10 ms·
Starting emails with "BEGIN PGP MESSAGE" will fool the filter
- superkuh 2y agoHere is the content that is in the HTML but which the linked page refuses to actually show on the screen, instead opting for a "run javascript" message: <meta content='Our university deployed a mail filter that rewrites URLs in emails to redirect them via a service that checks for bad websites. Somebody clever worked out that PGP-signed emails are exempt from the rewrite rule, so now people are starting their emails with "BEGIN PGP MESSAGE" even though they haven't used PGP at all, just to fool the filter Anybody sending malware links has probably also worked out that trick by now, thereby rendering the entire filter pointless' name='description'>
- cesarb 2y agoA trick which works if you use Mastodon, since that page is a Mastodon post: Go to the Mastodon instance where you have an account, and paste the URL in the search box. It should load the post within your Mastodon instance (and allow you to boost/favorite/etc), without running any JavaScript from the post's instance. (It won't surprise me if someday a Firefox plugin is created to open these Mastodon post pages without running their JavaScript, by detecting it's Mastodon and going through the same protocol as federated instances to fetch the content. Of course, it would be better if the Mastodon server software didn't require JavaScript for simply showing a post page in the first place.)
- berkes 2y agoNot exactly the plugin you envision, but Graze¹ does this for interaction (boost, favorite, follow, reply etc) with posts on any instance. I guess the redirect and re-open on your own instance would be a feature for graze? IDK. ¹ https://addons.mozilla.org/en-US/firefox/addon/graze/ https://addons.mozilla.org/en-US/firefox/addon/graze/
- cwillu 2y agoThank you.
- ethbr1 2y agoIMHO, there's definitely some security value is at least running a non-standard config. Moving from seeing all attacks (even if blocked) to only targeted attacks decreases the amount of noise a detection system/reviewer has to deal with. The important bit, though, is remembering only the above doesn't mean things that make it through are secure, which is usually where companies fall over. (I.e. implement dumb mail filter, then assume any mails that make it through are safe)
- Isognoviastoma 2y agoThanks for sharing! A bit of css, and it's possible to read mastodon posts with a web browser! head {display:block; background:Canvas; color:CanvasText;} meta[content] {display:block; padding-bottom:1em;} meta[content]::after{content:attr(content); display:block;}
- o11c 2y agoOr just append /embed The disadvantage is that threads don't render.
- superkuh 2y agoThe fact that the mastodon devs put the content in the HTML but refuse to show the content tells me everything I need to know about mastodon. It may even be worse than twitter. Generally I will not go out of my way to use or view such links. I just close the tabs.
- cesarb 2y agoIn my experience, Mastodon (and other relatives from its family) is much better than current Twitter, at least for non-logged-in users. On Mastodon, as long as you enable JavaScript, you can see the whole thread for the post, while Twitter (which also needs JavaScript) only shows the initial post; and if you go to an account's page, Mastodon shows the whole timeline in reverse-chronological order (which is generally what you want), while Twitter shows old posts in a random order.
- superkuh 2y agoI understand that POV and within it's context I agree. But to a non-JS user they are equivalent (Mastodon and Twitter) in functionality: blank pages telling you to execute random code. Very similar to phishing emails telling one to execute the random code attachment. Twitter has to be bad by virtue of being a corporation driven by profit motive and requiring JS to collect and sell user data. Mastodon doesn't have to be crap since it is not required to generate maximum profit. It just chooses to be as shown from the content being in the HTML but hidden. This makes Mastodon worse. Either it's malicious or, more likely, incompetent cargo culting of corporate practices. Devs unable to separate themselves from the use-cases they have to develop for at their paid jobs or lacking the knowledge to do so.
- deleted 2y ago[deleted]
- bongodongobob 2y agoTried this with my work email, it doesn't seem to work with whatever our exchange setup is. Is this just a case of an admin using the default settings in their filtering?
- layer8 2y agoIt’s a custom filter deployed at that university.
- jeffbee 2y agoThere was a time when prefacing your message with `begin 644` would hide your message, or the remainder of it, from users of MS Outlook. Maybe still works, who knows.
- g4zj 2y agoI don't know much about mail servers, but would it be possible to validate the signature somehow before delivering the message? Is this impossible or impractical for some reason?
- deleted 2y ago[deleted]
- thenewnewguy 2y agoEven if they did, you could just sign the message for real.
- upofadown 2y agoEmail signatures are essentially end to end. The company would have to keep a file of all the identities of all the people that everyone in the company knew. To make this useful, the company would also have to record information about who knew who. As already mentioned, the email might also be encrypted (the most common case). Then the signature would not be available as it would be hidden under the encryption. These sorts of filtering issues are why corporate cybersecurity people, somewhat ironically, tend to dislike encrypted email. There is an opportunity here to make better email clients that treat encrypted, but unsigned, emails with suspicion.
- layer8 2y agoThere is commercial mail server software that does exactly that.
- cmgbhm 2y agoPGP doesn’t require the use of global directories so you can’t do strong validation. This is a bypass game on something like proof point url protection that rewrites URLs to go through a central redirect so that reputation check can be separated from reputation delivery, usage detected, and one liner URLs still work. I’m over a decade out of this space so take with a grain of salt. The tool could do a better job inspecting “oh that’s a pgp formatted massage”. You could probably just route them all to spam and almost no one would notice.
- swyx 2y agoobligatory https://xkcd.com/1181/ https://xkcd.com/1181/
- gramakri2 2y agoheh, I am awed by the foresight of the author !
- Hizonner 2y agoThere is a special place in Hell for people who "helpfully" rewrite email bodies in transit.
- CuriousCosmic 2y agoStares aggressively at Protonmail. Yeah you at Proton. I'm talking to you. Stop doing this. No touchy the email.
- jimbosis 2y agoDo you or does anyone else have a summary of or any link to read about what you are alluding to, namely Proton Mail rewriting email bodies?
- super_linear 2y agohttps://news.ycombinator.com/item?id=36639530 https://news.ycombinator.com/item?id=36639530
- ChainOfFools 2y agodoesn't this break DKIM?
- 256_ 2y agoDKIM headers can have an optional length parameter which says "the first n bytes of the message body is cryptographically signed", whilst allowing the rest of the message to be modified. I don't know if anyone actually uses it, though; I don't think I've ever seen or used it. Also, DKIM can optionally be lax about whitespace.
- megous 2y agoThat sounds like something that can interact really well with HTML email, if you can manage to overlay the unsigned content over signed content visually via CSS/inline styles. :)
- deleted 2y ago[deleted]
- ethbr1 2y agoIn my experience, the vast majority of corporate mail filters ban certain file types based on name extensions. Fewer, but some, inspect files to deduce their type. None care about encrypted zips with the file renamed to a common extension (encrypted zip manifests are unencrypted, so the file names are still visible).
- stvltvs 2y agoThere is a way to cajole zip into encrypting filenames if this is important enough to put up with unzipping twice. Plus you might get better compression! https://unix.stackexchange.com/questions/289999/how-to-zip-directory-with-encryption-for-file-names#290088 https://unix.stackexchange.com/questions/289999/how-to-zip-d...
- godelski 2y agoAnd many people have learned to bypass these filters by renaming extensions. You can always zip things up or just rename foo.py to foo.py.pdf But I understand that there is still reason to filter filetypes. Apparently some programs will run programs if they see certain filetypes... Here's a recent telegram exploit where the user did have to click on the file https://www.bitdefender.com/blog/hotforsecurity/telegram-patches-zero-day-python-script-vulnerability-in-windows-client/ https://www.bitdefender.com/blog/hotforsecurity/telegram-pat...
- mrkramer 2y agoHug of death?
- godelski 2y agoWell it looks like the link is down and the only archive snapshot I see is a loading screen: https://archive.is/obzJ9 https://archive.is/obzJ9 ----- BEGIN EDIT ----- I can see it from the mastadon app but not in browser. I took a screenshot for others: https://i.imgur.com/q3DA7wQ.png https://i.imgur.com/q3DA7wQ.png Text is: Our university deployed a mail filter that rewrites URLs in emails to redirect them via a service that checks for bad websites. Somebody clever worked out that PGP-signed emails are exempt from the rewrite rule, so now people are starting their emails with "BEGIN PGP MESSAGE" even though they haven't used PGP at all, just to fool the filter Anybody sending malware links has probably also worked out that trick by now, thereby rendering the entire filter pointless @martin@nondeterministic.computer ----- END EDIT ----- But I have an interesting issue which is (presumably) related. I keep getting obviously spam emails in my gmail and Google has refused to do anything about it (after finally getting through to support). These are embarrassingly bad emails. Ones you'd expect a naive bayesian classifier to get near 100% accuracy on! In the "to" address is something that's not even remotely my email. Suppose I'm godelski@gmail.com, the "to" has something like "robbert01@gmail.com" and always has a CC with a different number. Subject lines will be things like "confirmation of receipt" but in non-standard and inconsistent fonts. And the message body is that all too typical single image and claim of something like winning a home depot gift card. The "from" address is always some scammy looking address. So Naive Bayes should get it on just this alone! But the weird thing is when you show the original message. There's PAGES of stuff in here (about 20 pages or 9.5k words)! All kinds of email conversations, things including stuff like "here is your one time <account> password", stuff in other languages, survey questions, conversations, and a lot more. I actually did a diff on a few of these and they're almost identical too! I can't help but think that these are some weird prompt injections. It looks like it is written by a madman, but it it's probably some "throw shit at the wall and see what sticks" kinda thing. But the message ID always comes from some Microsoft (something like microsoftstore1.microsoft.com). This is where Google support said it isn't their problem and moved on. I'm pretty critical of LLMs and their ability to reason, but I feel often we're trying to turn humans into machines instead of letting them complement one another. And I think this is why so many business people like LLMs, because they think everything can be figured out with clear immutable rules. But the thing is that the environment always changes and you need something that's not only adaptable, but can reason AND understands the actual desired outcome that humans want. I hope someone at Google pays attention. Because you can't just hand all thinking over to humans. We're not there yet and it's why everything is going to shit (not just Google)
- jamespo 2y agoI've recently had to zero score SpamAssassin ENCRYPTED_MESSAGE rule as it's being exploited. Also I don't receive any encrypted messages.
- stuffinmyhand 2y ago> Also I don't receive any encrypted messages. Should start giving people your public key then!
- psd1 2y agoYes, and email address.
- acidx 2y agoDetails are hazy as this was a long time ago, but at some point you could make parts of messages not render in Outlook and Outlook Express by writing "begin something" (two spaces after "begin") by itself in a single line. Outlook would thing that it was the start of an uuencoded block and not render anything after that. I remember annoying friends in a mailing list by quoting emails with "begin quote from Person Name:" :)
- gpderetta 2y agoYes! And I remember that the official recommendation from MS was "do not write begin at the start of a line".
- ale42 2y agoTypical MS...
- anthk 2y agoExcel bugs forced scientists to rename genomes...
- otherme123 2y agoI don't like Excel, but 1) it is a true feature when used as intended in a finantial environment and 2) you shouldn't use Excel to fiddle with genetic data, learn proper tooling, you are supposed to be a pro. Still I think changing user data silently is an error. This is known since at least 2004, with workarounds (https://link.springer.com/article/10.1186/1471-2105-5-80 https://link.springer.com/article/10.1186/1471-2105-5-80), yet people still use Excel instead of learning a bit about proper data storage. In my lab I sent a mail with the steps to harden Excel against this "bug". Want to guess how many did it? Zero.
- TeMPOraL 2y ago> proper data storage Excel is second after Access for bottom-up developed data storage. And since Access is all but gone, it's absolutely not surprising people reach for Excel.
- reidrac 2y agoA few times I got spam with all the text in the signature. And I thought, weird: and it makes the email look funny because the signatures are shown on a different color in my email client. Now I'm thinking if there was some smart idea behind that trying to fool some filters.
- DeathArrow 2y agoIt might fool the University filter but it will trigger the NSA filter.
- lostlogin 2y agoWe’re afraid of the three letter agencies, but their list of failures would suggest that quite a lot gets past them.
- vmfunction 2y agocan you show us the list? Truly interested, seems like the three letter guys are pretty good at what they do.
- voidUpdate 2y agoFailures by the three letter guys? oh boy... Waco and Ruby Ridge are but two
- lostlogin 2y agoEvents with prominent intelligence failures: Pearl Harbour. Yom Kippur war, the Vietnam war defeat, September 11, Manchester Arena, the invasion of Iraq, the fall of Afghanistan, the Hamas attacks (2014, 2021, now). I’m sure there are masses more.
- rootusrootus 2y agoWe'd probably need to know what didn't get past them to get an accurate picture. Maybe the flow is pretty high.
- berkes 2y agoI've never really understood how this 'urls via our own redirector' really works, if at all. I can imagine some reasons why it would work better than merely checking the URLs when filtering: not rewriting but simply checking and scoring against other spam rules. But also see reasons why it secures less well. Pro: you can block URLs post-delivery. E.g. an advisary changes the link to malware or phishing after some time/n requests/based on user agent. Con: all encryption, including DKIM, GPG etc break. Edit: to clarify why I don't understand why this works: and advisary can still do the same: i.e. serve an innocent page to the checker but then a bad webpage to the actual visitor. Not trivial, but not hard either. A good middle ground might be to scan URLs on the mailserver against lists and maybe open the page and scan its content before delivering. Then have the client intercept links and redirect them through another on-demand checker? Because obviously, training people to "not click links in emails" or use only plain text or both, hasn't worked in the last decades.
- Maxion 2y agoThe most funny filters are those that visit the URL to check what it is. Those break all the magic login links, email verification links et. al. that people receive. Really can't understand who approved such things.
- rileymat2 2y agoIn theory, magic links that are only GET and not idempotent are the issue, not the systems/filters hitting them.
- spiffytech 2y agoThis is one of the reasons to adopt magic codes instead of magic links.
- tomschlick 2y agoOr just have your magic link include a "Confirm Login" button once it loads that sends a POST so automated clients don't cause issues.
- dkdbejwi383 2y agoReminds me of a bug from the early 00s in a bunch of router firmware, where the router would crash/reboot on receiving a malformed "DCC SEND" message, so people would spam "DCC SEND ANYLONGSTRINGHAHAPWNED" in large IRC channels and watch as half the participants dropped.
- ltr_ 2y agooh the memories, the CTCP ping with the string "+++ATH0" string on the message, or the `/skin "/con/con"` command on Quake2 online games, and the ";cat /etc/passwd" on old Unix's finger services, fun simpler times, what a mess.
- 1oooqooq 2y agowhy you think that's gone? treating data as privileged input was never out of fashion. last one in memory: google pixels modem accepting AT for custom firmware things from the outside. recommendation was "disable 4G and 3G until update" (which was the first one they delayed)
- kalaksi 2y agoSimilarly, at one time posting "startkeylogger" in IRC would also kill some people's connection because of an antivirus mistaking it for traffic from/for a trojan
- cqqxo4zV46cp 2y agoYep. Then you combined both in the one message for ultimate effectiveness. :)
- anothermoron 2y agoIn early 2000 I was playing a stand alone mod for Unreal Tournament 99 called Tactical Ops. UT99 provided an IRC client right in the game and people used it to coordinate matches, when somebody from nato-ladder (North American Tactical Ops Ladder) discovered that spamming a specific character to a player in private message (or even in public channel where the player was) caused the game to crash with nothing to show in the logs. They used it intelligently during tournament, not overusing it, just making a particular player drop at the right moment and probably abused it for sometime before it became publicly known. I don't remember if this was an issue also present in UT99 or just TO.
- rompledorph 2y agoX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*