Split Tunnel SMTP Exploit Bypasses Email Security Gateways

Attackers can inject malicious payloads directly to email server via email encryption appliances, Securolytics says.

Many organizations, especially in sectors like healthcare, use onsite or hosted encryption appliances to protect their email against compromise. That could be a problem.
Security vendor Securolytics this week
claimed
it has devised an exploit that allows an attacker to bypass an organizations email security gateway and directly unload malware on the email server by using the encryption device as a backdoor.
The so-called Split Tunnel SMTP Exploit works against pretty much any email encryption device—virtual, hosted or in-house—that accepts inbound SMTP and theres very little anyone can do to stop it, according to the company. Attackers can use the exploit to inject any payload that supports MIME encoding including ransomware, macro viruses and password protected ZIP files.
The exploit, says Vikas Singla, CEO of Securolytics, takes advantage of the fact that an email encryption appliance has a publicly accessible IP address and is able to receive and transfer emails. Such devices are typically deployed beyond the enterprise firewall and are often used in conjunction with an email security gateway.
Singla says that during an engagement at a healthcare customer site Securolytics discovered an attacker could completely bypass the email security gateway by connecting directly to the encryption appliance. The appliance simply decrypts and routes the emails it receives to the email server without checking it for malware.
So, an attacker who is able to discover the publicly accessible IP address of an encryption gateway can send malware-laden messages directly to the email server through the encryption gateway, without touching the security appliance at all, Singla says.
In some configurations, the email encryption appliance is deployed in front of the security gateway to decrypt encrypted mail, and to forward it to the security gateway, which then inspects the decrypted email for malware before sending it to the email server.
Even in such situations, an attacker who is able to connect directly to the encryption appliance can inject a rogue message into it. When the security gateway receives the message and inspects it for malware, it will typically do so using the encryption devices IP address and not the original senders IP address, Singla says. This gives an opening for an attacker to get messages containing malicious payloads and links past the email security gateway.
Singla says Securolytics tested the exploit against two organizations and was able to bypass email security controls in both cases and have malicious email reach the email server. Because Securolytics used an invalid mailbox for both tests, the target server bounced back the emails.
One of the simulated attacks involved a 400-employee hospital using Microsoft Exchange, an onsite email encryption product, and an email security gateway appliance.
Securolytics researchers used an automated script to map out the target organizations email infrastructure and the delivery routes for email. It then used a brute force attack to find the encryption appliances IP address. Once the researchers had the information they used another scanner to see if any of the uncovered mail transfer agents had Port 25 open.
The researchers first sent an email with a benign payload to an invalid address within the targets domain to figure out how the security gateway and internal mail servers handled incoming mail. They then sent a message with a malicious payload to verify the security gateway was working properly. Finally, they resent the same message with the same payload and from the same IP address, but directed it to the encryption appliance instead.
The device received the malicious email, accepted it and forwarded the mail directly to the email server which then attempted to deliver it to the invalid inbox before bouncing it back.
The same thing happened when Securolytics carried out the simulated attack against an 11,500-employee healthcare system. In this case, the organization had deployed Office 365 behind a hosted email encryption device. Even with Microsofts Exchange Online Protection turned on the organization was unable to prevent a malicious email sent directly to the encryption appliance from reaching the mail server.
The Split Tunnel SMPT attack does not work if port 25 is closed. The two attacks we show require port 25 to be open on the targets [Mail Transfer Appliance], says Singla.
Our initial thought was that organizations could close port 25, he says. But we found the encryption server requires, by design, port 25 to be open so they can receive email from other encryption MTAs. Singla says. Securolytics is now testing to see if the attack works for configurations where the encryption appliance sits behind the security gateway.
The only way for organizations using encryption appliances to mitigate the threat is to disable transparent gateway-to-gateway encryption, according to Securolytics. Email encryption product vendors often use transparent encryption to make it easy for organizations to send and receive encrypted emails without needing to modify anything.
Related stories:
Email Encryption On The Rise But Still Not Universal
How Many Layers Does Your Email Security Need?
7 Tips For Mitigating Phishing And Business Email Attacks

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Split Tunnel SMTP Exploit Bypasses Email Security Gateways