Into the Inbox: Novel Email Spoofing Attack Patterns

Into the Inbox: Novel Email Spoofing Attack Patterns

Speakers: Caleb Sergeant, Offensive Security, PayPal; Hao Wang, Offensive Security Manager, PayPal

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=twu5Mw0y9ss

Overview

In "Into the Inbox: Novel Email Spoofing Attack Patterns," Caleb Sergeant and Hao Wang of PayPal unveiled their groundbreaking research into new methods of email spoofing that have far-reaching implications for digital security. Their work, which culminated in the discovery of several CVEs, exposed vulnerabilities impacting over 20 million domains globally. The presentation highlighted how attackers can bypass common email authentication mechanisms like SPF, DKIM, and DMARC by exploiting subtle misconfigurations and design choices within email infrastructure.

The talk, a first-time Black Hat appearance for both speakers, delved into three distinct attack patterns, though the provided transcript focuses primarily on the most impactful one. Sergeant, with a decade of experience in offensive security following a career in the Marine Corps, and Wang, an offensive security manager with 15 years in penetration testing, shared their journey from an April Fool's prank to a large-scale security investigation. Their findings underscore the persistent challenge of securing email communications against increasingly sophisticated spoofing techniques, emphasizing the need for robust defensive strategies.

This research is critical because email remains a primary vector for phishing, business email compromise (BEC), and other social engineering attacks. By demonstrating how easily widely trusted domains can be spoofed, Sergeant and Wang provide invaluable insights for organizations to re-evaluate their email security postures and implement stronger authentication policies. The scale of the potential impact, affecting millions of domains, signals a widespread vulnerability that demands immediate attention from domain owners, hosting providers, and security professionals alike.

Background

▶ Watch: Introduction, speakers, and talk overview (0:00)

The genesis of this research began, somewhat unusually, with an elaborate April Fool's prank. Caleb Sergeant, aiming to "one-up" previous pranks, decided to spoof an email from his friend's Homeowners Association (HOA), instructing him to repaint his house. To achieve this, Sergeant utilized an online email marketing service, leveraging its API to craft and send the email. To his surprise, the test email he sent to himself appeared legitimate, successfully passing standard email authentication checks, including SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance). This unexpected success sparked a deeper investigation into how such spoofing was possible despite ostensibly robust security mechanisms.

This personal anecdote quickly evolved into a formal research project for Sergeant and Hao Wang. Their initial curiosity led them to revisit prior work in the field of email security. They specifically cited two key influences: Marcello Bite Bleeder's Defcon talk on "Spam Channel" and the abuse of SPF records, and Timo Longin's discovery of SMTP smuggling. Longin's research, unveiled around December of the previous year (2022, given the Black Hat 2023 context), demonstrated how an outbound SMTP server could send an email that an inbound SMTP server might interpret as two separate messages due to differing interpretations of the end-of-data sequence. This particular technique can lead to email spoofing by manipulating how email content is parsed and delivered.

The fundamental problem enabling these attacks lies in the intricate interplay and often misunderstood logic of email authentication protocols. While SPF, DKIM, and DMARC are designed to prevent spoofing, DMARC, critically, only requires one of SPF or DKIM to pass for an email to be considered legitimate. This "or" condition creates a significant vulnerability, as attackers only need to find a way to satisfy one of these checks, rather than both, to successfully spoof a sender's domain. The complexity of managing these records, especially across large organizations or shared hosting environments, further contributes to the existence of these exploitable misconfigurations.

Key Findings

▶ Watch: Influential prior research: Spam Channel and SMTP Smuggling (5:00)

Caleb Sergeant and Hao Wang's extensive research yielded several critical findings that collectively paint a concerning picture of the state of email security. Their initial broad survey involved examining 15 different vendors, encompassing web hosting providers, domain registrars, and email service providers. Out of these 15, a staggering eight were found to have some form of email spoofing vulnerability. This high success rate underscored the prevalence of exploitable weaknesses across a wide spectrum of essential internet infrastructure components.

The discovered vulnerabilities were categorized into three distinct attack patterns. While the talk's transcript primarily details the first and most impactful pattern, the speakers emphasized that all three contributed to the overall risk. The most significant finding was that Attack Pattern #1 alone rendered millions of domains vulnerable to spoofing. This widespread impact is attributed to common practices within the hosting industry that inadvertently create pathways for unauthorized email sending.

A notable aspect of their research methodology was the necessity to build their own dataset of DNS records. Initially, the researchers sought existing data sets for DNS records, including subdomains, SPF, and mail records, to identify potential vulnerabilities at scale. However, the exorbitant costs quoted by data providers led them to develop their own solution. They leveraged ChatGPT to write a program that systematically scanned the Alexa top 1 million domains, gathering the necessary SPF and DMARC records. Although this scanning process was time-consuming, taking "weeks and weeks" with limited resources, it ultimately provided them with a comprehensive dataset to identify the scale of the vulnerabilities. This proactive approach to data collection was instrumental in quantifying the widespread impact of their discoveries and demonstrating that the numbers they cited, such as "20 million different domains," were meticulously derived from empirical data rather than estimations.

Technical Deep Dive

▶ Watch: Explanation of SPF, DKIM, and DMARC basics (6:00)

The foundation of understanding these novel email spoofing attacks lies in the core email authentication protocols: SPF, DKIM, and DMARC. The speakers provided a concise explanation of each:

• Sender Policy Framework (SPF): SPF is a DNS TXT record that specifies which IP addresses are authorized to send email on behalf of a particular domain. Conceptually, it's a whitelist of approved sending servers. If an email originates from an IP address not listed in the sender's SPF record, it should theoretically fail SPF validation.
• DomainKeys Identified Mail (DKIM): DKIM adds a digital signature to outgoing emails, allowing the recipient's server to verify that the email was indeed sent by an authorized sender and that its content hasn't been tampered with in transit. The signature is cryptographically linked to the sending domain.
• DMARC (Domain-based Message Authentication, Reporting & Conformance): DMARC acts as the "doorman" for email, enforcing policies based on the results of SPF and DKIM checks. It instructs receiving mail servers on how to handle emails that fail authentication (e.g., quarantine, reject, or allow with reporting). A critical detail highlighted by the speakers is that DMARC operates on an "or" logic: for an email to pass DMARC, only one of SPF or DKIM needs to align and pass. This "or statement" is a key vulnerability point, as an attacker only needs to satisfy one criterion to achieve DMARC pass.

The talk also referenced SMTP smuggling, a technique pioneered by Timo Longin, as a foundational concept for understanding advanced email spoofing. SMTP smuggling exploits a discrepancy in how different SMTP servers interpret the "end of data" sequence (typically <CR><LF>.<CR><LF>). An outbound server might process a sequence in a way that an inbound server interprets as two distinct emails. This can lead to a scenario where one part of the crafted message passes authentication checks, while a second, spoofed part is delivered, effectively "smuggling" an unauthorized email past defenses. While the speakers acknowledged the profound impact of SMTP smuggling, their primary research focused on different attack patterns.

The most impactful finding, Attack Pattern #1, targets the pervasive use of master SPF records by large web hosting companies. The speakers illustrated this with an example involving networksolutions.com. During their enumeration of SPF records for this domain, they discovered an inclusion for SPF.websitewelcome.com. Further investigation revealed that SPF.websitewelcome.com is a master SPF record utilized by Hostgator, a major web hosting provider.

The purpose of such a master SPF record is ostensibly for operational efficiency: it allows a hosting company like Hostgator to dynamically reallocate IP addresses for its shared hosting services without requiring individual domain owners to constantly update their SPF records. By including SPF.websitewelcome.com in their domain's SPF record, networksolutions.com effectively delegates trust to all IP addresses authorized by Hostgator's master SPF.

The vulnerability arises because if an attacker can find a way to send email through Hostgator's infrastructure (which, by design, is allowed to send on behalf of any domain that includes SPF.websitewelcome.com), they can then spoof any domain that has included this master SPF record. The transcript implies that leveraging an email marketing campaign or similar service that is hosted on or uses the infrastructure covered by such a master SPF record could facilitate this. Because the email originates from an IP address permitted by the master SPF record, and that master record is included in the target domain's SPF, the SPF check passes. With a passing SPF, DMARC also passes (due to its "or" logic), and the spoofed email is delivered to the recipient's inbox as legitimate. This mechanism bypasses DMARC protection even if DKIM is not spoofed, as only one authentication mechanism is required to pass. This specific attack pattern affects "millions of millions" of domains that rely on such shared hosting and master SPF configurations, making it a highly scalable and potent threat.

Demo / Proof of Concept

▶ Watch: Key insight: DMARC passes if SPF or DKIM passes (6:50)

While the talk outlined several theoretical attack patterns, the most concrete demonstration of email spoofing capabilities was presented through Caleb Sergeant's personal anecdote – the April Fool's prank that initiated their research. This served as a practical Proof of Concept (PoC) for basic email spoofing that successfully bypassed standard authentication.

Sergeant's goal was to send an email appearing to come from his friend's Homeowners Association (HOA), instructing him to repaint his house. To execute this, he utilized an online email marketing service, obtaining an API key and sending the email via a curl request. Before sending the actual prank email, he performed a test. To his surprise, this test email, sent with a spoofed "From" address (e.g., [email protected]), appeared entirely legitimate in his inbox. Crucially, the email passed SPF, DKIM, and DMARC checks, indicating to the receiving mail server that it was a valid and authenticated message.

The success of this initial prank, where a simple email marketing API could be leveraged to send a fully authenticated spoofed email, highlighted a significant blind spot. At the time, Sergeant didn't fully understand why it worked, only that it did. The core mechanism, as later elucidated by their research, was that the email marketing service's sending infrastructure was likely authorized by the target domain's SPF record, or perhaps it was able to sign the email with a valid DKIM for the domain. Since DMARC only requires one of these to pass, the spoofed email sailed through. The prank email itself contained subtle indicators, like unusual paint shades ("warm black," "true black"), and was sent on April 1st, but these were human-discernible clues, not technical failures of the email security protocols. The friend fell for the prank, demonstrating the real-world impact of such a seemingly legitimate spoofed email. This personal demonstration served as a compelling real-world example of how novel spoofing patterns, even if initially discovered by accident, can effectively circumvent modern email security measures.

Defensive Implications

▶ Watch: Introduction to the SMTP Smuggling attack pattern (7:20)

The novel email spoofing attack patterns uncovered by Caleb Sergeant and Hao Wang carry significant defensive implications for organizations and domain owners. The primary takeaway is that relying solely on a DMARC policy without a deep understanding of its underlying SPF and DKIM configurations is insufficient.

1. Scrutinize SPF Records for Broad Inclusions: Organizations must meticulously review their SPF records for any broad include statements, particularly those pointing to master SPF records managed by web hosting providers (like SPF.websitewelcome.com for Hostgator). These inclusions can inadvertently delegate trust to a vast network of IP addresses, many of which an organization may not directly control or even be aware of. If an attacker can leverage any service within that hosting provider's ecosystem, they can effectively spoof the organization's domain. Where possible, domain owners should aim for more granular control over their SPF records, specifying only the exact sending services they use.
2. Understand DMARC's "Or" Logic: Defenders need to internalize that DMARC only requires one of SPF or DKIM to pass for an email to be deemed legitimate. This means that even if an organization has a strong DKIM implementation, a weak or overly permissive SPF record can still be exploited. Both SPF and DKIM must be configured securely and aligned with the domain to achieve comprehensive protection.
3. Implement Strict DMARC Policies: While the transcript does not detail the "recommendations" section from the agenda, a strong inference is the need to implement DMARC policies with p=reject or p=quarantine to actively prevent spoofed emails from reaching inboxes. A p=none policy, while useful for monitoring, does not offer active protection against spoofing. However, organizations should transition to stricter policies carefully, ensuring all legitimate sending sources are properly authenticated to avoid legitimate emails being blocked.
4. Audit Email Sending Services: Organizations should maintain a comprehensive inventory of all third-party services authorized to send email on their behalf (e.g., marketing platforms, transactional email services, CRM systems). Each of these services must be properly configured with SPF and DKIM, and their IP ranges or domains must be accurately reflected in the organization's SPF record. The prank example underscores how easily an email marketing API can be abused if not properly managed or if the target domain's SPF is too broad.
5. Be Aware of SMTP Smuggling: While Attack Pattern #1 was the focus, the mention of SMTP smuggling highlights the need for mail server administrators to ensure their outbound and inbound SMTP gateways are consistent in their interpretation of SMTP protocol sequences, especially the end-of-data marker. Keeping mail server software updated and applying vendor patches is crucial to mitigate such parsing vulnerabilities.
6. Regular DNS Record Review: Given the dynamic nature of IT environments and potential changes by hosting providers, regular audits of DNS records, particularly SPF, DKIM, and DMARC, are essential. This ensures that records remain accurate, minimal, and secure against new or evolving attack vectors.

Key Takeaways

• DMARC's "Or" Logic is a Critical Weakness: DMARC only requires SPF or DKIM to pass for an email to be authenticated, creating a significant attack surface if either mechanism is misconfigured.
• Master SPF Records are High-Impact Vulnerabilities: Broad include statements in SPF records, especially those from large web hosting providers like Hostgator's SPF.websitewelcome.com, can delegate trust to an extensive network, making millions of domains vulnerable to spoofing.
• Widespread Impact: The research identified eight out of fifteen major email ecosystem vendors with spoofing issues, with Attack Pattern #1 alone impacting "millions of millions" of domains and leading to several CVEs.
• SMTP Smuggling is a Novel Threat: The attack vector identified by Timo Longin, abusing SMTP end-of-data sequence interpretation, represents a powerful method for email spoofing.
• Proactive Data Collection is Essential: The researchers built their own DNS record dataset using a ChatGPT-written program to overcome data acquisition costs, demonstrating the importance of extensive scanning for identifying widespread vulnerabilities.
• Even Seemingly Valid Email Authentication Can Be Exploited: The initial prank demonstrated that even without deep technical knowledge, attackers can find ways to send authenticated spoofed emails if underlying configurations are flawed.

About the Speaker(s)

Caleb Sergeant is an Offensive Security professional at PayPal. With a decade of experience in Information Security, he brings a robust background to the field. Prior to his career in cybersecurity, Sergeant served for approximately ten years in the Marine Corps. "Into the Inbox" marked his debut as a speaker at Black Hat, where he shared the culmination of several months of novel research.

Hao Wang is an Offensive Security Manager at PayPal and presented alongside Caleb Sergeant. Wang has a distinguished career in the security industry, having started as a penetration tester 15 years ago and continuing to practice offensive security today. This presentation was also his first Black Hat talk, where he helped unveil their significant findings on email spoofing.