DEF CON 31 - SpamChannel - Spoofing Emails From 2M+ Domains & Virtually Becoming Satan - byt3bl33d3r

[@lrhache]

You should have wrote to the ceo from their own domain

[@easternplatypus]

that would've been funny but probably not worth risking criminal charges 😭

[@LinkageAX]

Is it really criminal if the CEO says it's a feature of the product? It's being used as intended at that point imo

[@alexc7095]

lol... just lol waw..... I can see it now scam as a service on darkweb 😂😂😂😂😂

[@MasterThief117]

​@@easternplatypus The CEO themselves said it was a feature of the service and if domains didn't like it, they could secure themselves via DMARC/DKIM. The CEO essentially gave free reign to spoof their own domain using the service.

[@MrTweetyhack]

@@easternplatypus only if they catch you

[@claudiusraphael9423]

Endless stream of Bruh-moments from minute 9 on .. Nicely done!

[@eyezikandexploits]

Sending himself a email from blackhat is top notch irony

[@eternalillusion]

Love this mofo. Splendid and efficient, zero-hopium talk. 10/10.

[@devonrogers1299]

Bro😢

[@criticaloptimist]

I’m both shocked this vulnerability is a thing but also not surprised so many companies don’t have SPF/DKIM set up. Email is a mess to secure, super complicated, and I don’t think most companies really have an expert managing their domains. But I do know that any company that would find out about this vulnerability would never be ok with this.

[@YuanLiuTheDoc]

I can believe that your E-mail to the CEO went to spam folder - because he marked you as nuisance after your second "offense". But I cannot believe that a CEO who was perhaps not very tech savvy didn't pass your concern about the Cloudflare API might change the calculus to CTO.

[@Shpongle64]

Well now the world knows about cloud flare

[@thefloorhasgone]

Great talk. I found his manner of speaking quite relaxing to listen to 😊

[@juliacaesar8462]

This guy is a great speaker. So comfortable and fun to listen to. Very informative and I enjoyed the humor. Well done!!

[@TheCocoaDaddy]

Awesome video. I have experience with SPF, DKIM and DMARC but have never looked into the ARC headers. Thanks for the thorough explanation!

[@Leetfin]

Patched after this talk lol

[@fiendlybrds]

Nice I am loving this defcon dump!

[@theycallme_nightmaster]

35:36 I can tell you that this is indeed possible using certain security gateways.

[@rhysperry111]

Still can't believe DKIM isn't widely setup and that most mail providers ignore it if SPF passes

[@geroffmilan3328]

This

[@Tetsuo6995]

What I truly don't understand is why DMARC passes if SPF "OR" DKIM is passed. So with an AND you would verify that : 1. The correct IP sent you the email (SPF) 2. The correct server signed the mail and that its headers are not tampered with DKIM But no, you can just set it to an OR. But on the other hand, some providers trust ARC as some kind of guarantee that an email is what it pretends to be. Email security is shite. I kind of hope we will one day drop SMTP alltogether and move on to completely different tech.

[@geroffmilan3328]

@@Tetsuo6995 it's fkn dumb💯 I need to re-check what the RFCs say here, but agree 100% about email security. This is what we get when we continue bolting shit onto a protocol from the 1970s whilst shackling ourselves to backwards compatibility. On the other hand, as a pen tester "by design" flaws are the gift that keeps on giving. The only thing which will move the needle on this, sadly, will be an attack which is a) trivial to implement and b) has staggering adverse *financial* impact. Add this to the already-huge pile of "why market forces don't solve everything".

[@thewhitefalcon8539]

DKIM is hard to get right. SPF is easy.

[@geroffmilan3328]

@@thewhitefalcon8539 I find it's the reverse, but it does vary by mail service/platform. With DKIM you're just creating a keypair, ensuring the mail service uses it when sending, and publishing the DNS record for it. With SPF, you have to ensure there are no more than 10 entries or it becomes useless - so it's a good to a) never use a mail service that can't handle DKIM and b) always use DKIM rather than SPF to authorise third-party mail services to use the domain

[@RandornCanis]

You can sometimes enforce DKIM alignment inside DMARC by setting your SPF record to -all. This isn't so uncommon because forwards and mailing lists break SPF anyways. You'll just need another SPF domain for the envelope from header, but this intentionally leaves only DKIM for domain alignment.

[@drstefankrank]

The only problem is receivers who don't support DKIM an solely rely on SPF, but I consider this their problem.

[@YuanLiuTheDoc]

(Mail) security is everybody's problem. Breach of a recipient can negatively impact the sender, not to say a million other entities that the breached party has connections with.

[@idiotwidowmaker8932]

Soooo it would be hypothetically very interesting if some people delivered to the CEOs mailbox AI generated invoices, “escalations” , etc just things that cant be ignored and see how fast it gets fixed

[@erbterb]

What if it is feature and not a bug? Spam some command and control malware, get click on link, get control of target phone, download "ai" software, harvest all the data. Bring out gallons of hand lotion amd let er rip.

[@rpm10k.]

This is hilarious and fantastic. Great speaker.

[@adrianantoci1187]

That is just incredible. Amazing talk.

[@magnusthorne]

Wow. What a great talk. Great job.

[@drstefankrank]

It would have been so easy, even with their relay in SPF. Do the same like Microsoft or Google does. Do API authentication and tie this authentication to a verified list of domain you own. They all need you to authenticate your domain at initial setup with a unique txt record in dns for example.

[@louis-lau]

They really should have done that, but I can also understand the perspective. Since their target market is hosts that don't control the domains and probably use standard control panels like cpanel or directadmin, there's no way to verify the domains with mailchannels out of the box in those panels. Now their customers need to do some kind of custom integration instead of just using them as an SMTP relay with any off the shelf setup they want. Before these authentication protocols email had been spoofable for decades, and for many organizations today it still is. For them, it's simply a tradeoff between ease of customer acquisition, and protection against spoofing between customers. So while I agree with you, I can understand why this wasn't done. Email is insecure in a variety of ways. Hopefully one day we'll get to the point that it's not.

[@hangingwithvoid360]

His demo vid didn't play because its synced to online only XD its not stored on his PC. lmaooo The cloud strikes again.

[@Its-Just-Zip]

If I remember correctly, there was a talk recently about fixing Dmarc to where dmarc would fail if either dkim or SPF failed. What's going on with that stuff? I believe some email providers will throw an error if either DKIM or SPF fail but that really needs to become like a standard and they need to start throwing that error if DKIM is not set up because there is really no reason not to be running all of the above.

[@jfbeam]

MC's CEO is technically correct... SPF assumes one domain = one IP = one domain. That's not necessarily true. And it's never true on any email aggregation site like MC. Their API needs to authenticate who is attempting to send the message, then they can police what domains are used. The way they've integrated with CF eliminates all that - they just look for it to come from any CF IP, without CF disclosing anything about the CF user / account. (this would be rather simple for both of them to fix.)

[@randomblogger2835]

At SMTP2GO we had a simmilar issue authenticating email sourced from Salesforce, but fortunately they exposed their customer id in an email header so we used that in combination the the source IP address, Salesforce now support full SASL SMTP authentication.

[@MrTweetyhack]

your emails were allegedly going to spam yet somehow he was responded to you earlier emails. I bet this company is just some old guy in his basement.

[@MrMilarepa108]

Can't follow but he's got it, I'd trust him with my email server 10 days out of 10.

[@MrMilarepa108]

Additional note: I do not have an email server. But if I had, I know who I wanted to be in charge of it.😊

[@louis-lau]

​@@MrMilarepa108 To be completely fair, if whoever is hosting your email isn't aware of this issue, they're not that competent or specialized. I found myself nodding along with almost the whole talk, none of it was really news to me. Email is layers upon layers of stuff, all meant to be backwards compatible. Mailchannels should just really have their customers upload a list of domains they intend to send from, but they're far from the only one that this issue applies to. Email just isn't great for secure messaging in many ways, maybe we'll get there one day :)

[@Spooky_OG]

Thanks for the knowledge. Very cool.

[@Pervy]

Hey it's byt3bl33d3r. I've been checking out this blog posts for years lol.

[@stonelox]

They must be in on the email spam profit scheme

[@robmorgan1214]

Welp... time to block all cloudflare addresses.

[@CreedFlint]

23:22 , talking about unable to use DKIM when ARC goes through other marketing servers for 'sginatures' of email. Does that then mean the only line of defense is SPF, considering spf OR dkim only need to be authenticated for an email to pass through to an inbox?

[@qmurec]

awesome talk!

[@NeverGiveUpYo]

Epic talk

[@n.lightnin8298]

“A heroin convention” 🤔 😂

[@realdavidpain]

There probably even is a target audience for heroin and security related talks 🧐

[@comosaycomosah]

Lmao thats awesome spoofed his entry

[@comediavietii1245]

this is dangerous

[@aciid_0]

how tf did blackhat not even use SPF/DKIM until 2023? am I missing something? that shit is the first thing I set up on any new email server

[@carlmelgaard5423]

Awesome stuff!

[@SadeN_0]

Just... wow.

[@qu3nt]

oh look it’s 1996 again

[@Stoney_Eagle]

I guess this is why I can no longer escape the spam 😑

[@frango_e_salada]

PARABÉNS POR CALAR A BOCA DAQUELE VELHO FACISTA!!!

[@MatthiewMarks]

31:46 This is why I hate using cloud storage

[@skyracer-mk8hg]

Didnt they add domain lockdown or whatever it is called for fix that? EDIT: Just got to 34:00 and well yea..

[@byt3bl33d3r]

You can still just sign up via their website and spoof all domains via their normal SMTP relay. The domain lockdown record addressed a symptom not the root cause (lack of sender identity verification)

[@Tahsn31]

I am the first person who is watching this. Feel like special hahaha

[@claudiusraphael9423]

You are the One.

[@feuerherz007]

the chosen one 😢

[@SnapWireOnlyOne]

LMAO i was doing this before 2012 i was just bombing company's email accounts for a laugh

[@Adamizion]

Does it work anymore?

[@realdavidpain]

Just hop on the Cloudflare train 😏

[@fun-uj6be]

If it's not a spam it's a ham.

[@alexasouza4152]

Spoofing blackhat in a defcon talk, awesome! LMAO HAHA

[@tripletsborn]

Impersonating brainpop lol

[@gautamkrishnar]

Bruh!

[@ettyxcbyrcburcbtxcfhcdtyurt]

HAHAHAHAHAHAHAHAHAHHAHAHAHAHHAHAHAHAHAHHAHAHAHAHAHAH yeah so im moving countries. this has been happening to me for 3 years, and my chest cannot stomach anyone from my past life confronting me about receiving mail from me. i know some doctors that broke even in their 40s and ended their 50s by retiring comfy. im done with machines.

[@Michael_Jackson187]

You get domain lockdown when you try this, has anyone done this or is everyone just watching lol

[@dussedagod]

domain lockdown?

[@Michael_Jackson187]

@@dussedagod yea i spent like 30min to an hour setting everything up, went to use some of the domains provided in that list and they are all locked down lol.

[@quadrupledamage]

@@dussedagod He talked about it at the end, Cloudflare added Domain Lockdown to make sure other Cloudflare Worker users can't send emails from your domain. From what I understand, this issue still affects MailChannel, and with $80 you can spoof every single MC user.

[@deancrypto5939]

patched ??

[@thegu5]

yupp

[@deancrypto5939]

actually NO@@thegu5 just deploy your own worker and use a different domain ill drop some updated code later to make it 10 times easier

[@muhammadgoran4898]

i think they patched it cuz i tried my domain which hasnt any email record and it didnt work@@deancrypto5939

[@rpm10k.]

He won't

[@KingKongBlanue]

@@deancrypto5939Where’s the updated code sir ?

[@connoradair]

Straight jokes

[@Crypto_Chief]

😂😂😂. This hilarious

[@-Ncrypt]

Bet you he’s got a job by now 😂

[@ChairmanHehe]

cloudflare so fuckin sussy

[@svettnabb]

Arc=pass working must be because of lazy and greedy regex.

[@erbterb]

Look it is the Crowdmail guy. All lazy programmers using the same code with a centralised service structure. No vulns here.

[@Michael_Jackson187]

You need an api key

[@stubstunner]

What if you host your own MX record for a non-existent domain? I bet it works.

[@mini_bomba]

you can't put a DNS record on a DNS domain that doesn't exist...

[@geroffmilan3328]

​@@mini_bomba 💯 - or one you don't own/have zone file access

[@Tetsuo6995]

@@mini_bomba Nothing prevents you from putting anything in your public DNS server. It's simply that nobody will contact your server for these records since the associated domain is not registered anywhere. At least that's my understanding. I say that because I think you can prepare in advance some records for a domain you are about to obtain. And when you become the Authority for this domain, your MX, SPF records will start to get hits.

[@gamer-gw9iy]

7:37

[@superhanspaul]

"null" is german and means "zero" "0"

[@realdavidpain]

🤨

[@jbs.]

Closed when I heard 'allowlist'

[@skyemegakitty]

you won't be missed o/ bye

[@Michael_Jackson187]

Where can you point me? I tried this and you get domain lockdown if you try to use any of these domains

[@jackda2168]

@@Michael_Jackson187 hey did you find any solution ??? or do you pay 80$ for spoofing other domains ?

[@bradmca2022]

Less than like 5 like minutes in and like i just like can't take the like 100000 unnecessary like uses of the like word like anymore like

[@Crazen2]

Autism, you?