I didn’t see much visibility on this DocuSign hack. This is a situation where the product features were not vetted to understand if they could be misused by malicious fraudsters. There is not a technical vulnerability, it comes down to a design weakness in the product.
According to the security team at Wallarm, “An attacker creates a legitimate, paid DocuSign account that allows them to change templates and use the API directly.” They then employ a special template that masquerades as a well-known brand to send the billing invoice. Because the fraudulent invoice is directly sent from the DocuSign platform, it appears legitimate and won’t be stopped by email filters.
The entire process can be automated and sent out on a massive scale, spraying large numbers of unsuspecting victims.
It is the old story of well-intentioned developers asking if they “can” develop something without questioning if they “should” develop something.
It often takes security-minded experts, savvy in the ways of how attackers think, to evaluate such situations. These are often missed by even experienced developers because there is no technical vulnerability per se. But that does not mean a creative adversary can’t use it in destructive ways. Often, additional controls, oversight, or accounta
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.