Email Bombs Exploit Lax Authentication in Zendesk

Cybercriminals are abusing a widespread lack of authentication in Zendesk to flood targeted inboxes with thousands of ticket creation notifications that appear to come from hundreds of Zendesk customers. The messages can bear any subject line and are sent from the customers’ domains rather than Zendesk itself, with examples including The Washington Post and Tinder, among others.

Zendesk said the abuse occurred when customer accounts configured their instance to allow anonymous submissions, meaning no prior verification was required to raise a ticket. The attack also exploited replies that used third-party email addresses, with some notifications including the subject chosen by the creator and a reply-to address such as help@washpost[.]com.

Zendesk has claimed it uses rate limits to curb mass ticket creation, but in this incident those limits did not prevent the flood, and the company is reviewing additional preventive measures, according to Carolyn Camoens. The post notes that validation of the submitter’s email before sending responses would have prevented the abuse. according to Carolyn Camoens