DynDNS Hacked?

Author	All Replies
rebus9 join:2002-03-26 Tampa Bay Reviews: ·Verizon FiOS ·Bright House	DynDNS Hacked? I create unique email aliases for every vendor I do business with. More importantly, I use each unique alias only with that specific vendor and noone else. That way if I get spam to a particular alias, I know the source of the leak. Tonight I received a scam spam impersonating UPS (the parcel delivery service) which links to a Hungarian URL. It was sent to the email alias used for DynDNS. Our mail server has very aggressive protection against dictionary-style harvesting attacks. And since it's an alias and not a mailbox, it's not configured on any PC or mail reader. It only exists on the mail server as a forwarding rule. So it would appear that either DynDNS had its subscriber email info hacked, or they've sold their email lists to some 3rd party who's either leaked it or is abusing it. Maybe Dyn was hacked-- maybe not. Either way, heads up if you're a DynDNS subscriber.
	to forum · permalink · 2012-10-25 21:02:56 ·
Snowy mIRC unix.ro UnderNet Premium join:2003-04-05 Kailua, HI kudos:6 Reviews: ·RoadRunner Cable ·Clearwire Wireless	How unique is the local part of the email address? It's not uncommon for spammers to reuse the local part of an email address list by replacing the domain part with a different name. e.g., a@msn.com becomes a@dyndns.com, a@gmail.com etc... If your address was 1313$$998UUytIpRRtyeWWS@dyndns.com it would get spammed if there an email address such as 1313$$998UUytIpRRtyeWWS@yahoo.com that had been scraped. This isn't a guess to what occurred, just one alternative example of how it could have occurred.
	to forum · permalink · 2012-10-25 21:50:28 ·
rebus9 join:2002-03-26 Tampa Bay	Anything is possible, but over the years I've accumulated a little over 200 unique aliases. Only the DynDNS alias received spam, and there are far easier aliases to guess. (think of big name merchants, etc)
	to forum · permalink · 2012-10-25 22:55:29 ·
jimkyle Btrieve Guy Premium join:2002-10-20 Oklahoma City, OK kudos:2 Reviews: ·AT&T Southwest	reply to Snowy Your theory would be a possible explanation if the address in question were the "from" part of the message, but as I read it the OP's alias would have to be the local part of the address and the domain would have to be for his mail server. Your scenario would send the spam to dyndns.com, not to the OP, if used for the "to" part of the envelope. I suspect it's much more likely for DynDNS to have sold at least part of their list to a third party. Another possibility is a sniffer somewhere along the way, harvesting addresses at random... -- Jim Kyle
	to forum · permalink · 2012-10-25 23:58:37 ·
NormanS Premium,MVM join:2001-02-14 San Jose, CA kudos:6 Reviews: ·SONIC.NET ·Pacific Bell - SBC 1 edit	reply to Snowy said by Snowy: How unique is the local part of the email address? It's not uncommon for spammers to reuse the local part of an email address list by replacing the domain part with a different name. e.g., a@msn.com becomes a@dyndns.com, a@gmail.com etc... Assumes that OP has an '@dyndns.com' email account; but I don't see any such service at their site. OTOH, I have long had a paid DNS service from them, and opted to receive regular notices from them to an old Pacbell account, using Yahoo! Mail Addressguard. My address is in the form, 'base-uniqueuser@yahoo.com'. In my case, Yahoo! has had insecurities, such that, 'user@yahoo.com' for any given Yahoo! Mail (or partner ISP) account might have been leaked. In the OP's case, I assume he is familiar with the security of his ESP's servers, so it would br reasonable to consider a problem with the DynDNS subscriber mailing list. -- Norman ~Oh Lord, why have you come ~To Konnyu, with the Lion and the Drum
	to forum · permalink · 2012-10-26 03:13:14 ·
koitsu Premium,MVM join:2002-07-16 Mountain View, CA kudos:18	reply to rebus9 said by rebus9: Anything is possible, but over the years I've accumulated a little over 200 unique aliases. Only the DynDNS alias received spam, and there are far easier aliases to guess. (think of big name merchants, etc) As someone who adopted this methodology of trying to prevent spam and "track the source who distributed the Email address", I can assure you with absolute certainty that in the long term / grand scheme of things it doesn't work. For example, my method was to use things like dyndns@subdomain.domain.com. Sure, it worked wonderfully, until spammers began changing their methods/models. They don't care about bouncebacks or SMTP rejections (no such user) any more -- they quite literally just guess whatever as the username, send the mail out as best they can, and discard the results. They take words out of dictionaries, make their own permutations, take common names of services/companies/etc., and use them as the username portion as as the domain portion and just "hope for the best". So in my case, what's the chance of them ""guessing"" dyndns@subdomain.domain.com, despite it never being mentioned anywhere or used anywhere but with DynDNS? Answer: extremely high. In fact, it's even higher than the likelihood of DynDNS selling my Email address. Obviously if you used something like jds3i2jke00_34hskj@domain.com where the username portion was totally random and very long (we're talking 12+ characters minimum), the chance of this happening is very low, but it's still possible. Remember: spammers will figure it out, even if just by chance. A colleague of mine has been using a clever-but-different version of the above model with pretty good results -- specifically, username@{year}.hisdomain.com. When the year rolls, he nukes the A/MX records for the previous year, and adds ones for the current. The downside to this method is that he has to "train" human beings to remember to specify the correct year when Emailing him (e.g. address books have to be updated once a year). But overall it works. That's all I have to say on the matter. -- Making life hard for others since 1977. I speak for myself and not my employer/affiliates of my employer.
	to forum · permalink · 2012-10-26 07:24:14 ·
KodloN @per4mance.cz	reply to NormanS I can confirm what rebus9 wrote. I'm also using unique email alias for every eshop or service provider registration. Today early morning I have recieved spam to dyndns email alias. Sender: "UPS Services" Subject: "Delivery problem # Error ID3433" Contains link: http___www_agstrong_hu_RXBOORXKQB_html (I have intentionally invalidated the link here) I don't know if there is a chance to defend. Of course, I will cancel the alias.
	to forum · permalink · 2012-10-26 07:34:15 ·
dv123 @virginmedia.com	reply to rebus9 Hi -Yes, I had exactly the same problem this morning. I too use disposable addresses for each service I subscribe to, and I got the "UPS" mail you refer to. The local part of my address is very unusual, and I have several hundred such disposable addresses in use, only a handful of which have evr been compromised. It does seem that the DynDNS mailing list is "out there".
	to forum · permalink · 2012-10-26 07:37:40 ·
rebus9 join:2002-03-26 Tampa Bay Reviews: ·Verizon FiOS ·Bright House	reply to koitsu said by koitsu: said by rebus9: Anything is possible, but over the years I've accumulated a little over 200 unique aliases. Only the DynDNS alias received spam, and there are far easier aliases to guess. (think of big name merchants, etc) As someone who adopted this methodology of trying to prevent spam and "track the source who distributed the Email address", I can assure you with absolute certainty that in the long term / grand scheme of things it doesn't work. We'll agree to disagree. I've been doing this since I registered my first domain way back in 1996. It has worked spectacularly well for 16 years, and continues to do so. Within the past year or so, the same thing happened to a small nutritional supplement vendor. They had no clue their user data had been compromised until I phoned them after receiving a phish email to that alias. It also comes in handy for detecting which websites prostitute their users out to 3rd parties. I had a couple of aliases that received floods of unsolicited messages (calling them that, instead of spam, because it was focused/targeted content and not random). There was absoltely no doubt who'd sold their lists to 3rd parties who sold products that correlated with the orignal vendor's genre. Sure, I'll name the worst offender-- active.com. I used them to sign up for a few races, and within a couple of months I was flooded with advertising emails from many different vendors of running shoes, running clothing, accessories (gps trainers, heartrate monitors, etc). And before you ask-- I always make sure I've un-checked any boxes that ask for permission to give my address to partners and 3rd parties, or asking if I want to receive periodic emails, etc.
	to forum · permalink · 2012-10-26 09:04:47 ·
aha @your-server.de	Now I got similar mails like KodloN... I use MD5sums (MD5 of site and username) as local part my of email-addresses. At the moment I have 5 of them because I have to manage 5 different dyndns-accounts for my customers Today I got 4 mails (to 4 different for-dyndns-used-addresses) like this: --- SNIP --- Return-Path: Received: from web25.webkontrol.doruk.net.tr (unknown [212.58.2.167]) by my-mailserver (Postfix) with ESMTP id 41D922A9BC for ; Fri, 26 Oct 2012 13:09:55 +0200 (CEST) Received: from WEB25 ([127.0.0.1]) by web25.webkontrol.doruk.net.tr with MailEnable ESMTP; Fri, 26 Oct 2012 14:09:36 +0300 Date: Fri, 26 Oct 2012 14:09:36 +0300 Subject: SPAMVERDACHTUPS delivery problem # Error ID21777 To: the@ddress From: "UPS Support" X-Mailer: MIME-tools5.503(Entity5.501) Reply-To: "UPS Support" Message-ID: --- SNAP --- or this --- SNIP --- Return-Path: Received: from yumatrix.arvixededicated.com (unknown [65.98.83.154]) by mailserver (Postfix) with ESMTPS id 177162B34F for ; Fri, 26 Oct 2012 02:24:50 +0200 (CEST) Received: from yumatrix by yumatrix.arvixededicated.com with local (Exim 4.80) (envelope-from ) id 1TRXPA-00070C-PU for my2nd@ddress; Thu, 25 Oct 2012 20:04:04 -0400 To: my2nd@ddress Subject: Error in the delivery address ID#66305 From: "UPS Information" X-Mailer: CSMTPConnectionv1.3 Reply-To: "UPS Information" Message-Id: Date: Thu, 25 Oct 2012 20:04:04 -0400 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - yumatrix.arvixededicated.com X-AntiAbuse: Original Domain - mydomain X-AntiAbuse: Originator/Caller UID/GID - [501 501] / [47 12] X-AntiAbuse: Sender Address Domain - yumatrix.arvixededicated.com --- SNAP --- That really looks like somebody hacked Dyndns!
	to forum · permalink · 2012-10-26 10:02:42 ·

thermoman @mediaWays.net	Hi there, just found the following phishing mail in my INBOX addressed to an unique email address only used for my dyndns account: To: Subject: My resume MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="__MESSAGE__ID__ABcSZaXcVzngFw" --__MESSAGE__ID__ABcSZaXcVzngFw Content-type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit Hello, Thank you for getting back to me about the clerk position. I really want to be a part of the company and the job sound great. So I'm sending you all documents with the scan of my passport. Looking forward to your reply. Thank you. --__MESSAGE__ID__ABcSZaXcVzngFw Content-Type: application/x-msdownload; name="Resume_CV_Passport_Scans.zip" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Resume_CV_Passport_Scans.zip" ... Googled "dyndns hacked" just after reading this mail and found this board.
	to forum · permalink · 2012-10-26 12:32:58 ·
thermoman @mediaWays.net	Seems they are already aware of the situation: »twitter.com/DynInc/status/261864026571677696
	to forum · permalink · 2012-10-26 12:43:47 ·
NormanS Premium,MVM join:2001-02-14 San Jose, CA kudos:6 Reviews: ·SONIC.NET ·Pacific Bell - SBC	reply to KodloN said by KodloN : I can confirm what rebus9 wrote. I'm also using unique email alias for every eshop or service provider registration. Today early morning I have recieved spam to dyndns email alias. I have been watching my 'base-ddns@yahoo.com' email alias (the actual account is, 'user@pacbell.net'). But, as with the very nasty Yahoo! leak, I seem to be unaffected. In the case with the Yahoo! leak, victims had to have used a particular, newly purchased (by Yahoo!) service; I had not signed up for it. In this case, I am wondering if spammers have figured out that the 'base-uid@yahoo.com' is akin to a spamtrap; to be avoided. -- Norman ~Oh Lord, why have you come ~To Konnyu, with the Lion and the Drum
	to forum · permalink · 2012-10-26 14:19:58 ·
Snowy mIRC unix.ro UnderNet Premium join:2003-04-05 Kailua, HI kudos:6 Reviews: ·RoadRunner Cable ·Clearwire Wireless	reply to jimkyle said by jimkyle: Your theory would be a possible explanation if the address in question were the "from" part of the message, Yes, you're absolutely correct. Thank you to all who helped clear up any confusion my post created.
	to forum · permalink · 2012-10-26 16:21:08 ·
OinkOink @myvzw.com	reply to rebus9 I, too, can confirm with the rest. I use the same methods and got the same exact spam/phish. (And if you haven't used it, let me give a free plug to sneakemail.com, which makes this method extremely simple and extremely effective.)
	to forum · permalink · 2012-10-26 19:36:55 ·
mmainprize join:2001-12-06 Houghton Lake, MI	reply to rebus9 Well i have seen where i get an e-mail but i can not find my mailbox address in the header anywhere, but i still get the message. The name it was sent to, always starts with the same letter as my e-maill address but it is not my e-mail address. In these cases, the e-mail was sent to all users, like wildcards, r*@Dyn.com. Not sure how this is done but they must have hacked either dyndns or the ISP mail servers, or found a bug in a, IM/send/reply to a dyndns user, at the dyndns web site. I also have a Dnydns account but i did not get the spam.
	to forum · permalink · 2012-10-27 21:55:11 ·
rebus9 join:2002-03-26 Tampa Bay Reviews: ·Verizon FiOS ·Bright House	reply to thermoman said by thermoman : Seems they are already aware of the situation: »twitter.com/DynInc/status/261864026571677696 I emailed them directly around the time I made the original post here, and got a response from Dyn asking for the spam/scam message and full headers. (which I sent) Seeing that other users are also getting the same spam kind of confirms my suspicion that the Dyn email list is "out there". Now the question is how it got there-- either via 3rd party, or system compromise.
	to forum · permalink · 2012-10-27 22:19:43 ·
hszeto join:2002-06-05 1 edit	reply to rebus9 Just like you, we run our own POP3 server. Therefore, we are able to give unique e-mail address for each contact. we have dyn@*..org e-mail address for Dyn. In contrast, we have not received anything from this e-mail address at all. In fact, we are very alert of this type of issue. We were the first to report this type of issue at this site as you can see »[VOIPo.COM] Unique e-mail address for pre-launch sign-up got spa Unfortunately, in spite of reporting every single spam received to SpamCop and KnujOn, we continue to receive spam at voipo@xx.xxx.xx e-mail address almost 3 years later now.
	to forum · permalink · 2012-10-28 13:52:29 ·
NormanS Premium,MVM join:2001-02-14 San Jose, CA kudos:6 Reviews: ·SONIC.NET ·Pacific Bell - SBC	reply to mmainprize said by mmainprize: Well i have seen where i get an e-mail but i can not find my mailbox address in the header anywhere, but i still get the message. The name it was sent to, always starts with the same letter as my e-maill address but it is not my e-mail address. SMTP doesn't require the "Receipt-To:" email address to be stamped in the headers. Most email services do not, but some do. Yahoo! Mail is one which does. From a test: X-Apparently-To: x@yahoo.com via 98.138.212.28; Sun, 28 Oct 2012 11:32:21 -0700 To: <x@sonic.net> In full: X-Apparently-To: x@yahoo.com via 98.138.212.28; Sun, 28 Oct 2012 11:32:21 -0700 Received-SPF: pass (domain of hotmail.com designates 65.55.34.210 as permitted sender) Message-ID: <COL103-DS1314D5780149C4D08D6733E77C0@phx.gbl> From: S L* <x@hotmail.com> To: <x@sonic.net> Subject: [TEST] Will this work? Date: Sun, 28 Oct 2012 11:32:00 -0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0010_01CDB4FF.D887C8D0" Importance: Normal Content-Length: 628 Once the email has been placed in the mailbox, the "Receipt-To" data is no longer needed, so it is normally discarded. -- Norman ~Oh Lord, why have you come ~To Konnyu, with the Lion and the Drum
	to forum · permalink · 2012-10-28 15:08:10 ·
mmainprize join:2001-12-06 Houghton Lake, MI	NormanS SMTP doesn't require the "Receipt-To:" email address to be stamped in the headers. Most email services do not, but some do. Yahoo! Mail is one which does. From a test: Once the email has been placed in the mailbox, the "Receipt-To" data is no longer needed, so it is normally discarded. That interesting, The only e-mails like those i get are in my Hotmail inbox (I get those in outlook, i don't use the web interface). So did that e-mail you sent with a wild-card in the address work or was it rejected as invalid address. I do not know how they do it but i get e-mails with one or more addresses in the To: line but it is not my address listed. Like you stated it don't have to be there or was removed, and maybe it is a blind copy of some sort.
	to forum · permalink · 2012-10-28 15:40:29 ·

Broadband Tech > Security > Scam and Phishbusters > DynDNS Hacked?