filmov
tv
USENIX Security '21 - Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender
Показать описание
Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks
Kaiwen Shen, Chuhan Wang, and Minglei Guo, Tsinghua University; Xiaofeng Zheng, Tsinghua University and Qi An Xin Technology Research Institute; Chaoyi Lu and Baojun Liu, Tsinghua University; Yuxuan Zhao, North China Institute of Computing Technology; Shuang Hao, University of Texas at Dallas; Haixin Duan, Tsinghua University; Qi An Xin Technology Research Institute; Qingfeng Pan, Coremail Technology Co. Ltd; Min Yang, Fudan University
As a fundamental communicative service, email is playing an important role in both individual and corporate communications, which also makes it one of the most frequently attack vectors. An email's authenticity is based on an authentication chain involving multiple protocols, roles and services, the inconsistency among which creates security threats. Thus, it depends on the weakest link of the chain, as any failed part can break the whole chain-based defense.
This paper systematically analyzes the transmission of an email and identifies a series of new attacks capable of bypassing SPF, DKIM, DMARC and user-interface protections. In particular, by conducting a "cocktail" joint attack, more realistic emails can be forged to penetrate the celebrated email services, such as Gmail and Outlook. We conduct a large-scale experiment on 30 popular email services and 23 email clients, and find that all of them are vulnerable to certain types of new attacks. We have duly reported the identified vulnerabilities to the related email service providers, and received positive responses from 11 of them, including Gmail, Yahoo, iCloud and Alibaba. Furthermore, we propose key mitigating measures to defend against the new attacks. Therefore, this work is of great value for identifying email spoofing attacks and improving the email ecosystem's overall security.
Kaiwen Shen, Chuhan Wang, and Minglei Guo, Tsinghua University; Xiaofeng Zheng, Tsinghua University and Qi An Xin Technology Research Institute; Chaoyi Lu and Baojun Liu, Tsinghua University; Yuxuan Zhao, North China Institute of Computing Technology; Shuang Hao, University of Texas at Dallas; Haixin Duan, Tsinghua University; Qi An Xin Technology Research Institute; Qingfeng Pan, Coremail Technology Co. Ltd; Min Yang, Fudan University
As a fundamental communicative service, email is playing an important role in both individual and corporate communications, which also makes it one of the most frequently attack vectors. An email's authenticity is based on an authentication chain involving multiple protocols, roles and services, the inconsistency among which creates security threats. Thus, it depends on the weakest link of the chain, as any failed part can break the whole chain-based defense.
This paper systematically analyzes the transmission of an email and identifies a series of new attacks capable of bypassing SPF, DKIM, DMARC and user-interface protections. In particular, by conducting a "cocktail" joint attack, more realistic emails can be forged to penetrate the celebrated email services, such as Gmail and Outlook. We conduct a large-scale experiment on 30 popular email services and 23 email clients, and find that all of them are vulnerable to certain types of new attacks. We have duly reported the identified vulnerabilities to the related email service providers, and received positive responses from 11 of them, including Gmail, Yahoo, iCloud and Alibaba. Furthermore, we propose key mitigating measures to defend against the new attacks. Therefore, this work is of great value for identifying email spoofing attacks and improving the email ecosystem's overall security.
0:11:28
USENIX Security '21 - Weak Links in Authentication Chains: A Large-scale Analysis of Email Send...
0:12:05
USENIX Security '21 - An Analysis of Speculative Type Confusion Vulnerabilities in the Wild
0:12:05
USENIX Security '21 - Database Reconstruction from Noisy Volumes: A Cache Side-Channel Attack.....
0:11:56
USENIX Security '21 - A Highly Accurate Query-Recovery Attack against Searchable Encryption...
0:12:09
USENIX Security '21 - Preventing Use-After-Free Attacks with Fast Forward Allocation
0:12:05
USENIX Security '21 - VScape: Assessing and Escaping Virtual Call Protections
0:12:18
USENIX Security '21 - Share First, Ask Later (or Never?) Studying Violations of GDPR's Exp...
0:13:36
USENIX Security '21 - Adversarial Policy Training against Deep Reinforcement Learning
0:12:08
USENIX Security '20 - Actions Speak Louder than Words: Entity-Sensitive Privacy Policy and Data...
0:11:43
USENIX Security '21 - SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning
0:13:17
USENIX Security '21 - Compromised or Attacker-Owned: A Large Scale Classification and Study
0:10:50
USENIX Security '21 - Hiding the Access Pattern is Not Enough: Exploiting Search Pattern Leakag...
0:12:13
USENIX Security '21 - Exposing New Vulnerabilities of Error Handling Mechanism in CAN
0:11:49
USENIX Security '21 - 'It's Stored, Hopefully, on an Encrypted Server'': Mi...
0:12:12
USENIX Security '21 - Evaluating In-Workflow Messages for Improving Mental Models of End-to-End...
0:12:01
USENIX Security '21 - Entangled Watermarks as a Defense against Model Extraction
0:11:44
USENIX Security '22 - Loki: Hardening Code Obfuscation Against Automated Attacks
0:10:28
USENIX Security '21 - Privacy-Preserving and Standard-Compatible AKA Protocol for 5G
0:12:49
USENIX Security '21 - Sharing More and Checking Less: Leveraging Common Input Keywords to Detec...
0:13:58
USENIX Security '21 - CSProp: Ciphertext and Signature Propagation Low-Overhead Public-Key...
0:10:51
USENIX Security '21 - Having Your Cake and Eating It: An Analysis of Concession-Abuse-as-a-Serv...
0:12:15
USENIX Security '21 - Weaponizing Middleboxes for TCP Reflected Amplification
0:10:32
USENIX Security '21 - Token-Level Fuzzing
0:10:31
USENIX Security '21 - Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applicatio...
Комментарии