#smtpsmuggling — Public Fediverse posts

Timo Longin @login introduces SMTP smuggling, a novel technique to spoof fully SPF-validated emails from various popular domains including @microsoft.com.

Wow. It's incredible nobody found this before. It's the first of its kind. Probably not the last...!

https://youtu.be/V8KPV96g1To

Related:
https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide
https://www.postfix.org/smtp-smuggling.html
https://www.malwarebytes.com/blog/news/2024/01/explained-smtp-smuggling

#SmtpSmuggling #37C3 #SMTP #vulnerability #infosec #TimoLongin #security

It's a wrap! 🌯 Our technical guideline "BSI TR-03108 (Secure Email Transport)" is now accompanied by "BSI TR-03182 (Email Authentication)" providing guidance for email services to protect their users against impersonation attacks like Spoofing and Phishing :flan_mask:​

https://bsi.bund.de/dok/tr-03182-en

#TeamBSI #EmailAuthentication #DNSSEC #DMARC #DKIM #SPF #SMTP #SMTPSmuggling

Finally the two missing options against #smtpsmuggling arrived in #debian buster this morning.

https://security-tracker.debian.org/tracker/CVE-2023-51764

smtpd_forbid_bare_newline = normalize

and if needed:

smtpd_forbid_bare_newline_exclusions = $mynetworks

see

https://www.postfix.org/smtp-smuggling.html

SPF-valid spoofed mail from [email protected] 😈 ?

Timo Longin @login stumbled upon SMTP Smuggling while looking for vulnerabilities in the Simple Mail Transfer Protocol.

Great work and great talk!

#Smtp #SmtpSmuggling #TimoLongin #37c3

https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide

Ich: »Ich habe gerade mal getestet, ob Ihr für #SmtpSmuggling anfällig seid, aber anscheinend kann ich auch einfach so Mails als jeder beliebige Absender über Eure Server verschicken.«

Mail-Provider: »Ja, das ist ganz normales Phishing, aber das ist so gewollt, damit man mit mehreren Absendern dasselbe Sammelpostfach bedienen kann.«

Ich: »Es ist gewollt, dass ich mich als Ihr oder jeder Eurer anderen Kunden ausgeben kann? Inklusive gültiger DKIM-Signatur?«

Mail-Provider: 🤷‍♂️

Es gibt so Tage...

@ParadeGrotesque
The patch for CVE-2023-51766, #SMTPSmuggling in Exim4, just landed in Debian.
https://security-tracker.debian.org/tracker/source-package/exim4

Long planned, but now with enhanced motivation due to #SMTPSmuggling attack I finally replaced my old #EMailServer based on #Postfix and applied the workarounds.

Beside that I completely replaced the server hardware and all the VMs for Calendar, Files and Web (last one still WIP).

🔗 https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

🔗 https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide

🔗 https://www.postfix.org/smtp-smuggling.html

Neue Lücke in altem E-Mail-Protokoll: #SMTP smuggling | Security https://www.heise.de/news/Neue-Luecke-in-altem-E-Mail-Protokoll-SMTP-smuggling-9584467.html #SMTPsmuggling

@ParadeGrotesque
The patch for #SMTPSmuggling just landed in Debian Bullseye:
* 3.5.23 (Closes: #1059230)
- Addresses CVE-2023-51764, requires configuration change
- Security: with "smtpd_forbid_bare_newline = yes" (default "no" for Postfix < 3.9), reply with "Error: bare <LF> received" and disconnect when an SMTP client sends a line ending in <LF>, violating the RFC 5321 requirement that lines must end in <CR><LF>. This prevents SMTP smuggling attacks that target ...
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059230

#SMTPSmuggling – Spoofing E-Mails Worldwide https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide

Prescient words from RFC 2821, "Simple Mail Transfer Protocol". #smtpsmuggling https://www.ietf.org/rfc/rfc2821.txt

Wait? SEC Consult told closed-source providers like Microsoft months before about #SMTPSmuggling, but not #Postfix?

Capitalist bootlickers! Completely unacceptable!

I... personally think #SMTPSmuggling is one of trickiest vulnerability to handle...

At #37C3, speakers said not following SMTP RFC caused that problem. But the problem is, (as you can see in Postfix & Axum's federation test datas) if you follow the RFC strictly, you will face legion of angry customers who complaining they missed some (important) mail from crappy shopping mall which uses php mail() to send horribly broken email directly to TCP 25.

I understand SEC's perspective. "We've told that central global organization that is super experienced in managing large scale security issues, they've told the vendors, but apparently nobody thinks this is a big deal, so yeah, let's publish the blog post then."

So, if what SEC says is true, then CERT/CC has fucked up. But of course SEC could've also talked to Postfix on their own. But why would they, CERT/CC already did.

This was all a big dumb game of telephone, it seems.

#SMTPSmuggling

I have watched the #37c3 #SMTPsmuggling talk stream, and congrats to @login for profusely apologizing publicly on the disclosure timeline, that's not easy to do. The research is great, let's hope everything gets fixed soon.

"Here's the problem."
"Here's why it's a problem."
"Here's how we inadvertently exacerbated one part of the problem."
"That bit admittedly sucked, and we're sorry for the trouble we caused."

That's good. That's how you do it.

#37c3 #smtpsmuggling

"Sorry for ruining your Christmas, Wietse" (from Postfix) and something with penetration of the human body with dildos. The first 5 minutes of the #SMTPSmuggling talk at #37C3 does not disappoint. #sarcasm https://streaming.media.ccc.de/37c3/zuse

Im Juni wird eine Sicherheitslücke entdeckt: Die zur Mailauslieferung notwendige "Zusammenarbeit" zwischen Mailservern lässt sich austricksen, um falsche Absender unterzujubeln. So wird #Spam und #Phishing Tür und Tor geöffnet.

Die Entdecker wissen von 11 Systemen (Mailprovider, Softwarehersteller), die betroffen sind. Informieren aber nur 3 davon. Ein Versuch der Klärung der Hintergründe vor dem #37C3-Vortrag heute.
#SMTPSmuggling
📰 https://dnip.ch/2023/12/22/nicht-wirklich-responsible-disclosure-die-extraportion-spam-ueber-die-festtage/
🧵 https://waldvogel.family/@marcel/111622567290149119

In 24h + 40 minutes, the #SMTPSmuggling presentation by Timo Longin from SEC consult will start at #37C3. Maybe someone in the audience can ask about the weird shenanigans of not informing open source projects like postfix, exim, sendmail directly back in June and instead causing frantic hard work for them during Christmas. https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html

After having been informed by @mathieui that #Exim is also affected, I compiled a list of what #SECConsult documented and what has been found out in the meantime. SEC Consult documented 11 mail systems (software and/or providers; many with millions of accounts) vulnerable to some form of #SMTPSmuggling. But they only informed 3. With #Exim also vulnerable (apparently presumed "clean" by SEC Consult), the list is now 12.
https://netfuture.ch/2023/12/smtp-smuggling-status/

Regarding #SMTPSmuggling, anyone knows if #Postfix 2.10 is affected? According to #RedHat versions 8 and 9 may be but they're still in investigation and they naturally focus on the more recent versions first. However... #RHEL 7 includes 2.10 and at least smtpd_data_restrictions is a configuration option that is not present... https://access.redhat.com/security/cve/cve-2023-51764

Everyone attending #SECConsult #TimoLongin's #37c3 #SMTPSmuggling talk
https://events.ccc.de/congress/2023/hub/en/event/smtp_smuggling_spoofing_e-mails_worldwide/
at least boo them for shitting the devs in the face right before holidays.

It’s always #DNS. Unless it is DOS v UNIX linefeeds ;) #SMTPSmuggling

The #SMTPSmuggling attack is being mitigated and tracked in the following CVEs:

- CVE-2023-51764 postfix
- CVE-2023-51765 sendmail
- CVE-2023-51766 exim

All three CVEs have been filed *today* by the community and NOT by SEC consult who discovered the flaw in June 2023 but decided to not share their findings with postfix, sendmail or exim. Only after they published their post on 2023-12-18, the communities have become aware and are now working hard to fix what is now more a 0day :(

Reading about the recent SMTP and SSH vulnerabilities, I get the impression that open source projects, proprietary vendors and government agencies such as @certbund don't know how to talk to each other. They should at least have something like a red phone.

Please comment here if you have a constructive idea on how to improve the situation! #SECconsulting seems to assume that everyone uses #VINCE, a CMU service I had never heard of.

#SMTP:
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
https://www.postfix.org/smtp-smuggling.html

#SSH:
https://terrapin-attack.com/patches.html

#SMTPsmuggling #Terrapin #ITsec #37c3