Security researchers have discovered a new technique that allows threat actors to send spoofed emails with false addresses. They can use this technique to deliver highly targeted phishing emails, while avoiding being spotted by email security solutions.
Timo Longin, a senior security consultant at SEC Consult, published a report on the technique, which he called SMTP smuggling.
SMTP is short for Simple Mail Transfer Protocol, and is described as a TCP/IP protocol needed to send and receive email messages. Because outbound and inbound SMTP servers handle end-of-data sequences differently, hackers can “break out of the message data” and thus “smuggle” arbitrary SMTP commands, including entire email messages.
Non-issue for Cisco
Apparently, the vulnerability can be abused in servers from Microsoft, GMX, and Cisco, with SMTP implementations from Postfix and Sendmail also being affected.
Microsoft and GMX have already addressed the issue, but some reports have claimed Cisco has decided not to. Discussing the matter, the company apparently said SMTP smuggling isn’t exactly a vulnerability, but rather “a feature and that they will not change the default configuration."
Consequently, threat actors can still potentially smuggle emails to Cisco Secure Email instances with default configurations. SEC Consult concluded that the best course of action for Cisco users is to change their settings from “Clean” to “Allow”, as this will prevent spoofed emails with valid DMARC checks from making it into the inbox.
Phishing continues to be the primary attack vector for most threat actors out there. It is omnipresent, cheap, and can be automated. Threat actors can impersonate big brands, company managers, and similar, and use AI writers to draft emails with a sense of urgency. Victims often act on these emails (either by clicking a link or downloading an attachment) without considering the potential risks, resulting in endpoint compromise or data theft.
Via TheHackerNews
More from TechRadar Pro
- What is phishing and how dangerous is it?
- Here's a list of the best firewalls today
- These are the best endpoint protection services right now
