You don’t always need to hack into a company’s systems to get its secrets. Sometimes, the company will simply email them to you. A new report by WIRED’s Matt Burgess has uncovered a bizarre email security problem in which companies are inadvertently sending sensitive information to domains that can be registered and controlled by outsiders. Security researchers Cory Solovevich and Mike Sheward discovered that seemingly harmless addresses such as noreply and deleteduser can become unexpected gateways to corporate information when the domains behind them aren’t properly controlled.
The “hack” is buying the right domain
The worrying part is that this doesn’t require sophisticated hacking. Solovevich discovered that domains such as noreply.net and noreply.us were receiving huge volumes of emails that companies presumably thought would disappear into the void.
Instead, those messages landed in an inbox he controlled. WIRED reports that noreply.net received more than 400,000 messages over a year and a half, including more than 28,000 attachments. The emails ranged from ordinary notifications to employee information and other sensitive business data.
Sheward encountered a similar problem after purchasing deleteduser.com, receiving thousands of unintended emails containing information such as work vacation requests, hotel bookings, employee names and Zoom meeting invitations. The underlying problem is fairly simple. Companies sometimes use placeholder addresses for accounts that no longer exist, assuming nobody can access the destination. But if the associated domain is no longer controlled by the organization and someone else registers it, those supposedly dead-end emails can suddenly have a very real recipient.
This goes way beyond a few stray emails
The researchers found that the problem could be widespread. Solovevich identified 7,136 domains configured to receive email, including 328 with catch-all inboxes capable of accepting messages sent to different addresses within those domains. That doesn’t mean all of these domains are actively leaking sensitive information, but it highlights how easily forgotten email configurations can become a security problem.
Fortunately, Solovevich and Sheward have been notifying affected organizations rather than simply exploiting the information they receive. Solovevich has also purchased more than 30 domains to prevent malicious actors from taking advantage of the same issue.
The bigger lesson from WIRED’s investigation is almost embarrassingly simple: an email address isn’t a black hole just because a company thinks it is. Organizations can spend millions protecting their networks from sophisticated attacks, but if sensitive emails are still being sent to domains someone else can buy, sometimes the easiest way into a company’s secrets is simply owning the right piece of internet real estate.