Re: Did AT&T leak their email list publicly?

[patneedham]

I'm apparently on this list: [e-mail]

Here are some screenshots of the debacle [edit: properly redacted now]

https://imgur.com/a/MWV2wmk

https://imgur.com/a/yRJCKUn

It started out when someone wrote to that mailing list with

> This is a test to see if external users can email AT&T's internal email list with the most recent email mishap.

followed by other responses like

> I guess so…

> So far, based on the number of unique domains coming back directly to me (and replying all), it appears to be mostly business customers. I am assuming business because I also used my gmail for my business when I set up an AT&T account. Time will tell of course but there's definitely not an insignificant number of people on this list as far as I can tell.

> We’re just lucky there aren’t multiple people with vacation responses on eh?

[proslasher]

Legit, I'm the OP of the first email. AMA.

No, they didn't leak the email list, but they did leak their internal email list and showed that the incompetently set up an exchange DL and allowed anyone to email it instead of a restricted set of users. They also didn't take the time to close it down, they instead deleted it.

If I wasn't the OP, I wouldn't know that John Hammond is making a video of this right now. Check back in a few hours when this comment ages like fine wine.

[proslasher]

Video will be up tomorrow.

[Sylamore]

I'm surprised this hasn't happened before, @list.att.com is just a standard listserv type system, internally anyone can create and manage lists of email addresses with internal or external addresses in it and those lists are all open to the public internet if you know their address.

I can't remember if there is any kind of access control that the owner of the list can implement to prevent external messages to the list address but no longer have access to check.

[mattl]

How many unique addresses on the list approximately?

[patneedham]

No idea. The person who initially emailed that mailing list address said he'll write about it on his linkedin after the storm and after it's fixed. FWIW I'm not an AT&T customer (or business customer), I just happened to participate in some IOT hackathon they sponsored/hosted 6 or 7 years ago, that's the only way they've ever obtained my email address.

Only 9 unique email addresses have added to the "reply-all" thread within the past couple hours. Don't know if any estimates can be extrapolated from that though.

[castratikron]

I got one too

[samstave]

That list will be sold for much coin soon.