40

I've received email confirmation from careers.stackoverflow.com that an application message--supposedly from me--has been received by an employer. The email confirmation went to one of my email addresses, but not one that I've used here. (It's my first name at a major email service, so it's an email address that a lot of people seem to get confused about, and they sign up for things, thinking it's theirs.)

My first thought was that it was an application from another stack overflow account, one that someone opened with the wrong email address. But when I check my own sent box on careers.stackoverflow.com, there's the message:

Dear Sir stroke Madam,
Fire, exclamation mark. Fire, exclamation mark. Help me, exclamation mark. 123 Carrendon Road.
Looking forward to hearing from you. All the best, Maurice Moss.

Um, apparently this is a character on The IT Crowd. And someone is sending fake emails as this character, which are somehow now attached to my stackoverflow account. Also, the employer ("Grindstone") isn't showing up in any searches, and I can't contact them through the message thread, because they haven't replied. With luck, they'll just dump it, but it's concerning.

There doesn't seem to be a stackexchange account associated with the email address where I got the confirmation--all attempts at using the stackoverflow "forgot my password" turn up with no accounts for that email address. Again, somehow this fake message has been associated with my stackoverflow account.

I've already changed my stackexchange password, but this whole episode suggests that there's some systemic vulnerability.

Is there anyone on staff who can look into this with me?

Update: I did find the employer in question--in Australia, and careers.stackoverflow.com tells me in bold green type at the top of the listing that I applied on July 29. I did not.

Explanation: Option 1 of Martijn's answer, based on our discussion, looks like the best explanation.

Bug: If someone clicks a link in an email that was sent to an email address that isn't yet associated with their SO account, that email address will automatically become associated. This could, theoretically, be used to insert sent messages from someone's SO account without their consent, and without knowing their password. (Though the attacker would have to know that their target has an SO account, and has an email address not yet associated with SO.)

Improve this question
4
  • 1
    Update: I did find the employer in question--in Australia, and careers.stackoverflow.com tells me in bold green type at the top of the listing that I applied on July 29. I did not.
    – Maurice Rickard
    Jul 29, 2014 at 2:55
  • Do you know if that employer indeed received something as well? (Surely the developers will be able to tell without asking them; but I'm just too curious!)
    – Arjan
    Jul 29, 2014 at 10:16
  • 1
    I haven't heard back from them, but it seems like it was sent through SO's system using the "apply without logging in" option. (See my comments on @martijn-pieters answer below; I think I've figured out how this all happened.)
    – Maurice Rickard
    Jul 29, 2014 at 11:53
  • @Laura in the end of his answer, Alex raise a possible feature request. Maybe edit it into the question and bring back the tag? (agree that at the current state, the question is not a feature request :))
    – Shadow The GPT Wizard
    Aug 5, 2014 at 22:27

2 Answers 2

Reset to default
20

The message is a quote from a UK sitcom called The IT Crowd; Moss has discovered a fire, has no idea how to deal with it and ends up writing an email to the emergency services:

Dear Sir stroke Madam, I am writing to inform you of a fire which has broken out on the premises of... no, that's too formal.

Dear Sir stroke Madam. Fire... exclamation mark. Fire... exclamation mark. Help me... exclamation mark. 123 Carrendon Road. Looking forward to hearing from you. All the best, Maurice Moss.

See a YouTube video of the sketch.

Two options as to what happened here:

  • Someone played a prank on the Australian company by applying with the above message (probably via the Apply without logging in option) and used the first name of the sitcom character as the email address; [email protected]. This happens to be an actual account, yours.

    Because you received the resulting email and clicked on the link, Careers has registered the email as being yours and associates it with the account you are logged in with. This sort of makes sense as you can fill in any email address when applying.

    Suddenly it looks as if you sent this from your account.

  • Someone used your account to play a prank on you. You may want to check what computers you used recently that you may have left logged in. It is probably wise to change your password on whatever OpenID provider you use to log in to Careers.

Given that the email address used matches the fictional character, I'd say option 1 is more likely here.

Improve this answer
15
  • 1
    Yup, looks like someone who knows the OP is playing a joke on his expanse, knowing his password.
    – Shadow The GPT Wizard
    Jul 29, 2014 at 10:43
  • No one who knows me knows my SO password--it's not a word or phrase a person could guess, and if they were playing a prank, they'd go after a more visible target, rather than SO careers. Also, I'm not Australian, and wasn't going after this job. And the email address used (maurice@[commonemailprovider].com) wasn't associated with my SO account.
    – Maurice Rickard
    Jul 29, 2014 at 11:39
  • You're close, though, I think: let's say someone's playing a prank on the firm posting the job by sending this. They click SO's Apply Now button and Apply Without Logging In. They fill out a web form, and, not wanting to use their real email address, make one up--except it's real, happens to be mine, and I have an SO account. But this email address isn't associated with any accounts (yet).
    – Maurice Rickard
    Jul 29, 2014 at 11:43
  • So if an email address is unassociated, let's say it's flagged on SO's system in some way. When I get the email confirmation from SO at an address I don't use at SO, I click the link. My default browser opens, and as I'm logged in to SO, I'm guessing this happens: SO sees that a valid account has followed a link in an email to an unassociated address, and helpfully adds the previously unassociated address to the account.
    – Maurice Rickard
    Jul 29, 2014 at 11:45
  • 1
    @MauriceRickard: ah, I see where you are going. The first name matches, and as you received the email and clicked the link, the email is now associated with your account.
    – Martijn Pieters
    Jul 29, 2014 at 11:46
  • Yes--exactly. So it's not exactly a breach of my account, but it does point up a potential exploit of SO's system, if the exploiter knows that the intended victim has a valid email address not associated with their SO account.
    – Maurice Rickard
    Jul 29, 2014 at 11:48
  • 1
    @MauriceRickard: I think we cracked this puzzle then; no account hack but an email prank that pulled you in unwittingly by virtue of an email address match.
    – Martijn Pieters
    Jul 29, 2014 at 11:50
  • 2
    Yes, agreed. It would be nice if SO offered a review stage before adding an email address automatically, though. "You're about to associate an email address with this account. Do you want to do this? Y/N" would prevent any malicious use of this.
    – Maurice Rickard
    Jul 29, 2014 at 11:51
  • 1
    @MauriceRickard: Sounds like that would make sense; I'd hate to have accounts associated automatically like this.
    – Martijn Pieters
    Jul 29, 2014 at 11:53
  • @MauriceRickard: The company they applied to has no connections to emergency services, do they?
    – Martijn Pieters
    Jul 29, 2014 at 11:58
  • @MartijnPieters: They look like a creative firm. Here's the posting: careers.stackoverflow.com/jobs/63514/…
    – Maurice Rickard
    Jul 29, 2014 at 12:04
  • @MauriceRickard: right, no obvious clues as to why they were targeted then; they are not listed on the Sydney city page, for example.
    – Martijn Pieters
    Jul 29, 2014 at 12:07
  • 8
    This could be abused. I could take the email address of a person I know and dislike, do fake, bad applications and get that person in trouble.
    – Stijn
    Jul 29, 2014 at 12:13
  • 3
    @Stijn : Exactly, yes. This does indeed seem like a potential attack. While the attacker doesn't gain access to the victim's SO account, they can damage the victim's reputation this way.
    – Maurice Rickard
    Jul 29, 2014 at 12:23
  • Thinking the attack through a little more, let's imagine two co-workers competing for the same position, and both have SO accounts. Let's say that their company has posted a job listing--any job listing will do. Co-worker 1 knows co-worker 2's personal email address, and uses that to send an obscenity-filled letter of resignation as co-worker 2 to their HR department (who would probably be the contact on the job posting). It's not out of the realm of possibility.
    – Maurice Rickard
    Jul 29, 2014 at 13:58
19

My hunch is that the employer themselves was testing out the application process, rather than anybody trying to prank anybody.

When the applicant used one of Maurice's email address, Maurice received the confirmation email:

enter image description here

Maurice clicked the "Register and view your application" link. This "claims" the job application and associates it with Maurice's account.

The email address that was used has not been associated with Maurice's account, just the job application itself.

This is why the application shows up in Maurice's Sent items box on Careers, and why the job listing says Maurice has applied.

This is all intended behaviour for clicking that link.

I guess there are a couple of options for what we could to handle this scenario better:

  • after clicking the link, give you a confirmation message before associating an application with your account
  • in the email, make it clear that if you did not send a job application, you can safely ignore it
Improve this answer
1
  • 3
    Thanks, Alex--that makes sense. I think a confirmation message before the association is complete would be best--maybe with a way of previewing the message as well.
    – Maurice Rickard
    Jul 29, 2014 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .