[Solved] Collabora user base / db hacked?

dartcafe · October 4, 2017, 7:27am

I got an email sent to a mail address I used to register on Collabora:

Betreff: Collabora Online in ownCloud demo access
Datum: Mon, 02 Oct 2017 09:26:26 +0000 (UTC)
Von: Eloy Crespo eloy.crespo@collabora.com
Antwort an: eloy.crespo@collabora.com
An: [real name] <[real mail adress]>

Hi [real name]!

Thank you for your interest in Collabora Online in ownCloud.

Simply click on the activation link to activate your demo:

ownCloud: Demo activation link

You will be redirected to the demo login screen, where you can log in with:

username: [real mail adresse]
password: owncloud1234 (not a real used password by me)

Once your demo is activated you can always return to our ownCloud demo page to access your demo.

If you have any questions about the demo, or need commercial info, just reply to this email.

Best regards,

Eloy

Eloy Crespo
Sales Executive
Collabora Productivity Ltd.
eloy.crespo(at)collabora.com

The links point to a server named hxxxs://u2350786.ct.sendgrid.net/wf/click?upn=[…]

Escubaer · October 4, 2017, 7:31am

Thats an official email from Collabora. Got the same thing during the process at some point.

dartcafe · October 4, 2017, 8:28pm

Hmmm, OK. But the mail has many aspects that allows the conclusion, that this is scam.

I didn’t had interest in collabora recently.
The sender address (eloy.crespo@collabora.com) is from another domain, than the mail comes from (sendgrid.net).
All links lead to u2350786.ct.sendgrid.net.
The domain sendgrid.net has no content. www.sendgrid.net is not found.
A password is sent in clear.
…

Sorry, but that doesn’t look very professional.

lennyhorstink · October 13, 2017, 10:54am

Hi. Just learned about this thread.

Sorry for the mailing! At Collabora we use a marketing automation tool to send out demo request emails, and last week I made some fixes in the system after a major update. But, an error caused to send a batch of older contacts the demo activation email again…

We use Sendgrid (www.sendgrid.com) to send out the emails, for better deliverability and extra email statistics. So, all urls are changed by sendgrid to sendgrid.net links.

And, the password to the demo is send in the clear, because it’s a temporary demo account, to play with. We recommend people to never upload any sensitive data to any demo account

So, it was not a hack. It was a error that appeared after updating internal systems, and something I should have caught earlier. Sorry for any inconvenience caused…

dartcafe · October 13, 2017, 11:08am

Thanks for your answer. I am just a little bit sensible about that.