SendGrid infosec chief eats humble pie, admits email service hacked

'Account takeover was an isolated incident', insists firm


Marketing email distribution service SendGrid is asking customers to switch passwords after admitting it got hacked.

The move follows the realisation that a previously reported hack is a bigger deal than previously imagined. The initial alert was triggered after the SendGrid account of Bitcoin exchange Coinbase was compromised and abused to push a phishing attack.

Subsequent forensic and incident response work has revealed that hackers didn't just steal one set of account login credentials but the login details of a SendGrid worker. These purloined details were used to access “usernames, email addresses, and (salted and iteratively hashed) passwords for SendGrid customer and employee accounts” on at least three occasions during February and March this year.

Hackers may also have snatched customers’ recipient email addresses and contact information, creating a heightened risk of more plausible phishing scams for the interwebs at large in the process.

The practical upshot is that all customer accounts are potentially at risk of hijacking – especially if weak passwords are in play – hence the mandatory switch-up of both passwords and DomainKeys Identified Mail (DKIM)1 keys (a small minority of around 600 SendGrid customers have custom DKIM keys).

SendGrid boasts more than 100,000 customers, including well-known internet firms such as Airbnb, Foursquare, Spotify and Uber. Its cloud-based email delivery services handle everything from transaction confirmations to friend requests, sign-up confirmations and email newsletters. SendGrid is apologising to customers for the inconvenience caused by the hack and promised to improve the security of its systems including IP whitelisting and enhanced two-factor authentication.

The New York Times broke the story that Coinbase had its Sendgrid credentials compromised three weeks ago, back in early April. Sendgrid took issue with the NYT for implying that it had suffered a platform-wide breach, publishing a blog post decrying the report as "inaccurate".

David Campbell, chief security officer at SendGrid, has since been obliged to backtrack on these combative comments and admit that incident response experts have uncovered reasons to be concerned – if not widespread abuse of potentially compromised login details. ®

Bootnote

1DKIM is an email validation system designed to foil email spoofing, explained in greater depth here.

Similar topics

Broader topics


Other stories you might like

  • AMD claims its GPUs beat Nvidia on performance per dollar
    * Terms, conditions, hardware specs and software may vary – a lot

    As a slowdown in PC sales brings down prices for graphics cards, AMD is hoping to win over the market's remaining buyers with a bold, new claim that its latest Radeon cards provide better performance for the dollar than Nvidia's most recent GeForce cards.

    In an image tweeted Monday by AMD's top gaming executive, the chip designer claims its lineup of Radeon RX 6000 cards provide better performance per dollar than competing ones from Nvidia, with all but two of the ten cards listed offering advantages in the double-digit percentages. AMD also claims to provide better performance for the power required by each card in all but two of the cards.

    Continue reading
  • Google opens the pod doors on Bay View campus
    A futuristic design won't make people want to come back – just ask Apple

    After nearly a decade of planning and five years of construction, Google is cutting the ribbon on its Bay View campus, the first that Google itself designed.

    The Bay View campus in Mountain View – slated to open this week – consists of two office buildings (one of which, Charleston East, is still under construction), 20 acres of open space, a 1,000-person event center and 240 short-term accommodations for Google employees. The search giant said the buildings at Bay View total 1.1 million square feet. For reference, that's less than half the size of Apple's spaceship. 

    The roofs on the two main buildings, which look like pavilions roofed in sails, were designed that way for a purpose: They're a network of 90,000 scale-like solar panels nicknamed "dragonscales" for their layout and shimmer. By scaling the tiles, Google said the design minimises damage from wind, rain and snow, and the sloped pavilion-like roof improves solar capture by adding additional curves in the roof. 

    Continue reading
  • Pentester pops open Tesla Model 3 using low-cost Bluetooth module
    Anything that uses proximity-based BLE is vulnerable, claim researchers

    Tesla Model 3 and Y owners, beware: the passive entry feature on your vehicle could potentially be hoodwinked by a relay attack, leading to the theft of the flash motor.

    Discovered and demonstrated by researchers at NCC Group, the technique involves relaying the Bluetooth Low Energy (BLE) signals from a smartphone that has been paired with a Tesla back to the vehicle. Far from simply unlocking the door, this hack lets a miscreant start the car and drive away, too.

    Essentially, what happens is this: the paired smartphone should be physically close by the Tesla to unlock it. NCC's technique involves one gadget near the paired phone, and another gadget near the car. The phone-side gadget relays signals from the phone to the car-side gadget, which forwards them to the vehicle to unlock and start it. This shouldn't normally happen because the phone and car are so far apart. The car has a defense mechanism – based on measuring transmission latency to detect that a paired device is too far away – that ideally prevents relayed signals from working, though this can be defeated by simply cutting the latency of the relay process.

    Continue reading

Biting the hand that feeds IT © 1998–2022