4 ms·

Considering how CloudFlare was just implicated in destroying secure email at Defcon [1], the addition of GPUs to that active assault is terrifying. 1. https://

Considering how CloudFlare was just implicated in destroying secure email at Defcon [1], the addition of GPUs to that active assault is terrifying. 1. https://www.youtube.com/watch?v=NwnT15q_PS8 https://www.youtube.com/watch?v=NwnT15q_PS8

drunkendog 3y ago
I believe the secure email issue linked is exploitable by any MailChannels customer, not just Cloudflare Workers.
- ttul 3y ago
  All Workers API calls to MailChannels must send email from a domain that has a Domain Lockdown record authorizing the Worker by its CF-Worker header. Docs are here: https://support.mailchannels.com/hc/en-us/articles/4565898358413-Sending-Email-from-Cloudflare-Workers-using-MailChannels-Send-API https://support.mailchannels.com/hc/en-us/articles/456589835... Since you cannot forge the CF-Worker header in API requests (this header is added by Cloudflare's back end), it is not possible to send email for any domain that hasn't been locked down to your specific Worker.
stri8ted 3y ago
The CloudFlare worker is just being used to make a POST request to MailChannels. How is this a CloudFlare problem?
weird-eye-issue 3y ago
It was Mailchannels, and Cloudflare was only one of the many companies that they fooled into doing an integration. As far as the CF Workers <> Mailchannels integration, the security issues are pretty much fixed now, but I still wouldn't trust Mailchannel
- thereisnojesus 3y ago
  [flagged]
- anonbanker 3y ago
  Watch to the end of the talk I posted. It's only just begun.
ttul 3y ago
Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown. SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure. Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/4565898358413-Sending-Email-from-Cloudflare-Workers-using-MailChannels-Send-API https://support.mailchannels.com/hc/en-us/articles/456589835... Appreciate all the questions and criticism here.

drunkendog 3y ago

I believe the secure email issue linked is exploitable by any MailChannels customer, not just Cloudflare Workers.

ttul 3y ago
All Workers API calls to MailChannels must send email from a domain that has a Domain Lockdown record authorizing the Worker by its CF-Worker header. Docs are here: https://support.mailchannels.com/hc/en-us/articles/4565898358413-Sending-Email-from-Cloudflare-Workers-using-MailChannels-Send-API https://support.mailchannels.com/hc/en-us/articles/456589835... Since you cannot forge the CF-Worker header in API requests (this header is added by Cloudflare's back end), it is not possible to send email for any domain that hasn't been locked down to your specific Worker.

stri8ted 3y ago

The CloudFlare worker is just being used to make a POST request to MailChannels. How is this a CloudFlare problem?

weird-eye-issue 3y ago

It was Mailchannels, and Cloudflare was only one of the many companies that they fooled into doing an integration. As far as the CF Workers <> Mailchannels integration, the security issues are pretty much fixed now, but I still wouldn't trust Mailchannel

thereisnojesus 3y ago
[flagged]
anonbanker 3y ago
Watch to the end of the talk I posted. It's only just begun.

ttul 3y ago

Appreciate the skepticism; it keeps us on our toes. Let's cut to the chase: Domain Lockdown: We added this to our Cloudflare Workers integration. It mandates a DNS TXT record to authorize a Worker to send emails from a specific domain. You can't forge the CF-Worker header, so impersonation is off the table. Pre-Lockdown Vulnerability: Yes, we were more exposed before. Thanks to the researchers who pointed it out, we've patched this up with Domain Lockdown. SMTP Relay & Web Hosting: Domain Lockdown isn’t mandatory yet in the rest of our service for the web hosting industry. But we’re developing updates for our cPanel WHM plugin and other integrations to make this scalable for millions of domains. Scale & Standardization: We service a broad range of configurations. Rolling out universal changes takes time. We're also working with industry groups like M3AAWG to push for improvements to DMARC and other standards to help everyone be more secure. Tech docs for the curious: https://support.mailchannels.com/hc/en-us/articles/4565898358413-Sending-Email-from-Cloudflare-Workers-using-MailChannels-Send-API https://support.mailchannels.com/hc/en-us/articles/456589835... Appreciate all the questions and criticism here.