Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Split Tunnel SMTP Exploit Bypasses Email Security Gateways
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:51:55 PM
Re: Pending Review
"This is akin to saying driving a car is bad because a person doesn't use the seat belts."

I agree, at the end of the day we come back to human being the weakest link.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:49:27 PM
Re: Pending Review
"The fact that someone architects a system and does not send the email through the SEG is simply poor design"

Agreed and good points. Most SMEs would not have that one, they hardly have physical firewall I would say.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:47:25 PM
Re: Why you need multiple layers of security
"having multiple layers of security."

Agree. Layered security most likely detect this types of threats. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:45:44 PM
Re: Thanks for sharing
"What a simple security hole"

Agree. As one could guess, sometimes simple things impact the environment most.

 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/30/2017 | 12:44:28 PM
TCP dedicated ports
Best approach to avoid TCP dedicated ports it seems to avoid this threat.
TomF593
0%
100%
TomF593,
User Rank: Apprentice
5/27/2017 | 8:18:47 AM
Re: Pending Review
I'm not sure I would classify this as an exploit in the terms you have laid out the scenario. This does show very poor email security architecture design but modern SEG (Secure Email Gateways) contains A/V and Anti-Malware engines to detect the presence of malware in email. The fact that someone architects a system and does not send the email through the SEG is simply poor design.

This is akin to saying driving a car is bad because a person doesn't use the seat belts. Yes it is dangerous, yes it is bad, however you can't blame the car saying it is unsafe. The operator is unsafe, they chose not to put on the seat belts and benefit from the protect afforded.

"In some configurations, the email encryption appliance is deployed in front of the security gateway to decrypt encrypted mail, and to forward it to the security gateway, which then inspects the decrypted email for malware before sending it to the email server.

Even in such situations, an attacker who is able to connect directly to the encryption appliance can inject a rogue message into it. When the security gateway receives the message and inspects it for malware, it will typically do so using the encryption device's IP address and not the original sender's IP address, Singla says. This gives an opening for an attacker to get messages containing malicious payloads and links past the email security gateway." 

Again poor design architecture/implementation a properly configured SEG would look back in headers and discover the true sending MTA IP address not take the encryption device as the source.

"The Split Tunnel SMPT attack does not work if port 25 is closed. "The two attacks we show require port 25 to be open on the target's [Mail Transfer Appliance]," says Singla."

If you can't reach port 25 no mail would flow. This statement is not even needed. Again like saying if I don't answer the phone you can't talk to me.
DougMorganBreakpoint
50%
50%
DougMorganBreakpoint,
User Rank: Apprentice
5/25/2017 | 3:33:22 PM
Why you need multiple layers of security
Creative attack, and a great argument for having multiple layers of security.  Clearly this can bypass email security.  Hopefully the the organization has web filtering or other policies in place to block access to command and control sites to limit the damage if a user does fall for the delivered phiishing email.
realuser
100%
0%
realuser,
User Rank: Apprentice
5/25/2017 | 3:06:16 PM
Thanks for sharing
What a simple security hole... Latest methods to deliver malware became really interesting. Nice work!


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21866
PUBLISHED: 2021-08-02
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger t...
CVE-2021-27499
PUBLISHED: 2021-08-02
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-...
CVE-2021-27503
PUBLISHED: 2021-08-02
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application encrypts on the application layer of the communication protocol between the Ypsomed mylife App and mylife Cloud credentials based on har...
CVE-2021-27943
PUBLISHED: 2021-08-02
The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (against only 10000 possibilities), allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and configu...
CVE-2021-29979
PUBLISHED: 2021-08-02
Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.*. This vulnerability affects Hubs Cloud < mozillareality/reticulum/1.0.1/20210618012634.