New vulnerability discovered in SMTP: protection by eXpurgate

On December 18, the renowned cyber security company SEC Consult published explosive information on a newly discovered attack technique called “Simple Mail Transfer Protocol (SMTP) Smuggling”. This method allows attackers to bypass security mechanisms and send fake emails that are processed deceptively by affected email systems.

Background: SMTP Smuggling

SMTP smuggling exploits the different interpretation of the end of an email message by different SMTP implementations. Emails are manipulated in such a way that they are split into several parts when passing through a vulnerable email system. This enables attackers to send forged emails that avoid various security mechanisms. These include spoofing sender information and bypassing mechanisms to ensure the authenticity of a message such as SPF, DKIM and DMARC.

Dangers and risks: social engineering and phishing

Exploiting differences in the interpretation of sequences between outgoing and incoming SMTP servers allows attackers to send spoofed emails in the name of trusted domains. This opens the door to various types of social engineering and phishing attacks.