Personal Safeguards

DocuSign's first priority is to make your DocuSigning experience safe and secure.

The Internet is a critical component to your business and to conducting business on the DocuSign Global Network. Those committing fraud seek to take advantage of this trusted relationship for illegal purposes. DocuSign continuously monitors for such activity in order to help safeguard our customers' information, documents, and data.

You are the first and best layer of defense in combating online fraud. Learning to properly detect and avoid online and email scams is the ultimate protection against fraud.


Updates And Alerts

Update 11/22/2016 - Malicious Email Campaign

DocuSign is tracking a malicious email campaign where the subject reads: "You have a new Encrypted Document”. The email contains a Word Doc attachment “EncryptedDoc.doc” which is designed to trick the recipient into running what’s known as macro-enabled-malware.  

These emails are not associated with DocuSign. They originate from a malicious third-party using DocuSign branding in the headers and body of the email. The emails are sent from non-DocuSign-related domains including service@docusign-document.com and service@docusign-secure.com. Legitimate DocuSign signing emails come from @docusign.com or @docusign.net email addresses. 

Please remember to be particularly cautious if you receive an invitation to sign or view a Document you are not expecting. If you have received a copy of the above email, DO NOT OPEN ANY ATTACHMENTS. Instead, forward the email to spam@docusign.com and then immediately delete the email from your system.

For further advice on how to recognize malicious emails and how to protect yourself you can visit our Trust Center here.

Update 7/19/16 – DocuSign and OpenSSL Security Advisory status CVE- 2016-2107 & CVE-2016-2108

Recently there were 2 issues identified with OpenSSL. We have identified all impacted servers and have applied the appropriate patches necessary to remediate these issues within our environment. We have also confirmed that our network perimeter infrastructure is not vulnerable to the 2 issues linked below. We will continue to monitor any new information around known issues and exploits that may have an impact to our system.

Here are links with more information around these issues:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2107 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2108 

Update 3/1/2016 - DROWN

On March 1st, a vulnerability in Secure Sockets Layer (SSL) Version 2 was announced under the name DROWN, which stands for Decrypting RSA with Obsolete and Weakened Encryption.  DROWN is a serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet Security.

A server is vulnerable to DROWN if:

  • It allows SSLv2 connections.  No DocuSign production servers allow SSLv2 connections.

OR

  • It's private key is used on any other server that allows SSLv2 connections, even for another protocol.  DocuSign does not reuse the same private keys across services..

Additional information about the DROWN vulnerability can be found at:

https://drownattack.com/#paper

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0800

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3197

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0703

ALERT 12/18/2015 – Juniper Networks releases notice of backdoor software discovery

On 12/18/2015, Juniper Networks released a Security Bulletin (2015-12) outlining two security issues found during an internal code review. 

These issues were reported to be found only in the ScreenOS operating system used on the SSG series of Juniper Firewalls. 

DocuSign does not have any SSG series Juniper Firewalls installed on our network.

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713

DocuSign Single Sign-On Certificate Update

DocuSign’s Single Sign-On certificate used for SAML AuthN requests and WS_Federation encryption in our NA1/NA2/EU1 production environments is about to expire. As a result, the certificate consumed by your Identity Provider (IdP) will be rolled over to a new version on 8/26/2015 at 4:00:00 PM (PDT). Please prepare to update your Identify Provider (IdP) to ensure no disruption in service – otherwise your IdP will continue to use the current certificate resulting in your SSO scenarios not processing starting on 8/26/2015 at 4:00:00 PM (PDT). Please note this action only applies to accounts in DocuSign’s Production environments: NA1 (www.docusign.net), NA2 (na2.docusign.net) and EU1 (eu1.docusign.net).

The new certificate is available for download here.

The SAML metadata containing the new SSO certificate has been posted as follows:

NA1: Link

NA2: Link

EU1: Link

Please be sure to update your IdP to use this new metadata information to ensure your SSO flows continue working seamlessly beyond the transfer date. If your IdPs are able to use two configurations then please update this configuration now. Otherwise please plan to rollover your IdP on 8/26/2015 at 4:00:00 PM (PDT).

For more information and questions, please contact DocuSign Enterprise Support.

ALERT 07/29/2015 -- Critical Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (MS15-078)

On July 20th, an out of band security update was released by Microsoft to address a critical vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts.

DocuSign initiated incident response procedures upon learning of the vulnerability to ensure the security of the company’s servers, core systems and online properties. We have applied the appropriate patch to all systems in accordance with ourIncident Response and Vulnerability Management procedures. At this time, no further action is required.

Below is the link from Microsoft with additional details about this vulnerability: 
https://technet.microsoft.com/library/security/ms15-078

Update 7/27/15 – DocuSign and Adobe Flash status

Recently there have been a number of 0-day vulnerabilities relating to Adobe Flash. We at DocuSign do not utilize Adobe Flash within our production environment and therefore are not susceptible to the critical vulnerabilities listed below. We will continue to monitor any new information around known issues and exploits that may have an impact to our DTM platform. 

Here are links to the recent Adobe 0-day vulnerabilities:
https://helpx.adobe.com/security/products/flash-player/apsb15-14.html
https://helpx.adobe.com/security/products/flash-player/apsa15-03.html

 

Update 07/6/2015 - Customer Notification: Additional IP Addresses for DocuSign Service

Customer Notification: Additional IP Addresses for DocuSign Service

It’s DocuSign’s intention to provide the most robust and reliable service possible to enable your business transactions. We also want to proactively share information which may be of interest to our customers regarding the evolution of our service. A few of our customers have elected to explicitly allow internet addresses advertised by our service. It is important for those customers to keep up-to-date with our current IP address ranges. The following IP address ranges will be used by our service effective immediately and until further notification


Current and Continuing for North America based and demo accounts: 
209.67.98.1 through 209.67.98.63 
206.25.247.129 through 206.25.247.159 
209.46.117.161 through 209.46.117.191 
162.248.184.1 through 162.248.187.255 
54.149.21.90 

New additions for North America based and demo accounts: 
54.69.114.54 
52.25.122.31 
52.25.145.215 
52.26.192.160 
52.24.91.157 
52.27.126.9 
52.11.152.229 

Current and Continuing for European Union based accounts: 
185.81.100.1 through 185.81.103.254 

New additions for European Union based accounts: 
52.28.168.105

Should you have any questions, please don’t hesitate to contact us.

Update 7/2/2015 - DocuSign SSL/TLS Certificate Renewal

DocuSign’s SSL/TLS certificate used for NA1/NA2/EU1 production environments is set to expire. As a result, the certificate will be rolled over to a new one on 9/9/2015 at 4:00:00 PM (PDT).The new certificate will be a SHA2 (SHA256) certificate.  
 

Please note that the SSL/TLS certificate used in our Demo environment was updated to a SHA2 (SHA256) certificate on 3/26/2015. This Demo environment is available for your testing and can be used to ensure a seamless update of the production certificate scheduled for 9/9/2015. Please test your API and Connect integrations against Demo to be assured there will be no impact when the production change occurs. If you have issues with your tests in Demo please reach out.

 
The new certificate is available for download here.  
Link to Symantec’s stance on SHA2 technology: Link.  
For more information and questions, please reach out to Customer Support or your Account Manager
 

May 15th, 2015 – QEMU “VENOM” Vulnerability

The Venom vulnerability impacted the Xen platform and DocuSign has no dependencies on the Xen platform. This covers our Production and Corporate environments as well as our subsidiaries and service providers.
 
VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host’s local network and adjacent systems. 
 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456
http://venom.crowdstrike.com/
 

Critical Vulnerability in the Microsoft Windows HTTP Protocol Stack (MS15-034)
 
 
On April 14, a security patch was released by Microsoft to address a critical vulnerability in the Windows HTTP protocol stack (“HTTP.sys”) that was disclosed the same day. The vulnerability is rated Critical since it may allow remote code execution by an attacker or lead to a Denial of Service. The issue impacts all Windows HTTP services, including Internet Information Services (IIS).
 
DocuSign initiated incident response procedures upon learning of the vulnerability to ensure the security of the company’s servers, core systems and online properties. Since some of our technology stack includes Windows web servers, we reviewed all of our sites and supporting infrastructure to ensure all Windows based HTTP services were accounted for.
 
DocuSign has applied the appropriate patch to all systems in accordance with our Incident Response and Vulnerability Management procedures. At this time, no further action is required. DocuSign will continue to monitor the status of the situation and provide updates as needed.
 
Here are some additional resources and information about the vulnerability:
 
https://technet.microsoft.com/en-us/library/security/ms15-034.aspx
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1635
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1635
 

Update 04/15/2015

Customer Notification: Additional IP Addresses for DocuSign Service

It’s DocuSign’s intention to provide the most robust and reliable service possible to enable your business transactions. We also want to proactively share information which may be of interest to our customers regarding the evolution of our service.   A few of our customers have elected to explicitly allow internet addresses advertised by our service.  It is important for those customers to keep up-to-date with our current IP address ranges.   The following IP address ranges will be used by our service effective April 13, 2015 and until further notification:

 
Current and Continuing for North America based and demo accounts
209.67.98.1 through 209.67.98.63
206.25.247.129 through 206.25.247.159
209.46.117.161 through 209.46.117.191
162.248.184.1 through 162.248.187.255

New addition for North America based and demo accounts

54.149.21.90

These IP address ranges apply to all of our North American environments: www, NA2, and demo.

These IP address ranges will also apply to our EU1 environment until May 15th 2015

 

New and Incremental for European Union based accounts
185.81.100.1 through 185.81.103.254
This IP address range applies to our EU environment immediately, and our EU1 endpoint after May 15th 2015.

Should you have any questions, please don’t hesitate to contact us.

Update 03/18/2015 - FREAK

On March 3rd, a vulnerability in some Secure Sockets Layer (SSL) and Transport Layer Security (TLS) servers and clients was announced under the name FREAK, which stands for Factoring RSA Export Keys.  Exploitation of the vulnerability requires a man-in-the-middle (MiTM) attack with a vulnerable client or web browser and a target server that still supports the deliberately weakened EXPORT ciphers.

DocuSign does not support EXPORT ciphers on our TLS servers and our systems were not impacted by the vulnerability.

As with all man-in-the-middle vulnerabilities, DocuSign recommends that users always use caution when accessing secure sites over public networks, heed browser security and certificate warnings, and keep their browser up to date with the most secure configuration and software patches.

Here are some additional resources and information about the vulnerability.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0204

https://www.us-cert.gov/ncas/current-activity/2015/03/06/FREAK-SSLTLS-Vulnerability

http://www.kb.cert.org/vuls/id/243585

https://www.smacktls.com/#freak

http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html

Update 02/23/2015

Customer Notification: Additional IP Addresses for DocuSign Service

It’s DocuSign’s intention to provide the most robust and reliable service possible to enable your business transactions. We also want to proactively share information which may be of interest to our customers regarding the evolution of our service.   A few of our customers have elected to explicitly allow internet addresses advertised by our service.  It is important for those customers to keep up-to-date with our current IP address ranges.   The following IP address ranges will be used by our service effective March 10, 2015 and until further notification:

 
Current and Continuing for North America based and demo accounts
209.67.98.1 through 209.67.98.63
206.25.247.129 through 206.25.247.159
209.46.117.161 through 209.46.117.191
162.248.184.1 through 162.248.187.255
These IP address ranges apply to all of our North American environments: www, NA2, and demo.
These IP address ranges will also apply to our EU1 environment until May 15th 2015

 

New and Incremental for European Union based accounts
185.81.100.1 through 185.81.103.254
This IP address range applies to our EU environment immediately, and our EU1 endpoint after May 15th 2015.

Should you have any questions, please don’t hesitate to contact us.

Update 2/13/2015 - Poodle

On October 14th, a vulnerability in Secure Sockets Layer (SSL) Version 3 was announced under the name Poodle, which stands for Padding Oracle on Downgraded Legacy Encryption.  In December, another version of the Poodle bug was also announced that affected certain versions of Transport Layer Security (TLS).  These vulnerabilities impact the way clients and servers secure their communications over a network and can expose information that was previously protected.  These vulnerabilities, CVE-2014-3566 and CVE-2014-8730, have been rated as medium by the National Vulnerability Database.

At the time of the original vulnerability announcement, DocuSign's servers were already configured to prefer versions of TLS and to accept SSLv3 as a last resort. Upon learning of the issue, we performed a traffic study to understand the impacts of disabling SSLv3 support altogether and to ensure the continued availability of our service for all customers.  We worked closely with our vendors to test and deploy patches as they were released.  We also implemented new configuration options in partnership with our customers to secure the services that connect to their systems.  

As of today, DocuSign is happy to report that our TLS services are not vulnerable to CVE-2014-8730.  DocuSign is also in the process of a phased disabling of SSLv3 to further prevent Poodle. We began our transition off of the protocol starting with our outbound services in January.  We plan to continue the disabling of SSLv3 starting with our DocuSign Demo site on February 23rd, and conclude with our Production site on March 23rd.  Once the disabling of SSLv3 is completed on our core platform, customers using legacy browsers or unique configurations may not be able to connect to our web servers.  Please be aware of these important dates and ensure that all browsers and clients have been updated to recent versions in order to support the change. 

Here are some additional resources and information about these vulnerabilities.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8730

https://www.us-cert.gov/ncas/alerts/TA14-290A

https://www.us-cert.gov/ncas/current-activity/2014/12/09/Certain-TLS-Implementations-Vulnerable-POODLE-Attacks

https://www.openssl.org/~bodo/ssl-poodle.pdf