Onderwerp: Is predictable spam filtering a vulnerability?

During a recent email conversation with several participants, we discovered that the email service of one participant silently dropped legitimate emails that happened to contain certain combinations of words common in spam. I believe this sort of filter i
s common practice, and in fact even in place for some of my own email addresses.

However, this experience made me think: isn't predictable spam filtering in general a vulnerability that could be used as a hoax device? Since most users reply to an email citing the complete source email, including filter-offending words, it should be po
ssible to keep a reply, forward, or even a whole thread, under the radar of specific recipients. If used in combination with forged replies from addresses predictably dropping emails, I think this may be a dangerous tool for social engineering.

For example: attacker 'A' sends 'B' a social engineering request for "the secret plans" and says "if you are unsure, forward my request to your boss and ask if this is okay". 'B' forwards the email to his boss 'C' and asks "Is this okay?". However, 'C':s
spam filter silently drops the email. 'A' forges a reply from 'C' saying: "Sure, no problem, go ahead."

Regards,
R. Armiento

On Wed, Jun 16, 2004 at 01:26:28PM +0200, R Armiento wrote:
[snip]
> For example: attacker 'A' sends 'B' a social engineering request
> for "the secret plans" and says "if you are unsure, forward my
> request to your boss and ask if this is okay". 'B' forwards the
> email to his boss 'C' and asks "Is this okay?". However, 'C':s
> spam filter silently drops the email. 'A' forges a reply from
> 'C' saying: "Sure, no problem, go ahead."

Many will probably discard the above as farfetched or ignore it
since it's not a "real" vulnerability that gives remote root to
the attacker, I think it's beautiful though.

Security is a state of mind, a way of thinking. Vulnerabilities
are all around us and the one you point out above is certainly
one of them.

> Regards,
> R. Armiento

--
Best Regards,
Joel Eriksson
-------------------------------------------------
Cellphone: +46-70 228 64 16 Home: +46-26-10 23 37
Security Research & Systems Development at Bitnux
PGP Key Server pgp.mit.edu, PGP Key ID 0x08811B44
DF38 5806 0EFB 196E E4B6 34B5 4C01 73BB 0881 1B44
-------------------------------------------------

Interesting insight that, in most cases I'd think B and C are likely to =
be
on the same network, possibly protected by the same spam filtering, =
meaning
that A's email wouldn't reach B. I know this isn't always the case, =
just my
thoughts on it.

The above would help reduce the probability of finding a scenario where =
this
would work, that said securing against social engineering attacks is a =
tad
challenging

Again all of the above just my two cents.

Kind regards.

Hamlesh Motah.
IT Consultant.

tel: +44 (0)709 212 0732
fax: +44 (0)709 212 0732
ema: admin@hamlesh.com
web: www.hamlesh.com

Hamlesh Consultants - IT Consultancy - Total Solutions Provider.

The Information contained in this E-Mail and any subsequent =
correspondence
is private and is intended solely for the intended recipient(s). For =
those
other than the recipient any disclosure, copying, distribution, or any
action taken or omitted to be taken in reliance on such information is
prohibited and may be unlawful.


: -----Original Message-----
: From: R Armiento [mailtoar_bt@armiento.se]=20
: Sent: 16 June 2004 11:26
: To: bugtraq@securityfocus.com
: Subject: Is predictable spam filtering a vulnerability?
:=20
:=20
:=20
: During a recent email conversation with several participants,=20
: we discovered that the email service of one participant=20
: silently dropped legitimate emails that happened to contain=20
: certain combinations of words common in spam. I believe this=20
: sort of filter is common practice, and in fact even in place=20
: for some of my own email addresses.
:=20
: However, this experience made me think: isn't predictable=20
: spam filtering in general a vulnerability that could be used=20
: as a hoax device? Since most users reply to an email citing=20
: the complete source email, including filter-offending words,=20
: it should be possible to keep a reply, forward, or even a=20
: whole thread, under the radar of specific recipients. If used=20
: in combination with forged replies from addresses predictably=20
: dropping emails, I think this may be a dangerous tool for=20
: social engineering.=20
:=20
: For example: attacker 'A' sends 'B' a social engineering=20
: request for "the secret plans" and says "if you are unsure,=20
: forward my request to your boss and ask if this is okay". 'B'=20
: forwards the email to his boss 'C' and asks "Is this okay?".=20
: However, 'C':s spam filter silently drops the email. 'A'=20
: forges a reply from 'C' saying: "Sure, no problem, go ahead."
:=20
: Regards,
: R. Armiento
:=20

> During a recent email conversation with several participants, we
> discovered that the email service of one participant silently
> dropped legitimate emails that happened to contain certain
> combinations of words common in spam. I believe this sort of
> filter is common practice, and in fact even in place for some of
> my own email addresses.
>
> However, this experience made me think: isn't predictable spam
> filtering in general a vulnerability that could be used as a hoax
> device?

Certainly. I have brought this issue up with several other ISPs who insist
on blocking my personal domain because I'm a "little guy". They can't prove
that I don't spam, so they default to blocking everything that comes from me
instead. AOL is the biggest and perhaps most annoying offender.

I personally see this as a denial of service attack against MYSELF.
Obviously not meant to be malicious in nature, but quite effective
regardless.

Imagine if I decided to use a spam fitler against someone else...I make an
email that contains known rejected words. I send that email, setting the
"FROM" address and header to be that of my victim. If I send out hundreds of
these messages, I can use someone else's spam filter to mail-bomb my victim
with "rejected" messages.

The REAL issue is that any email filter that silently drops messages can
easily mistake legitimate mail for spam. The user never knows, sometimes the
sender doesn't know, and the braindead admins who set up the filter think
they've done their job. What is even more useless is when the message is
bounced with instructions on how to get off their block list. You send an
email to their admin, yet it is bounced!

Spam filters are often worse then the spam problem itself.

---
Aaron Cake
Technical Services
Advanced Computer Ideas
Phone: 1-519-433-0279
Fax: 1-519-433-5413

On Wed, 16 Jun 2004, R Armiento wrote:

> However, 'C':s spam filter silently drops the email.

In my opinion, any spam filter that silently drops e-mail is broken, and
is indeed a security risk. A spam filter MUST respond with a 500 SMTP
failure code if it rejects a message.

Regards,

David.

David F. Skoll wrote:

>On Wed, 16 Jun 2004, R Armiento wrote:
>
>
>
>>However, 'C':s spam filter silently drops the email.
>>
>>
>
>In my opinion, any spam filter that silently drops e-mail is broken, and
>is indeed a security risk. A spam filter MUST respond with a 500 SMTP
>failure code if it rejects a message.
>
>Regards,
>
>David.
>
>
This ignores client side spam filters, and doesn't really change the
attack. The 500 message would be sent back to A, but not B, so B is
still in the dark about C not receiving the emails.

jon

On Fri, 18 Jun 2004, Jon Fiedler wrote:

> >In my opinion, any spam filter that silently drops e-mail is broken, and
> >is indeed a security risk. A spam filter MUST respond with a 500 SMTP
> >failure code if it rejects a message.

> This ignores client side spam filters,

Client-side spam filters that silently drop e-mail are broken. They
should generate a non-delivery notification.

Of course, that leads to all kinds of other nasty problems, so I've
concluded that client-side spam filters in general are broken, and the
only proper way to do it is on the server, and only by failing the
SMTP transaction.

> and doesn't really change the
> attack. The 500 message would be sent back to A, but not B, so B is
> still in the dark about C not receiving the emails.

No; B would get the failure message, because B is the envelope sender.

Regards,

David.

Greetings,

spam filters are a really big concern for most customers we have. They =
sure
hate spam, know that it statistically means that their employees will =
loose
some time filtering it out, not to mention those evil spam that carry
malicious code or point to malicious sites.

Content filtering is really tricky, and most of those customers try to =
avoid
it. They do it because they don't want to risk blocking a legitimate
message in favor of 10 blocked spams.

TBH, most of them employ 2 basic spam filtering techniques: source =
domain
filtering and realtime blackhole lists (RBLs).

The source domain filtering has some concerns. The biggest one is the =
fact
that most spam today forge the source email address, trying specifically =
to
avoid such mechanism. But they don't choose wisely (hope spammers won't =
read
this message) and usually choose borked email domains making it easier =
to
filter them out. Currently, some customers have lists of as much as =
20.000
blocked domains and emails. what is really strange is the fact that it
proves to be an effective way of blocking spam, so far.

The RBLs are now widely available, and some of them are more aggressive =
than
others.

Together, filtering by source domain / email address (with wildcards, =
such
as addresses with *no_reply*@*, *buycheap*@*, even *spam*@*), subject, =
and
RBLs prove to be around 60% effective (empyrical observation). Those
customers that employ content filtering increase their filtering rate to
around 70% with their desired settings, but also the amount of =
legitimate
emails blocked.

But bear in mind that those who do any sort of filtering have someone
actively monitoring incoming emails to keep up 2 date with filtering =
rules.
There is no way of employing a tool that does the job unnatended, or the
current tools are not capable of this (at least, not for now).

One of the actions we do to reduce such occurences with border / gateway
smtp filtering is to have some "loose" rules for internal messages, or
making internal messages don't pass the border smtp gateway. Internal =
emails
are treated differently than those coming from the outside, and all =
clients
using the corporate email systems from the outside use specific
authentication mechanisms to treat them as internal, in most cases.

One thing that content filtering really does help is to avoid malicious =
code
to be dropped to an internal inbox, and also, those emails that point to
malicious sites or downloads. Here in Brazil, it's really common to =
receive
bank scams trying to fool the user into loading a spoofed page to gather
users and passwords. There are groups specialized in this tactic.

Regards,

Romulo M. cholewa
Home: http://www.rmc.eti.br
News: http://www.rmc.eti.br/news
PGP key id 0x7F8A3B40



] -----Original Message-----
] From: Aaron Cake [mailto:aaron@vltpm.com]=20
] Sent: Thursday, June 17, 2004 11:19 AM
] To: bugtraq@securityfocus.com
] Subject: RE: Is predictable spam filtering a vulnerability?
]=20
] > During a recent email conversation with several participants, we=20
] > discovered that the email service of one participant=20
] silently dropped=20
] > legitimate emails that happened to contain certain combinations of=20
] > words common in spam. I believe this sort of filter is common=20
] > practice, and in fact even in place for some of my own email=20
] > addresses.
] >
] > However, this experience made me think: isn't predictable spam=20
] > filtering in general a vulnerability that could be used as a hoax=20
] > device?
]=20
] Certainly. I have brought this issue up with several other=20
] ISPs who insist on blocking my personal domain because I'm a=20
] "little guy". They can't prove that I don't spam, so they=20
] default to blocking everything that comes from me instead.=20
] AOL is the biggest and perhaps most annoying offender.

(...)

R Armiento wrote:

> During a recent email conversation with several participants, we discovered that the email service of one participant silently dropped legitimate emails that happened to contain certain combinations of words common in spam. I believe this sort of filter
is common practice, and in fact even in place for some of my own email addresses.
>
> However, this experience made me think: isn't predictable spam filtering in general a vulnerability that could be used as a hoax device? Since most users reply to an email citing the complete source email, including filter-offending words, it should be
possible to keep a reply, forward, or even a whole thread, under the radar of specific recipients. If used in combination with forged replies from addresses predictably dropping emails, I think this may be a dangerous tool for social engineering.

Generally, the word 'vulnerability' is attributed to actual flaw in
code. Me? I believe that if a software fails to do it's job due to
missing a feature or a feature not working correctly, it is indeed a
vulnerability, a weakness, or whatever other name you'd like to call it.

Using the word 'vulnerability' for it might not be the best of choices,
but it fits.

On the other hand, security products have to keep up with an evolving
world. New attacks and ways of circumventing detection show up daily,
and products update themselves accordingly. Is it being out-dated or
vulnerable for a product to act as you describe?

Maybe there is a time-issue on if and when the product gets updates, or
perhaps even if new blocks are required and old products can't be
expected to keep up.

Me? I believe that if a product does not keep up-to-date for doing what
it claims to do, it is useless. Not vulnerable.

Another good example is virus scanners which do not support unpacking of
different PE packers, when nowadays malware gets released and
re-released simply re-packed with a different packer, making it
undetectable to about half of the current top-products. Sometimes
getting a new name while at it for the media to chew on.

A poor choice of wording or plain exaggerations? I suppose that with a
missing definitions each person would have to decide for him/herself.
Calling it a vulnerability is fine.. but don't complain about the
stoning later. I didn't.

Gadi Evron.

> On Wed, Jun 16, 2004 at 01:26:28PM +0200, R Armiento wrote:
>>For example: attacker 'A' sends 'B' a social engineering request
>>for "the secret plans"
....
>>spam filter silently drops the email. 'A' forges a reply

Joel Eriksson wrote:
> it's not a "real" vulnerability that gives remote root to
> the attacker, I think it's beautiful though.

More likely I will ask your boss to approve payment of an invoice and
then send my own forged authorization.

This is a widespread vulnerability in the way that organizations
improperly trust computer communications.

The only solution is to implement some type of authentication for
important electronic communications, and we all know that new
vulnerabilities are exposed once there is an authentication mechanism.

To presume that electronic communications and stored communications are
trustworthy, the way that the parties to civil litigation generally do,
and the way that criminal courts nearly always do, creates endless
potential for very bad things to happen. We must always doubt by default
anything that is in electronic form.

With that in mind, remember that the attacker in the scenario presented
will only succeed once per target and then the target will adapt and
defend. In practice that is an acceptable risk, and the natural
condition of our exposure to computer vulnerabilities.

Where we really see harm come from improper computing practices on a
large scale is in court. As a society we will never be capable of
adapting to threats because there will always be new people who have not
previously suffered the consequences of each mode of attack.

Sincerely,

Jason Coombs

Director of Forensic Services
PivX Solutions, Inc.
http://www.pivx.com

I think spam filters arn't the solution to the spam problem. If someone gets
200 spam emails aday then what use is a spam filter telling them the email
was rejected? The user will end up not looking at the list of rejected
emails because it's sooo big.

Filtering certain works is also bad aswell eg "penis", "viagra".
It can easyly be evoided:
Email "Free penis enlargement pills" - Would be filterd
Email "Free pen is enlargement pills" - Wouldn't be filtered

So in order to be effective it has to look for variations on the works
For example "penis" it could look for "P E N I S", "peni$" etc...

This is when the problems start. I get sent 200 spam emails the rejected
emails log is huge, i can't be bothed to look through it, it'll take tooo
long, but it has removed an important email.

Email "Dear Andiroo, I have found your pen, it was under my desk. You PEN IS
now in the top draw of your desk".

Ok i lost my sepcial pen, my friend has found it but look "PEN IS" is like
"PENIS" so it's been taken by the spam filter.

My solution for spam:
I think there should be a huge database on spam emails, just like an anti
virus scanner but for spam. I think it is that simple have an anti-virus but
for spam, i am sure that if i get a spam email someone else will have
exactly the same email so if i can submit it to the database and it's added
to it quickly so everyone can get the updates then there would be no
problem, but there is soooo much spam out there we would for ever have to
update or ever growing in size databases.

I think this would eliminate alot of spam, I have ran out of ideas for
preventing spam emails, so what other effective solutions already out there?



>From: "Aaron Cake" <aaron@vltpm.com>
>To: <bugtraq@securityfocus.com>
>Subject: RE: Is predictable spam filtering a vulnerability?
>Date: Thu, 17 Jun 2004 10:18:46 -0400
>MIME-Version: 1.0
>Received: from outgoing2.securityfocus.com ([205.206.231.26]) by
>mc8-f2.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824); Fri, 18 Jun 2004
>14:43:23 -0700
>Received: from lists2.securityfocus.com (lists2.securityfocus.com
>[205.206.231.20])by outgoing2.securityfocus.com (Postfix) with QMQPid
>78FB1143812; Fri, 18 Jun 2004 18:26:43 -0600 (MDT)
>Received: (qmail 4774 invoked from network); 17 Jun 2004 08:06:11 -0000
>X-Message-Info: JGTYoYF78jEQIQmJRqn4zIchqtVGhE2/
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Message-ID: <009601c45476$00737fe0$650aa8c0@aaronxp>
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2739.300
>In-reply-to: <200406161326.AA304546076@dewmill.com>
>Return-Path: bugtraq-return-14825-andiroohunter=msn.com@securityfocus.com
>X-OriginalArrivalTime: 18 Jun 2004 21:43:23.0227 (UTC)
>FILETIME=[478332B0:01C4557D]
>
> > During a recent email conversation with several participants, we
> > discovered that the email service of one participant silently
> > dropped legitimate emails that happened to contain certain
> > combinations of words common in spam. I believe this sort of
> > filter is common practice, and in fact even in place for some of
> > my own email addresses.
> >
> > However, this experience made me think: isn't predictable spam
> > filtering in general a vulnerability that could be used as a hoax
> > device?
>
>Certainly. I have brought this issue up with several other ISPs who insist
>on blocking my personal domain because I'm a "little guy". They can't prove
>that I don't spam, so they default to blocking everything that comes from
>me
>instead. AOL is the biggest and perhaps most annoying offender.
>
>I personally see this as a denial of service attack against MYSELF.
>Obviously not meant to be malicious in nature, but quite effective
>regardless.
>
>Imagine if I decided to use a spam fitler against someone else...I make an
>email that contains known rejected words. I send that email, setting the
>"FROM" address and header to be that of my victim. If I send out hundreds
>of
>these messages, I can use someone else's spam filter to mail-bomb my victim
>with "rejected" messages.
>
>The REAL issue is that any email filter that silently drops messages can
>easily mistake legitimate mail for spam. The user never knows, sometimes
>the
>sender doesn't know, and the braindead admins who set up the filter think
>they've done their job. What is even more useless is when the message is
>bounced with instructions on how to get off their block list. You send an
>email to their admin, yet it is bounced!
>
>Spam filters are often worse then the spam problem itself.
>
>---
>Aaron Cake
>Technical Services
>Advanced Computer Ideas
>Phone: 1-519-433-0279
>Fax: 1-519-433-5413
>
>

__________________________________________________ _______________
It's fast, it's easy and it's free. Get MSN Messenger today!
http://www.msn.co.uk/messenger

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

R Armiento wrote:
| During a recent email conversation with several participants, we
discovered that the email service of one participant silently
dropped legitimate emails that happened to contain certain
combinations of words common in spam. I believe this sort of filter
is common practice, and in fact even in place for some of my own
email addresses.
|
| However, this experience made me think: isn't predictable spam
filtering in general a vulnerability that could be used as a hoax
device? Since most users reply to an email citing the complete
source email, including filter-offending words, it should be
possible to keep a reply, forward, or even a whole thread, under the
radar of specific recipients. If used in combination with forged
replies from addresses predictably dropping emails, I think this may
be a dangerous tool for social engineering.
|
| For example: attacker 'A' sends 'B' a social engineering request
for "the secret plans" and says "if you are unsure, forward my
request to your boss and ask if this is okay". 'B' forwards the
email to his boss 'C' and asks "Is this okay?". However, 'C':s spam
filter silently drops the email. 'A' forges a reply from 'C' saying:
"Sure, no problem, go ahead."
|
| Regards,
| R. Armiento
|
|

Interesting idea.

That might be problematic if the originator doesn't intercept the
letter to boss as it may contain some important data for
faking the boss's answer

- --
Ilya Sher: 3A4A 810C 1C81 79F3 A8C6 2545 90FD 6114 F730 0680
Rules: UNIX,UTF-8,Lisp,S-exps,Encryption,OSS,VIM,Gnome
Sucks: M$,XML,Morons on the web
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFA0VSakP1hFPcwBoARApNYAKCT2vjCpSd7GL30qbXiAG aySvTsTwCgk1Jj
BiwFRjU/rRRMrrjeCbnt6aI=
=9G+O
-----END PGP SIGNATURE-----

Your point on the Rejected messages is that it does happen. Reverse-NDR's
are a real problem - and are a loophole since NDR is a smtp spec.

On a second note, your comment on filters, (not involving the me2 spam
filter companies) filters do not stop spam, and sometimes they are truly
more detrimental.

There was an article posted on security focus that brought up all of these
issues with security and spam.

www.securityfocus.com/infocus/1763 (it's two parts, that's the first one, it
leads to the other one.).

The social engineering attack would have to be well surveilled to pull off,
but it is definitely possible by a long term and determined attacker.

Lance

-----Original Message-----
From: Aaron Cake [mailto:aaron@vltpm.com]
Sent: Thursday, June 17, 2004 7:19 AM
To: bugtraq@securityfocus.com
Subject: RE: Is predictable spam filtering a vulnerability?

> During a recent email conversation with several participants, we
> discovered that the email service of one participant silently
> dropped legitimate emails that happened to contain certain
> combinations of words common in spam. I believe this sort of
> filter is common practice, and in fact even in place for some of
> my own email addresses.
>
> However, this experience made me think: isn't predictable spam
> filtering in general a vulnerability that could be used as a hoax
> device?

Certainly. I have brought this issue up with several other ISPs who insist
on blocking my personal domain because I'm a "little guy". They can't prove
that I don't spam, so they default to blocking everything that comes from me
instead. AOL is the biggest and perhaps most annoying offender.

I personally see this as a denial of service attack against MYSELF.
Obviously not meant to be malicious in nature, but quite effective
regardless.

Imagine if I decided to use a spam fitler against someone else...I make an
email that contains known rejected words. I send that email, setting the
"FROM" address and header to be that of my victim. If I send out hundreds of
these messages, I can use someone else's spam filter to mail-bomb my victim
with "rejected" messages.

The REAL issue is that any email filter that silently drops messages can
easily mistake legitimate mail for spam. The user never knows, sometimes the
sender doesn't know, and the braindead admins who set up the filter think
they've done their job. What is even more useless is when the message is
bounced with instructions on how to get off their block list. You send an
email to their admin, yet it is bounced!

Spam filters are often worse then the spam problem itself.

---
Aaron Cake
Technical Services
Advanced Computer Ideas
Phone: 1-519-433-0279
Fax: 1-519-433-5413

This is nothing new to spam filtering. Any dynamic/proactive filter=
mechanism is subject to the sam shenanigans.

This has been a "feature" of IntrusionPreventionSystems since they came=
out. Spoof an attack from an IP you want to be denied, and the IDS=
updates the ruleset on the firewall (what a IPS really is, an IDS talking=
to a firewall) and that third party can't get past that perimeter.

bburge
someguy who does this kinda stuff

*********** REPLY SEPARATOR ***********

On 6/17/2004 at 7:27 PM Joel Eriksson wrote:

>On Wed, Jun 16, 2004 at 01:26:28PM +0200, R Armiento wrote:
>[snip]
>> For example: attacker 'A' sends 'B' a social engineering request
>> for "the secret plans" and says "if you are unsure, forward my
>> request to your boss and ask if this is okay". 'B' forwards the
>> email to his boss 'C' and asks "Is this okay?". However, 'C':s
>> spam filter silently drops the email. 'A' forges a reply from
>> 'C' saying: "Sure, no problem, go ahead."
>
>Many will probably discard the above as farfetched or ignore it
>since it's not a "real" vulnerability that gives remote root to
>the attacker, I think it's beautiful though.
>
>Security is a state of mind, a way of thinking. Vulnerabilities
>are all around us and the one you point out above is certainly
>one of them.
>
>> Regards,
>> R. Armiento
>
>--
>Best Regards,
> Joel Eriksson
>-------------------------------------------------
>Cellphone: +46-70 228 64 16 Home: +46-26-10 23 37
>Security Research & Systems Development at Bitnux
>PGP Key Server pgp.mit.edu, PGP Key ID 0x08811B44
>DF38 5806 0EFB 196E E4B6 34B5 4C01 73BB 0881 1B44
>-------------------------------------------------

At 19:27 2004-06-17 +0200, Joel Eriksson wrote:
>On Wed, Jun 16, 2004 at 01:26:28PM +0200, R Armiento wrote:
>[snip]
> > For example: attacker 'A' sends 'B' a social engineering request
> > for "the secret plans" and says "if you are unsure, forward my
> > request to your boss and ask if this is okay". 'B' forwards the
> > email to his boss 'C' and asks "Is this okay?". However, 'C':s
> > spam filter silently drops the email. 'A' forges a reply from
> > 'C' saying: "Sure, no problem, go ahead."
>
>Many will probably discard the above as farfetched or ignore it
>since it's not a "real" vulnerability that gives remote root to
>the attacker, I think it's beautiful though.

A far more plausible vulnerability would be for the attacker, if they had
exploited the mail and/or DNS hosts used by user B to intercept or redirect
mail. This would significantly increase the workability of further
socially engineered exploits.

FTR, the proposed failing wouldn't be possible if such decisions were
digitally signed (PGP/GNUPG, etc) - the "forged" email would fail to be
verified.

The success of the supposed mail vulnerability relies upon the gullibility
of user B, not upon an automated system. There are other factors to
consider in there as well, such as SPF filtering at the mailhost of user B
(which could reject the forged mail because the originating mailserver
isn't correct for the sending address), or of user B sending a response to
the forged authorization, and THAT message going unresponded to, or at
least of user A (attacker) not RECEIVING that message to know to respond to
it. For that matter, it relies upon the message from user B to user C not
including other details which user A would fail to address when sending the
forged reply, and that user B doesn't simply pick up the phone and call
user C, which renders the whole matter moot.

---
Please DO NOT carbon me on list replies. I'll get my copy from the list.

Sean B. Straw / Professional Software Engineering
Post Box 2395 / San Rafael, CA 94912-2395