Re: PSA: change your fedex.com account logins

[Steve Atkins <steve () blighty com>]

> On May 31, 2019, at 2:17 PM, Richard <lists-nanog () listmail innovate net> wrote:
>
>
>
> > Date: Friday, May 31, 2019 08:04:13 -0400
> > From: Jason Kuehl <jason.w.kuehl () gmail com
> >
> > Is it possible, yes. I've seen it several times now at my place of
> > work. Targeted attacks are a thing.
> >
> > > > Dan Hollis wrote:
> > > >
> > > > Phishing scheme didn't happen.
> > > >
> > > > fedex has had a number of major compromises so it's not a
> > > > stretch that their user database was stolen and sold to spammers.
>
> When I have looked into this type of issue for my unique addressing
> some did trace back to back-end db hacks (e.g., adobe), but I found
> that the most likely culprit was the 3rd-party bulk mailer that
> handled the organization's marketing mail. It could be a non-zeroed
> disk thrown into the trash or an inside job, but it almost always
> traced back to one or two bulk mailing companies. 

The most common issue for quite a while was malware on the windows
desktops of employees with access to the companies ESP account.

The web browser saves username and password to autofill the ESPs
web interface in a very predictable place. Malware exfiltrates that. Bad
guys compromise ESP account, download all the lists they can find
(and then start spamming on the company dime).

That's why ESPs pushed quite so hard to get multifactor authentication
of some sort adopted by their customers. But a lot of them didn't do
that (partly, I suspect, because the ESP account was accessed by
multiple employees) and even if they did that didn't stop the lists
that had already been downloaded.

Actual compromises of the ESP, or bad behaviour of it's employees,
seem to be rather rare but customer account compromise is
everywhere.

Cheers,
  Steve