Fraudsters Abuse DocuSign API for Legit-Looking Invoices

I didn’t see much visibility on this DocuSign hack. This is a situation where the product features were not vetted to understand if they could be misused by malicious fraudsters. There is not a technical vulnerability, it comes down to a design weakness in the product.

According to the security team at Wallarm, “An attacker creates a legitimate, paid DocuSign account that allows them to change templates and use the API directly.” They then employ a special template that masquerades as a well-known brand to send the billing invoice. Because the fraudulent invoice is directly sent from the DocuSign platform, it appears legitimate and won’t be stopped by email filters.

The entire process can be automated and sent out on a massive scale, spraying large numbers of unsuspecting victims.

It is the old story of well-intentioned developers asking if they “can” develop something without questioning if they “should” develop something.

It often takes security-minded experts, savvy in the ways of how attackers think, to evaluate such situations. These are often missed by even experienced developers because there is no technical vulnerability per se. But that does not mean a creative adversary can’t use it in destructive ways. Often, additional controls, oversight, or accountability must be included to dissuade, prevent, or quickly alert of misuse.

The sustainable solution for all software and service vendors is to have cybersecurity experts, not just security-minded developers, as part of the initial feature design teams, keep them in the loop during development, and make sure they vet the final capabilities before going live.