Posted by Philpax 2 days ago
Tell HN: Another round of Zendesk email spam
[1]: https://gist.github.com/hampuskraft/780c8fbcc4042689153533ef...
Either way, someone shared a much more minimal version [1] on my gist, which should be safe to use as long as you're not signing up for a Zendesk site. Most of the recent spam emails have been about Zendesk sign-ups specifically.
I just didn't want to keep maintaining this script if they find some other way to exploit Zendesk in the future, hence my nuclear approach.
[1]: https://gist.github.com/hampuskraft/780c8fbcc4042689153533ef...
Credit Karma is the biggest offender off the top of my head. For a company in the consumer datamining business, they sure aren't doing a good job.
It sounds like they’re crushing their goal, actually.
All support[at]<company>.zendesk.com were flagged, none of them reached the Inbox.
Most of whatever[at]company.tld were flagged also. I think only Headspace and another that I don't remember got to my inbox. There were some automatic SPAM flags using custom domains that are more or less known: Tinder, Squarespace, TED, ...
So I guess currently their reputation is messed up.
I did a Zendesk integration shortly after working on a general overhaul of our email at a previous company. The overhaul involved separating out our different types (transactional, marketing, support, etc), and then implementing best practices on deliverability for each of them. Not your day-one email setup, but we were still a small company.
The comparison to Zendesk's approach was astounding. Assuming you don't want to use a Zendesk address (we didn't, customers thought it was dodgy), the email setup they let you do was bad, and their support folks had no idea about any of the details. DKIM, SPF, etc, was all alien to them. Ironically they had pretty bad support in general.
I like to think I knew what I was doing. :-)
Unfortunately, too many company admins keep saying "we don't want our customers to have to be configured correctly, we might miss a message from them" and disable all the built in protections. Hopefully the option to disable protections will go away soon.
So basically good old fashioned "quality" enterprise shitware.
I suspect the issue is that we weren't paying enough. We had maybe 10 seats. I bet if you're buying 1000 seats a bunch of Zendesk engineers turn up and configure everything for you, but with the robust email setup needing that engineering time on their side to configure... so I guess in that way it may be Enterprise shitware.
Since then, Zendesk seems to have strengthened their system so that opening a ticket requires account activation first. Leading to today, when I’ve received thousands of signup attempt emails (again, typically one or two per Zendesk‐hosted forum). This is way more emails than I got last time. I hypothesize that the spammer is doing a “last gasp” attack: now that Zendesk has burned the exploit by no longer including the ticket text in the emails, the spammer is trying every Zendesk site it knows in hopes that some of them are slow to update and still forward the ticket text to the victim.
[Ref](https://support.zendesk.com/hc/en-us/articles/8257723564186-...)
[Ref 2](https://darknetsearch.com/knowledge/news/en/zendesk-ticket-s...)
similar to others i had it hitting emails that "don't exist" (wildcard catchall), including the less tasteful ones mentioned here.
https://support.zendesk.com/hc/en-us/articles/8257723564186-...
I'm not satisfied with it, tbh.
You gotta be kidding me.