HN Reader

If you start getting an email bombed out of nowhere, being signed up for hundreds of newsletters or other email notifications, take a quick look at your credit card statements for any unknown purchases. Email bombs are often used by card thieves to hide legitimate purchase notifcation email from retailers when they use your stolen creds.

Brian Krebs is a saint for being the perennial punching bag and target of cybercriminals but continuing to publish important information independently.

This attack is called email amplification. Any open form that triggers email sending is vulnerable. Fortunately these bots are pretty basic in my experience, putting a captcha (or anything unexpected) in front is enough to stop these bots.

This spam campaign drove me nuts! I received so many of these emails from so many random companies.

The key takeaway is to always have a email verification loop (or something stronger like phone verification) when using an anonymous user feature. You need to prove you own an email address before you use it.

Ah. This explains a bunch of odd emails I received all at the same time last week.

You know, combing "bomb" with LAX makes me think really different things for awhile until my parser finally woke up ...

Unless I missed it, the article doesn’t explain how this works. It seems like the spammer sends an email to support@somecompany.com but spoofs the From address to be the target of the spam. The Zendesk ticket system then sends the auto reply to the spoofed From address

This doesn't surprise me since Zendesk uses the same DKIM key for all customers. I have multiple domains that I support and they all point to the same CNAME record.

Another fun Zendesk “feature,” that, to my knowledge, has never been fixed is if you CC it on a thread with any other email address that auto-replies, it will get stuck in a loop and ping-pong emails back and forth until the mailbox fills up.