HN Reader

If you start getting an email bombed out of nowhere, being signed up for hundreds of newsletters or other email notifications, take a quick look at your credit card statements for any unknown purchases. Email bombs are often used by card thieves to hide legitimate purchase notifcation email from retailers when they use your stolen creds.

You know, combing "bomb" with LAX makes me think really different things for awhile until my parser finally woke up ...

Another fun Zendesk “feature,” that, to my knowledge, has never been fixed is if you CC it on a thread with any other email address that auto-replies, it will get stuck in a loop and ping-pong emails back and forth until the mailbox fills up.

Unless I missed it, the article doesn’t explain how this works. It seems like the spammer sends an email to support@somecompany.com but spoofs the From address to be the target of the spam. The Zendesk ticket system then sends the auto reply to the spoofed From address

Brian Krebs is a saint for being the perennial punching bag and target of cybercriminals but continuing to publish important information independently.

Ah. This explains a bunch of odd emails I received all at the same time last week.

This doesn't surprise me since Zendesk uses the same DKIM key for all customers. I have multiple domains that I support and they all point to the same CNAME record.

This attack is called email amplification. Any open form that triggers email sending is vulnerable. Fortunately these bots are pretty basic in my experience, putting a captcha (or anything unexpected) in front is enough to stop these bots.