Phishing Robots

by TheAntiSocialEngineer on 23rd March 2017 in Blog

So it turns out us humans aren’t the only ones with a few flaws when it comes to an inbound phishing email! Often uttered from the crowds at every infosec event is the dreaded cliché statement, “Well, humans are the weakest links in security” but not today, stand proud as we take the time to shame our binary companions.

In testing and teaching phishing to organisations, the same things get repeated. Don’t click on the link, check the sender, check for legitimacy etc but we recently discovered these phishing basics can also have quite a bit of damage when it comes to online accounts.

Many online services have a feature whereby you can email the service and it will perform an action. They don’t validate the sender.

Let’s take a look at a few examples, Wunderlist. You can send an email to ‘[email protected]’ from [email protected] and it will forward a todo to the account that uses [email protected]. If you want to interact with this account you could just spoof the email address ‘[email protected]’ and send your emails to [email protected].

How about uploading some malicious APK’s to the victims todo list? Off course you can, just attach to the email.

You can also expand on the features by adding items to the subject line of the email. So now the victims malware can be selected #Important and flagged accordingly.

IFTTT I still don’t understand how to work this service, but I expect people will be able to turn off your connected devices for fun using your forged email address and sending it to ‘[email protected]’.

Imgur allows you to post a picture to your Imgur account via email. Well let’s say we found the most popular Imgur accounts or corporate accounts, spoofed their email address and started uploading what we wanted to their account? I don’t think ‘PeanutBuddha’ with over 2 million up votes would like that.

With limited success it is also possible to dispatch notifications to services like Yammer. You want to email all of the sales department at a company – easy!

Just grab the email address of one salesman and send a spoofed email to [email protected]. Why stop there though? why not send a few phishing links to [email protected] too. Within seconds of sending one spam laden, malware infected email it can be spread around using their own comms platform.

British Gas home systems… accept email and SMS input, so now attackers can have a choice in what medium they wish to spoof. Always handy to know someone can be messing with your internet connected trash whilst you are away via spoofed text messages.

Spoofing an email

Whilst this is done all the time and is quite common in phishing emails not everyone might be aware that you can spoof an email sender. So next time you receive an email and you recognise the sender – it might not be correct. There is normally no checks on the ‘MAIL FROM’ element of an email. It’s trivially easy to send a message from [email protected] and many email systems are none the wiser.

The Fix

Some companies like Google, Evernote and Facebook to name just a few already know what the solution is! They use secret email addresses that are unique, similar to [email protected] whilst this solution is more secure it is not doing the same thing. You see when a company uses a generic mail in address then their system must connect this incoming email to the account and it does this by using the from address of the email (The one that can be spoofed) but a secret/unique email address is allocated per account, meaning emails to that address can only ever end up in that account. To mess with this system you would need to spoof the email aaaaaand! know the secret email address.

We have reached out to several companies effected to ensure they are aware of the issue, due to the nature of the issue it will not be fixed by everyone that uses a static email address. Whilst this does bring several fairly obvious concerns the companies mentioned were only the ones I ran into – thousands more remain and should not be viewed in a negative manner because of this post. It’s the internet, everything has a bug in – some can’t be fixed.

If you would like assistance in testing for issues like these, make contact today.

Further reading can be found in our informational PDF