Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Split Tunnel SMTP Exploit Bypasses Email Security Gateways
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:51:55 PM
Re: Pending Review
"This is akin to saying driving a car is bad because a person doesn't use the seat belts."

I agree, at the end of the day we come back to human being the weakest link.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:49:27 PM
Re: Pending Review
"The fact that someone architects a system and does not send the email through the SEG is simply poor design"

Agreed and good points. Most SMEs would not have that one, they hardly have physical firewall I would say.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:47:25 PM
Re: Why you need multiple layers of security
"having multiple layers of security."

Agree. Layered security most likely detect this types of threats. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:45:44 PM
Re: Thanks for sharing
"What a simple security hole"

Agree. As one could guess, sometimes simple things impact the environment most.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:44:28 PM
TCP dedicated ports
Best approach to avoid TCP dedicated ports it seems to avoid this threat.
TomF593
0%
100%
TomF593,
User Rank: Apprentice
5/27/2017 | 8:18:47 AM
Re: Pending Review
I'm not sure I would classify this as an exploit in the terms you have laid out the scenario. This does show very poor email security architecture design but modern SEG (Secure Email Gateways) contains A/V and Anti-Malware engines to detect the presence of malware in email. The fact that someone architects a system and does not send the email through the SEG is simply poor design.

This is akin to saying driving a car is bad because a person doesn't use the seat belts. Yes it is dangerous, yes it is bad, however you can't blame the car saying it is unsafe. The operator is unsafe, they chose not to put on the seat belts and benefit from the protect afforded.

"In some configurations, the email encryption appliance is deployed in front of the security gateway to decrypt encrypted mail, and to forward it to the security gateway, which then inspects the decrypted email for malware before sending it to the email server.

Even in such situations, an attacker who is able to connect directly to the encryption appliance can inject a rogue message into it. When the security gateway receives the message and inspects it for malware, it will typically do so using the encryption device's IP address and not the original sender's IP address, Singla says. This gives an opening for an attacker to get messages containing malicious payloads and links past the email security gateway." 

Again poor design architecture/implementation a properly configured SEG would look back in headers and discover the true sending MTA IP address not take the encryption device as the source.

"The Split Tunnel SMPT attack does not work if port 25 is closed. "The two attacks we show require port 25 to be open on the target's [Mail Transfer Appliance]," says Singla."

If you can't reach port 25 no mail would flow. This statement is not even needed. Again like saying if I don't answer the phone you can't talk to me.
DougMorganBreakpoint
50%
50%
DougMorganBreakpoint,
User Rank: Apprentice
5/25/2017 | 3:33:22 PM
Why you need multiple layers of security
Creative attack, and a great argument for having multiple layers of security.  Clearly this can bypass email security.  Hopefully the the organization has web filtering or other policies in place to block access to command and control sites to limit the damage if a user does fall for the delivered phiishing email.
realuser
100%
0%
realuser,
User Rank: Apprentice
5/25/2017 | 3:06:16 PM
Thanks for sharing
What a simple security hole... Latest methods to deliver malware became really interesting. Nice work!


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23452
PUBLISHED: 2021-10-20
This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
CVE-2021-25969
PUBLISHED: 2021-10-20
In “Camaleon CMS� application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser w...
CVE-2021-25970
PUBLISHED: 2021-10-20
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
CVE-2021-25971
PUBLISHED: 2021-10-20
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
CVE-2021-25972
PUBLISHED: 2021-10-20
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read ...