Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Split Tunnel SMTP Exploit Bypasses Email Security Gateways
Threaded  |  Newest First  |  Oldest First
realuser
realuser,
User Rank: Apprentice
5/25/2017 | 3:06:16 PM
Thanks for sharing
What a simple security hole... Latest methods to deliver malware became really interesting. Nice work!
TomF593
TomF593,
User Rank: Apprentice
5/27/2017 | 8:18:47 AM
Re: Pending Review
I'm not sure I would classify this as an exploit in the terms you have laid out the scenario. This does show very poor email security architecture design but modern SEG (Secure Email Gateways) contains A/V and Anti-Malware engines to detect the presence of malware in email. The fact that someone architects a system and does not send the email through the SEG is simply poor design.

This is akin to saying driving a car is bad because a person doesn't use the seat belts. Yes it is dangerous, yes it is bad, however you can't blame the car saying it is unsafe. The operator is unsafe, they chose not to put on the seat belts and benefit from the protect afforded.

"In some configurations, the email encryption appliance is deployed in front of the security gateway to decrypt encrypted mail, and to forward it to the security gateway, which then inspects the decrypted email for malware before sending it to the email server.

Even in such situations, an attacker who is able to connect directly to the encryption appliance can inject a rogue message into it. When the security gateway receives the message and inspects it for malware, it will typically do so using the encryption device's IP address and not the original sender's IP address, Singla says. This gives an opening for an attacker to get messages containing malicious payloads and links past the email security gateway." 

Again poor design architecture/implementation a properly configured SEG would look back in headers and discover the true sending MTA IP address not take the encryption device as the source.

"The Split Tunnel SMPT attack does not work if port 25 is closed. "The two attacks we show require port 25 to be open on the target's [Mail Transfer Appliance]," says Singla."

If you can't reach port 25 no mail would flow. This statement is not even needed. Again like saying if I don't answer the phone you can't talk to me.
Dr.T
Dr.T,
User Rank: Ninja
5/30/2017 | 12:49:27 PM
Re: Pending Review
"The fact that someone architects a system and does not send the email through the SEG is simply poor design"

Agreed and good points. Most SMEs would not have that one, they hardly have physical firewall I would say.
Dr.T
Dr.T,
User Rank: Ninja
5/30/2017 | 12:51:55 PM
Re: Pending Review
"This is akin to saying driving a car is bad because a person doesn't use the seat belts."

I agree, at the end of the day we come back to human being the weakest link.
Dr.T
Dr.T,
User Rank: Ninja
5/30/2017 | 12:45:44 PM
Re: Thanks for sharing
"What a simple security hole"

Agree. As one could guess, sometimes simple things impact the environment most.

 
DougMorganBreakpoint
DougMorganBreakpoint,
User Rank: Apprentice
5/25/2017 | 3:33:22 PM
Why you need multiple layers of security
Creative attack, and a great argument for having multiple layers of security.  Clearly this can bypass email security.  Hopefully the the organization has web filtering or other policies in place to block access to command and control sites to limit the damage if a user does fall for the delivered phiishing email.
Dr.T
Dr.T,
User Rank: Ninja
5/30/2017 | 12:47:25 PM
Re: Why you need multiple layers of security
"having multiple layers of security."

Agree. Layered security most likely detect this types of threats. 
Dr.T
Dr.T,
User Rank: Ninja
5/30/2017 | 12:44:28 PM
TCP dedicated ports
Best approach to avoid TCP dedicated ports it seems to avoid this threat.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-41604
PUBLISHED: 2022-09-27
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This ca...
CVE-2022-40199
PUBLISHED: 2022-09-27
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
CVE-2022-40352
PUBLISHED: 2022-09-27
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
CVE-2022-40353
PUBLISHED: 2022-09-27
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.
CVE-2022-40354
PUBLISHED: 2022-09-27
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.