternative AI-generated title next to the original title" would say so.
- krapp 9mo agoHN would never do that, it would violate the minimalism of the site. Most people aren't even aware that their posted URLs can be changed or their titles re-edited automatically because the UI doesn't give affordances for anything. You're just expected to notice and edit it out within the edit window (which there also isn't an affordance for.)
- TZubiri 9mo agoInteresting that politics is a vector for contagion. When you think about politics is very contagious, politicians infect activists, who infect regular folk that advocate for stuff they don't benefit from, when elections come near, it's flu season. Double parasite burgers where a new parasite leeches of an existing vector are common in biology as well. Like malaria and mosquitoes.
- SketchySeaBeast 9mo agoPhilosophically fun, sure, but the article also points out that another vector was "Your language settings have been changed to Spanish", so I don't know if it's as profound as you're making it out to be. Anything that makes us panic can be a vector.
- nathanyz 9mo agoI have been receiving 2-3 of these variations per day. Have been reporting them as phishing in our GSuite account, but they just keep coming.
- losthobbies 9mo agoThat’s some devious shit. I can just imagine someone furiously clicking the button in a rage
- toast0 9mo agoHaving a friendly name listed in the From field is part of the problem. SPF, DKIM, and DMARC make it possible to control who can send as your domain, if the receiver cares to check. If you have strict SPF and DMARC rules, most receivers will drop or not accept emails that fail the rules. But you can't control using your brand from unaffiliated domains. Would you even open an email from noreply@drummond.com if that's what showed up in the message list? On mobile it's worse. Gmail (Android) doesn't even show the From address at all when you open an email. For some emails, I can tap the sender icon and see the address, for others I have to find the hit reply (but if DMARC et al doesn't validate a Reply-To address) or go find a computer and see the message there.
- ZeroConcerns 9mo ago> Can this be fixed? For popular senders: sort-of: in your incoming mail server, substring-match the display name of the sender against popular brands, and ensure the actual domain matches. This works remarkably well for proper brands (FedEx et al), but breaks down when the brand name regularly occurs in "normal" names, the sending brand sends mail from all over the place, or "innocuous" impersonation takes place all the time. Like, somehow, From: "VODAFONE" <shipping-update@dpd.co.uk> is a 100% legit sender (assuming SPF and DKIM verification pass), despite both Vodafone and DPD being pretty common impersonation targets. You'd think they'd know better, but alas. So, yeah, room for improvement and such...
- layer8 9mo agoUse <service>@<yourdomain> as your email address when signing up, and check the To header when receiving emails. And/or, long-press or right-click on any link to inspect the linked domain.
- lightandlight 9mo agoI often go one step futher by appending a short random identifier, `{service}.{id}@{domain}`, to make it harder to guess (in case someone learned of my email address policy). I created a little GTK program to help: https://github.com/LightAndLight/gen-alias https://github.com/LightAndLight/gen-alias
- layer8 9mo agoYes, it’s really <f(service, rand())>.
- zahlman 9mo agoWhat fraction of people do you suppose actually have a <yourdomain> to do this with? Even some highly technically inclined people (like myself) can be entirely ignorant of the process. It's not as if consumer ISPs provide the service.
- 9mo ago
- sig-term 9mo agorelatedly, my wife received polititexts destined to her conservative father. The latest was actually genius IMO, in that it stated "Dear STEVEN, due to inactivity, your registration will be changed to DEMOCRAT in 20 minutes unless you navigate to this link." It, I assume, redirected to some support page to donate to the US conservative party or its affiliates. The social engineering is getting more effective
- mcintyre1994 9mo agoInevitably some people are going to be away from their phones when they receive that, so I wonder what they think when they continue getting needy messages from Republicans after that!
- SketchySeaBeast 9mo agoI don't know if the fact that it fully slipped into the absurd or the fact that it probably still worked on people is sadder. I do love the idea of voter registration oscillating back and fourth at 20 minutes intervals forever. Would make voting in the primaries way more exciting as the voter base kept flipping.
- idiotsecant 9mo agoThis isn't even close to the most ridiculous emotional manipulation techniques American conservative fundraising uses to target old people who might not be in full possession of their faculties. It's some of the scummiest stuff possible.
- zahlman 9mo agoTo me as a Canadian, the absurd part is that ordinary people are expected to have "registered" with a party (as opposed to registering with the independent organization that runs elections, like we do; they automate getting most of the voter roll from Revenue Canada, but this requires your explicit consent on the tax form).
- LorenzoGood 9mo ago
- martey 9mo ago"The fundamental issue is that SendGrid’s business model depends on making it easy for legitimate businesses to send email at scale." I disagree with this conclusion, if not only because other email service providers don't have this issue. It wouldn't surprise me if something was broken with SendGrid's internal infrastructure. I used to be a SendGrid customer until my deliverability started being affected by this issue. SendGrid took weeks to reply to my customer service messages about resolving this, even though I was a paying customer and was renting private IP addresses from them to send mail. I finally gave up and closed my SendGrid account in July 2021. Despite this, they continued to send me monthly invoices until May 2022. Multiple SendGrid representatives promised that they had resolved the issue, but it wasn't until one CSR added me to SendGrid's global suppression list that they finally stopped.
- pksebben 9mo agoIf the attackers in this case are cleverly exploiting anything, I would bet on aggressive grey patterns like that more than I would US culture wars. Noticing that a company has policies that let you hide in plain sight means that you're paying close attention. Knowing what issues are hot button culture flamewars means you can access literally any American news outlet.
- citizenpaul 9mo ago>closed my SendGrid account ....continued to send me monthly invoices I used to run IT for a medium company. The amount of times I saw this with various SaaS companies was troubling. We had hundreds of services some as small as a single manager that demanded X and company wide tools. It was frequently a several months long hassle to get them to stop billing us when we cut ties with them. I wish I kept personal records now it was a minority but definitely in the 15%'ish range.
- forthwall 9mo agoOh! I’ve seen this phishing attempt as well, I believe it was was Gemini they said they would add an “lgbt” banner unless you changed settings.
- lbrito 9mo agoSo the modern Gestapo is so deeply unpopular it is being used for phishing attacks - no one (normal) wants to be seen anywhere near it. Amazing.
- sakopov 9mo agoIs this a new trend in phishing emails? They appear to be using legitimate domains to bypass spam detection. Usually the domains are associated with legitimate companies who are completely oblivious. I always wondered how this works. Is it a broken contact form somewhere?
- lbotos 9mo agothe article talked about how the sendgrid accounts are real, and presume compromised. I suspect that once the sendgrid account is compromised, they then send out these phishing emails, hoping to compromise _other_ sendgrid accounts to look for password overlap and/or keep the flow going.
- pixl97 9mo agoOne way is to look for companies that have SPF records (or whatever the system is these days) that contain ranges/names of large providers like sendgrid. Then they test sending mails with those large providers names under said system until they get ones that go out, and launch a campaign.
- parliament32 9mo agoWe've been getting similar phishing emails claiming to be from SendGrid, except they're along the lines of "we're adding a rainbow banner to the footer of all emails to show LGBT support, click here to opt out". It's especially funny because SendGrid isn't even one of our vendors.
- zzzeek 9mo agoright but nobody clicked the button on that one
- itintheory 9mo agoThat example is in TFA.
- eps 9mo agoBefore you reach for your wallets, remember - It might be 50 days by an (admittedly very cool) bus, but it's only 84 days in foot! * Consult your Google Maps and a sense of humor if it sounds to good to be true!
- snowwrestler 9mo agoNot just SendGrid, I have received very sophisticated phishing emails “from” MailGun as well. I think the advantages of getting into your email channel justify a lot of investment by the bad guys.
- deleted 9mo ago[deleted]
- cindyllm 9mo ago[dead]
- ekjhgkejhgk 9mo agoIn the 1920s and 30s they had mailing campaigns recruiting to join the SA. Same principle.
- idiotsecant 9mo agoRead the story
- educasean 9mo agoIs this an education problem? Should the general public be more diligent in checking the sender domain of the emails they read? Is this a UX issue? Should email clients highlight and emphasize the sender domain more than their display name?
- schnable 9mo ago> Should the general public be more diligent in checking the sender domain of the emails they read? yes
- agwa 9mo ago2FA doesn't stop phishing unless it's WebAuthn. But SendGrid, which is owned by Twilio, only supports 2FA based on SMS or the Authy App (which is also made by Twilio): https://www.twilio.com/docs/sendgrid/ui/account-and-settings/two-factor-authentication https://www.twilio.com/docs/sendgrid/ui/account-and-settings... It seems like Twilio has a conflict of interest that prevents them from offering WebAuthn, as that would be a tacit admission that their SMS and Authy products are not actually that secure.
- Terretta 9mo agorich irony that twilio numbers don't qualify to receive SMS codes when senders check if it's a virtual number (the regulated aka important ones do check)
- deleted 9mo ago[deleted]
- kgeist 9mo agoI wonder why Gmail and other email providers don't just run an LLM/ML pipeline to detect phishing emails. It seems that matching an email's content with the sender's domain (and possibly analyzing the content behind links) would be enough to show, with high certainty, a warning like "Beware: this looks like a phishing email." Is it too expensive? Too many false positives?
- zahlman 9mo agoTo my understanding, they already do use some form of ML for this and it's part of how things get routed to the spam folder without explicit rules.
- pixl97 9mo ago>LLM/ML pipeline to detect phishing emails. I think you're about 20 years behind the times if you think they don't. There are a whole lot of problems with it when you start pressing the finer details like you list. For example, just look at the legit emails banks send out. They will tell you not to click links claiming to be your bank, then include links (claiming to be your bank) for more information. Simply put the rules block too much corporate email because people that write corporate email do lots of dumb things with the email system.
- Tossrock 9mo agoIt's true that a lot of established ML techniques were first popularized to fight spam (ie bayesian filtering), but it might also be the case that they're not applying the full might of eg Gemini-3-Pro to every email received. I suspect Gemini-3-Pro would do an effectively perfect job of determining if something is phishing, with negligible values in the false quadrants of the confusion matrix, but it's probably too expensive to use in that way. Which is why things like this can still slip through.
- yabones 9mo agoThey do - well sort of. The most essential check is SPF and DKIM which authenticate if the message has come from an authorized server. The problem is that most mail services are too lenient with mismatched sender identification. On one hand, people would be quite vocal about their mail provider sending way too much legitimate (but slightly misconfigured) mail to the spam folder. However it allows situations like to happen where the FROM header, the "From:" address, and the return path are all different. Most mail systems have several stages of filters, and the first ones (checking authentication) are quite basic. After that, attachments, links, and contents are checked for known malware. Machine learning might kick in after this, if certain criteria are met. Mail security is very complicated and works well except for the times it falls flat on its face like this. https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
- flatcakes 9mo agoI've been getting a lot of these, and forwarding them (along with the raw source of the email headers) to abuse@sendgrid.com with some success.
- bdcravens 9mo agoI received one, though it was for adding a footer honoring MLK. I kinda thought it was odd, but did't think much of it, since I'm apparently not in the group that would be offended in any way. I wonder if the variation they use is random, or in any way location-based to maximize response (I'm in Texas). I've also received a bunch of API failure phishing emails, as well as some implying we needed to change our auth to Sinch.
- schnable 9mo agoI think the main motivator is that most people/businesses would not want their transactional emails to include political at all.
- detourdog 9mo agoI can't think of one email I received from sendgrid I would consider legitimate. Anytime I receive an email distributed by sendgrid I have found it actually had no value to me. Sometimes it's from a business I have dealt with but I never wanted or was interested in the content.
- SoftTalker 9mo agoSame impression. SendGrid, MailChimp, any of those are just enabling spam at the end of the day.
- ceejayoz 9mo agoDon't leave Salesforce out.
- iamacyborg 9mo agoIn the same way that all software engineers are building harmful products, yes, sure.
- plorkyeran 9mo agoDo you specifically go out of your way to check who sent every transactional email you receive and take notes on which email sending service your order confirmation was sent by? That would be a very weird thing to do and would be the only way to know that.
- rphillips 9mo agoIf using GSuite then head to the Gmail admin panel and create a compliance rule with 2 regex expressions. 1. Add expressions to: If ALL of the following match the message. 2. Expression 1: Type: Advanced content match Location: Full headers Match type: Matches regex (?im)^from:\sSendGrid(?:\s+\w+)\s*<[^>\r\n]+>+$ 3. Expression 2: Type: Advanced content match Location: Sender header Match type: Not matches regex (?i)^[A-Za-z0-9._%+-]+@(sendgrid\.com|twilio\.com)$ Set the rule to reject or quarantine. Users will not see the messages unless the attackers change the From header.
- TZubiri 9mo agoMaking a custom rule for a specific sender feels like fighting a fire with a glass of water. It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider). The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught by SPF/DKIM. Most of the time the user doesn't need to do much, you can just be weary of sender domains, and report the email as phishing and help blacklist that specific IP address/domain. Similar to how in medicine sometimes the physician tells you to drink water and rest, no medicine needed, just let the immune system do its thing.
- rezonant 9mo agoAs explained in the article, the scammers are using compromised Sendgrid domains to send the phishing emails. This means the emails are going to pass SPF/DKIM. Those domains are apparently owned by legitimate businesses which are actual Sendgrid customers. The phishers just compromised their account and API credentials
- ZoneZealot 9mo agoSendGrid's platform doesn't need to be the sender of these emails at all. It's just classic phishing, the emails can pass SPF, DKIM and DMARC as all of these rely on DNS resource records to be created on the RFC5321.MailFrom and/or RFC5322.From domain. Which is under control of the spammer. It's not pretending to be from sendgrid.com, if it was then these measures would help.
- scosman 9mo agoSendGrid phishing emails are some of the best phishing emails. I get emails that there's elevated error rates on an API (`/v1/send`). Looks very legit, good design, reasonable call to action, some urgency which makes me want to click. They know from MX records I send email with Sendgrid, so it's well targeted. Easy catch when I see the domain, but other than that it's the best I've seen in years.
- creeble 9mo agoI've been getting them for weeks and never noticed they were phishing. I only used a SendGrid account briefly, as a potential backup to my current outgoing transaction mail provider. Sent exactly 5 test emails I think. The ICE one this morning gave me pause, but only about 2s before I deleted it and moved on with my busy day of reading HN posts.
- rezonant 9mo agoThat would seem to imply they weren't checking MX as I presume you have removed Sendgrid from your SPF allowed senders policy by now.
- tonymet 9mo agoIt would be good to hold carriers accountable for fishing and spam. Sendgrid , Twilio and other saas messaging carriers need to do a better job with integrity. I don’t expect them to carry the whole burden, but some negative incentive to promote investment . It could be as simple as enforcing sender pays metering . We all know spam is 60+ % of traffic, so sender pays would drive down spam very quickly
- tatersolid 9mo agoSendGrid and their competitors are already the very definition of “sender pays” for email. “Sender pays” is how they make money. This isn’t a problem of monetary incentives. The problem is that companies get their SendGrid credentials compromised via password re-use or phishing.
- tonymet 9mo agoI mean the carrier pays the recipient , so Twilio and sendgrid bear some cost
- Dylan16807 9mo agoThey understood just fine. But because that cost passes through to the sendgrid customer, it wouldn't motivate sendgrid to stop enabling spam.
- tonymet 9mo agocurrently the costs are too low to affect policy. that's my point. and the recipients are making extremely high margins on ads, so they don't have much reason to push back, either.
- Dylan16807 9mo agoFor any reasonable email fee, sendgrid can continue passing it on to the customers and not care. If you make the fee super high, then many email workflows completely break and sendgrid goes out of business. I don't think there's a number where it does what you want and incentivizes sendgrid to be careful. (And you might say to seek a middle ground, but I don't think there is one. My guess is that "too low for sendgrid to care much more about a couple percent of mail from hacked accounts" and "too high for sendgrid to still attract customers" probably overlap.)
- alila 9mo agoThe OP didn’t explain or showed the unsubscribe button compromise trick. Anyone here can shed some light on it? I always had the habit of clicking on the unsubscribe button whenever I see an unwanted email. And I’d like to know what would happen if I click on malicious unsubscribe link.
- amw 9mo agoThis speculative nonsense adds nothing: > We know that state actors have invested heavily in understanding and exploiting these divisions. Russian active measures campaigns have been documented doing exactly this kind of work: identifying wedge issues and creating content designed to inflame both sides. North Korea has demonstrated similar sophistication in their social engineering operations by targeting academics and foreign policy experts What about "read Twitter in between bouts of using one susceptible user's API key to spam other users for their API keys" _really_ requires the sophistication of a state-level actor? Statements like this aren't journalism, they're exactly the same kind of manipulation being used by the phishers.
- gadgetoid 9mo agoI’m more troubled by the fact these emails are hitting my sendgrid only email address. Is this related to the breach that SendGrid said didn’t happen? I set my account up in 2021 for reasons I don’t recall and it’s since been deleted/deactivated by them.
- jscheel 9mo agoI get a flood of these every single day. Because we use SendGrid as a critical part of our product, I have to look for any emails from them pretty closely. It’s gotten impossible to do with all of these phishing attempts. I gotta hand it to them, though, the attempts are excellent.
- xg15 9mo ago> The political sophistication on display here (BLM, LGBTQ+ rights, ICE, even the Spanish language switch playing on immigration anxieties) suggests someone with a deep understanding of American cultural fault lines. Or an AI.