{"id":112410,"date":"2023-12-22T03:10:14","date_gmt":"2023-12-22T01:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij"},"modified":"2023-12-22T03:10:14","modified_gmt":"2023-12-22T01:10:16","slug":"smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","title":{"rendered":"SMTP Smuggling \u2014 a new email spoofing technique","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from SEC Consult have published a new spoofing technique caused by inconsistencies in the adherence to specifications across different implementations of the SMTP protocol. The proposed attack method allows a single message to be split into several different messages when transmitted from one SMTP server to another, which interprets the sequence for separating messages transmitted over a single connection differently. This method can be used to send fake emails on behalf of other senders in email services that verify the original sender. <\/p>\n

The issue arises because different SMTP servers interpret the end of data sequence differently, which can lead to a single email being split into multiple parts during one session with the SMTP server. The specification for marking the end of an email transmission defines the sequence . (a dot, framed by carriage return and line feed characters). After this sequence, commands for sending another email may follow without breaking the connection. Some SMTP servers strictly adhere to the specification, while others, to ensure compatibility with some rare email clients, also treat sequences like ., ., ., ., 0., and 0. as delimiters. <\/p>\n

The attack hinges on the fact that an email is sent to a first server, which only processes the delimiter \u2018\\r\\n.\\r\\n\u2019, while the body contains an alternative delimiter, such as \u2018\\r.\\r\u2019, followed by commands to send the second message. server<\/a>, which handles only the delimiter . sends an email whose body contains an alternative delimiter, such as ., followed by commands to send a second message. Since the first server strictly follows the specification, it treats the received sequence as a single email. If this email is then sent to a transit server or a recipient server that further perceives the sequence . as a delimiter, it will be processed as two separately sent emails (the second email may be sent on behalf of a user not authenticated via 'AUTH LOGIN', but will appear valid on the recipient's side).

\"SMTP<\/center>
\"SMTP<\/center> <\/p>\n

Examples of SMTP servers and services that allow alternative delimiters include Postfix, Sendmail, MS Exchange Online, and Cisco Secure Email Gateway, while among email services that do not filter incorrect delimiters from emails when addressing other servers are GMX, iCloud, and Microsoft Outlook. <\/p>\n

To address the issue in Postfix versions 3.8.1, 3.7.6, 3.6.10, and 3.5.20, a configuration option called «smtpd_forbid_unauth_pipelining» has been added, which leads to the disconnection of the session when using delimiters that do not comply with RFC 2920 and RFC 5321. Currently, this setting is disabled by default, but it is planned to be enabled by default in the Postfix 3.9 branch, expected to be released in spring 2024. The 3.9 branch will also include the setting smtpd_forbid_bare_newline, which will return an error when only a newline character («\n») is used to separate lines, violating RFC 5321. <\/p>\n

In the upcoming release of Sendmail 8.18.0.2, an option ‘o’ has been proposed in srv_features for protection against attacks, which enables the processing of only the «\r\n.\r\n» sequence. It is noted that disabling support for alternative delimiters may disrupt the functioning of some rare mail clients that do not fully comply with the SMTP specification.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0440\u0430\u0441\u0449\u0435\u043f\u0438\u0442\u044c \u043e\u0434\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u043d\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u043f\u0440\u0438 \u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c SMTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 SMTP-\u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e \u0438\u043d\u043e\u043c\u0443 \u0442\u0440\u0430\u043a\u0442\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0438\u0441\u0435\u043c, \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u043d\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435. \u041c\u0435\u0442\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":112411,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SMTP Smuggling \u2014 a new technique for spoofing email messages | ProHoster","description":"Researchers from SEC Consult have published a new spoofing technique caused by discrepancies in compliance with the specification in various implementations of the SMTP protocol.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47SMTP Smuggling \u2014 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 SEC Consult \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u0441\u043f\u0443\u0444\u0438\u043d\u0433\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u0443\u044e \u0440\u0430\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u0432 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SMTP.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/smtp-smuggling-novaya-tehnika-spufinga-pochtovyh-soobshhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-22T01:10:16+00:00","article:modified_time":"2023-12-22T01:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/112410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=112410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/112410\/revisions"}],"predecessor-version":[{"id":172924,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/112410\/revisions\/172924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/112411"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=112410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=112410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=112410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}