4 ms·

Hold on, am I reading the paper correctly? In the 5.1 attack, if you use "Add to contacts" in Outlook, this will bypass DMARC protection completely? So by addin

Hold on, am I reading the paper correctly? In the 5.1 attack, if you use "Add to contacts" in Outlook, this will bypass DMARC protection completely? So by adding someone to contacts you are essentially allowing their email to be spoofed? What the hell Microsoft?

jabroni_salad 3y ago
https://support.microsoft.com/en-us/office/add-recipients-of-my-email-messages-to-the-safe-senders-list-be1baea0-beab-4a30-b968-9004332336ce https://support.microsoft.com/en-us/office/add-recipients-of... Yes. Although I will say that ATP runs before safesenders or any other rule applies, and it's been hair trigger lately. Sadly this is the only way to do business sometimes. Every org has to deal with a couple other organizations that absolutely refuse to get their auth game together. Users just want their mail to work and the particulars don't matter to them. The result is that your contacts can be spoofed. If I (the admin) push back on this my boss will get a complaint like "jabroni is interfering with my bazillion dollar sale" and any argument to the contrary is obviously just me playing the blame game. So I whitelist it and now that company we are trading PDFs with can be spoofed by anybody and skips security scanning :)
- peanut-walrus 3y ago
  I mean, yeah, I've been in that position, I get it for the poorly configured domains. However, if I set a DMARC policy for my domain to reject, I would expect at least Google and Microsoft who control something like 90% of the email market to respect that policy. The realist in me realises that there is probably a non-negative number of domains out there with dmarc set to reject but failing absolutely all spf and dkim checks, but this should be their problem, not the receiver's.
- MichaelZuo 3y ago
  If the other organization insists on sticking to older methods, then best practice is for all parties involved to revert to the last commonly and unarguably fully agreed-to method of communication, which is most likely fax in the US.
  - jabroni_salad 3y ago
    which is hilarious, since both companies are probably using a fax gateway anyhow. You end up with email-> gateway -> real fax -> gateway -> email. This is somehow easier than configuring a dmarc record.
peanut-walrus 3y ago
Looks like this is fixed for Outlook.com > Microsoft confirmed the vulnerabilities (with severity “Important”, the highest severity assigned to email spoofing bugs) and awarded us a bug bounty. They have partially fixed the issues by rejecting spoofed email messages purporting to be from domains that have a DMARC policy of REJECT However, I could still replicate this on an o365 domain, so this attack would still work if attacker has access to an o365 domain.

jabroni_salad 3y ago

https://support.microsoft.com/en-us/office/add-recipients-of-my-email-messages-to-the-safe-senders-list-be1baea0-beab-4a30-b968-9004332336ce https://support.microsoft.com/en-us/office/add-recipients-of... Yes. Although I will say that ATP runs before safesenders or any other rule applies, and it's been hair trigger lately. Sadly this is the only way to do business sometimes. Every org has to deal with a couple other organizations that absolutely refuse to get their auth game together. Users just want their mail to work and the particulars don't matter to them. The result is that your contacts can be spoofed. If I (the admin) push back on this my boss will get a complaint like "jabroni is interfering with my bazillion dollar sale" and any argument to the contrary is obviously just me playing the blame game. So I whitelist it and now that company we are trading PDFs with can be spoofed by anybody and skips security scanning :)

peanut-walrus 3y ago
I mean, yeah, I've been in that position, I get it for the poorly configured domains. However, if I set a DMARC policy for my domain to reject, I would expect at least Google and Microsoft who control something like 90% of the email market to respect that policy. The realist in me realises that there is probably a non-negative number of domains out there with dmarc set to reject but failing absolutely all spf and dkim checks, but this should be their problem, not the receiver's.
MichaelZuo 3y ago
If the other organization insists on sticking to older methods, then best practice is for all parties involved to revert to the last commonly and unarguably fully agreed-to method of communication, which is most likely fax in the US.
- jabroni_salad 3y ago
  which is hilarious, since both companies are probably using a fax gateway anyhow. You end up with email-> gateway -> real fax -> gateway -> email. This is somehow easier than configuring a dmarc record.

peanut-walrus 3y ago

Looks like this is fixed for Outlook.com > Microsoft confirmed the vulnerabilities (with severity “Important”, the highest severity assigned to email spoofing bugs) and awarded us a bug bounty. They have partially fixed the issues by rejecting spoofed email messages purporting to be from domains that have a DMARC policy of REJECT However, I could still replicate this on an o365 domain, so this attack would still work if attacker has access to an o365 domain.