5 ms·

Everything is feasible except the faked linkedin email - it wouldn't pass SPF and so I'm pretty sure gmail would junk it.

chmars 13y ago
In my experience, SPF has never lived up to it's promised and it's just one of many factors to create a spam/ham score. There are just too many SPF issues with many mail address to use SPF alone to filter an otherwise normally looking mail.
maccam94 13y ago
I can confirm I get spam emails to my gmail inbox that fail SPF. But none of them are claiming to be from highly-visible sites like LinkedIn.
adwf 13y ago
Did he say he was on gmail? Maybe I didn't catch that part. That's an interesting decision for a security-minded person to make though. Do I use gmail as they'll have broad statistical analysis of attack vectors? Or do I use my own mail server which may not have the same features, but is more secure/private in other ways?
thaumaturgy 13y ago
Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail! But, I don't think this is common behavior, and the article doesn't actually say that the target has a Gmail account.
- krick 13y ago
  > But, I don't think this is common behavior It pretty much is. The actual settings vary between different mail providers and this is actually more complicated than checking header against sender IP. So everything is possible, but that mail-sending part needs more explanation anyway.
- jwcrux 13y ago
  Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.
  - thaumaturgy 13y ago
    Anybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.
    - jwcrux 13y ago
      Ah, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!
      - thaumaturgy 13y ago
        Yep, exactly.
- iambateman 13y ago
  If it's a corporate email account (as is mentioned), Microsoft is a much likelier candidate.
revelation 13y ago
The mail was just the CSRF attack vector, anyway. Could've just sent him a random short link over IM..
- afro88 13y ago
  ... that he wouldn't have clicked because who clicks random links over IM
  - pizzeys 13y ago
    Plenty of other ways to catch even the security aware. The obvious, since he knows this person, would be to tweet some 'news link' and have the code only work for Bill. You can be security aware and not be perfect 100% of the time.
dailycrud 13y ago
In the comments section of the original article, the attacker (Phikshun) notes that he worked at the same company as his victim, so he was able to test the phish on himself to make sure it passed through that company's email security.
thefreeman 13y ago
Not to mention who actually clicks those LinkedIn emails...
vxNsr 13y ago
He addresses this in the comments of the article[0]: >Aaron says: >April 5, 2014 at 3:52 pm >So how’d you sucker Bill into clicking your exploit link? Since you hadn’t yet hijacked his DNS, I presume the link didn’t (couldn’t) actually point to linkedin.>com — shouldn’t his mail client have warned him? (Mine would.) >>Reply >>Phikshun says: >>April 5, 2014 at 5:35 pm >>See this video by Raphael Mudge[1]. He does a much better job of explaining it than I would. I also had another advantage — Bill and I worked for the same company at the >>time, so I could send the phish to myself to make sure it passed all the filters. This isn't so unrealistic though. An advanced adversary will scour RFPs, public records and >>job postings to learn what protection technologies a company has and attempt to duplicate their environment for testing. [0]http://disconnected.io/2014/03/18/how-i-hacked-your-router/comment-page-1/#comment-4 http://disconnected.io/2014/03/18/how-i-hacked-your-router/c... [1]http://www.youtube.com/watch?v=OO_A8NHNBj8 http://www.youtube.com/watch?v=OO_A8NHNBj8
gnud 13y ago
I was honestly more surprised anyone clicked anything in a linkedin email - isn't linkedin automatically sent to spam?
larrys 13y ago
"Everything is feasible except" Perhaps someone could comment on the possible prison time if an approach like this was taken without the authorization that this person had in advance? Also it would seem that it would be fairly easy if you are in physical proximity to the target to use social engineering (as opposed to a bump key - opening the front door) to gain physical access to the premises and find the wifi password right under the router. Or plant something on the network that gives you access - you get the picture. Or plant a keylogger that might not be noticed for months. Or drop a USB key (wouldn't work with an infosec guy but maybe if it was mailed to him and it looked like it came from a reliable source it would).
somerandomness 13y ago
It's feasible if the target didn't use Gmail.

chmars 13y ago

In my experience, SPF has never lived up to it's promised and it's just one of many factors to create a spam/ham score. There are just too many SPF issues with many mail address to use SPF alone to filter an otherwise normally looking mail.

maccam94 13y ago

I can confirm I get spam emails to my gmail inbox that fail SPF. But none of them are claiming to be from highly-visible sites like LinkedIn.

adwf 13y ago

Did he say he was on gmail? Maybe I didn't catch that part. That's an interesting decision for a security-minded person to make though. Do I use gmail as they'll have broad statistical analysis of attack vectors? Or do I use my own mail server which may not have the same features, but is more secure/private in other ways?

thaumaturgy 13y ago

Well, I was all set to explain that SPF only checks the envelope sender, not the from: address header that is displayed to the user. Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail! But, I don't think this is common behavior, and the article doesn't actually say that the target has a Gmail account.

krick 13y ago
> But, I don't think this is common behavior It pretty much is. The actual settings vary between different mail providers and this is actually more complicated than checking header against sender IP. So everything is possible, but that mail-sending part needs more explanation anyway.
jwcrux 13y ago
Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.
- thaumaturgy 13y ago
  Anybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.
  - jwcrux 13y ago
    Ah, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!
    - thaumaturgy 13y ago
      Yep, exactly.
iambateman 13y ago
If it's a corporate email account (as is mentioned), Microsoft is a much likelier candidate.

revelation 13y ago

The mail was just the CSRF attack vector, anyway. Could've just sent him a random short link over IM..

afro88 13y ago
... that he wouldn't have clicked because who clicks random links over IM
- pizzeys 13y ago
  Plenty of other ways to catch even the security aware. The obvious, since he knows this person, would be to tweet some 'news link' and have the code only work for Bill. You can be security aware and not be perfect 100% of the time.

dailycrud 13y ago

In the comments section of the original article, the attacker (Phikshun) notes that he worked at the same company as his victim, so he was able to test the phish on himself to make sure it passed through that company's email security.

thefreeman 13y ago

Not to mention who actually clicks those LinkedIn emails...

vxNsr 13y ago

He addresses this in the comments of the article[0]: >Aaron says: >April 5, 2014 at 3:52 pm >So how’d you sucker Bill into clicking your exploit link? Since you hadn’t yet hijacked his DNS, I presume the link didn’t (couldn’t) actually point to linkedin.>com — shouldn’t his mail client have warned him? (Mine would.) >>Reply >>Phikshun says: >>April 5, 2014 at 5:35 pm >>See this video by Raphael Mudge[1]. He does a much better job of explaining it than I would. I also had another advantage — Bill and I worked for the same company at the >>time, so I could send the phish to myself to make sure it passed all the filters. This isn't so unrealistic though. An advanced adversary will scour RFPs, public records and >>job postings to learn what protection technologies a company has and attempt to duplicate their environment for testing. [0]http://disconnected.io/2014/03/18/how-i-hacked-your-router/comment-page-1/#comment-4 http://disconnected.io/2014/03/18/how-i-hacked-your-router/c... [1]http://www.youtube.com/watch?v=OO_A8NHNBj8 http://www.youtube.com/watch?v=OO_A8NHNBj8

gnud 13y ago

I was honestly more surprised anyone clicked anything in a linkedin email - isn't linkedin automatically sent to spam?

larrys 13y ago

"Everything is feasible except" Perhaps someone could comment on the possible prison time if an approach like this was taken without the authorization that this person had in advance? Also it would seem that it would be fairly easy if you are in physical proximity to the target to use social engineering (as opposed to a bump key - opening the front door) to gain physical access to the premises and find the wifi password right under the router. Or plant something on the network that gives you access - you get the picture. Or plant a keylogger that might not be noticed for months. Or drop a USB key (wouldn't work with an infosec guy but maybe if it was mailed to him and it looked like it came from a reliable source it would).

somerandomness 13y ago

It's feasible if the target didn't use Gmail.