SMTP Smuggling Lets Spoofed Emails Bypass Protections

A novel attack technique known as SMTP Smuggling has been discovered, allowing hackers to bypass traditional email authentication protocols and send spoofed emails from trusted domains. This technique, uncovered by Timo Longin, a senior security consultant at SEC Consult, exploits vulnerabilities in the Simple Mail Transfer Protocol (SMTP), which is used for email communication across the internet.

In an explanation to Dark Reading, Longin stated, "SMTP smuggling is a novel email spoofing technique, which allows attackers to send emails with fake sender addresses to pose as someone else." He further emphasized the risk this poses to enterprises, as it enables advanced phishing attacks that can deceive employees into believing the emails are from known, trustworthy sources.

SMTP Smuggling arises from differences in how outbound and inbound SMTP servers interpret the end-of-message data sequence. This discrepancy enables attackers to insert arbitrary SMTP commands or send separate emails, effectively evading security checks like SPF, DKIM, and DMARC, which are designed to prevent such spoofing.

The impact of this vulnerability is significant, as it could be used to impersonate millions of trusted domains, including those originating from Microsoft, Amazon, PayPal, and Mastercard.

The researchers were also able to confirm that SMTP Smuggling was possible with popular email hosting services Microsoft Exchange Online, GMX, and Cisco Secure Email Gateway. Microsoft and GMX have addressed the issue with patches, but Cisco Secure Email Gateway remains potentially susceptible and requires organizations to perform some manual changes to their configuration to mitigate the threat.

Thankfully, the necessary change is small — all that needs to be done is to switch the CR and LF Handling setting to “Allow”. This development underscores the importance of continuous vigilance and regular security assessments to identify and mitigate emerging threats in email infrastructure.