tech
A researcher bought noreply.net. Companies started sending him secrets.
Companies treat some email domains as digital trash cans, despite the risks.
TL;DR
- Security researcher Cory Solovewicz unintentionally created an 'accidental honeypot' by purchasing noreply.us and noreply.net domains.
- Companies are sending sensitive information, including personal data and company secrets, to these 'noreply' domains due to misconfigured systems.
- Mike Sheward also bought deleteduser.com and discovered thousands of unintended emails from various organizations, indicating a broader issue of improper email address handling.
- Both researchers have acquired over 30 domains to prevent malicious actors from exploiting this vulnerability.
- Solovewicz has scanned 7,136 domains and found 328 configured with catch-all inboxes, suggesting the problem is extensive.
- Researchers are attempting to notify affected companies, but responses are mixed, and the scale of the issue makes comprehensive notification challenging.
- The problem is not new, with similar issues reported almost 20 years ago, yet it remains avoidable through proper system configuration.