Ropemaker Allows Attackers to Change the Content of an Email—After It's Delivered

itman · Aug 22, 2017

I was just reading a web posting yesterday how this activity occurred to a corp. user. Somehow malware had managed to change the bank account numbers in an outgoing e-mail and he had no clue how it happened. At least now, he has a clue.

A new email exploit, dubbed Ropemaker, allows a malicious actor to edit the content in an email—after it’s been delivered to the recipient and made it through the necessary filters.

For instance, an attacker could swap a benign URL with a malicious one in an email already delivered to an inbox, or edit any text in the body of an email whenever they want—all without direct access to that inbox.

First uncovered by Mimecast’s research team, a successful exploit could even undermine those that use SMIME or PGP for signing.

“The origin of Ropemaker lies at the intersection of email and Web technologies, more specifically Cascading Style Sheets (CSS) used with HTML,” explained Matthew Gardiner, a spokesperson at Mimecast, in a blog. “While the use of these web technologies has made email more visually attractive and dynamic relative to its purely text-based predecessor, this has also introduced an exploitable attack vector for email.”

He added, “Ropemaker could be leveraged in ways that are limited only by the creativity of the threat actors, which experience tells us, is often unlimited.”
Click to expand...

https://www.infosecurity-magazine.com/news/ropemaker-change-content-email/

Peter2150 · Aug 22, 2017

Interesting article, but doesn't give any info about how it would access the inbox

itman · Aug 22, 2017

E-week has a few more details here: http://www.eweek.com/security/ropemaker-email-exploit-exposes-desktop-clients-to-security-risks along with the following mitigation I already use in my e-mail client:

For desktop email client users, there are a few options to help mitigate the risk of a Ropemaker email attack.

"An organization could block all HTML emails, which is a bit draconian, or organizations could use browser-based email clients," Gardiner said. "There aren't what we consider any perfect defenses against it. We believe an email industry dialogue is needed to address this type of application exploit."
Click to expand...

Also this tidbit:

Mimecast responsibly disclosed the Ropemaker vulnerability to both Apple and Microsoft in late 2016. Neither Apple nor Microsoft, however, sees the issue as a vulnerability that can or should be patched, which is why Mimecast has decided to publicly release its research to help raise awareness of the potential risks. Gardiner commented that he's not surprised that Microsoft and Apple don't consider
Click to expand...

Mimecast has a whitepaper supposedly with all the details. Of course, you have to register for it.

Rmus · Aug 23, 2017

itman said: ↑

https://www.infosecurity-magazine.com/news/ropemaker-change-content-email/
Click to expand...

“While the use of these web technologies has made email more visually attractive and dynamic relative to its purely text-based predecessor, this has also introduced an exploitable attack vector for email.”
Click to expand...

Wow! The dangers of HTML email have been talked about since the 1990s...so nothing new here, except the CSS trickery.

I suppose organizations have to use HTML email, I don't know... but home users can use a text-based email program.

----
rich

Rmus · Aug 23, 2017

itman said: ↑

E-week has a few more details here: http://www.eweek.com/security/ropemaker-email-exploit-exposes-desktop-clients-to-security-risks
Click to expand...

"There aren't what we consider any perfect defenses against it..."
Click to expand...

"Only those defenses are good, certain and durable, which depend on yourself alone and your own ability." —The Prince, by Niccolo Machiavelli.

----
rich

itman · Aug 23, 2017

Rmus said: ↑

I suppose organizations have to use HTML email
Click to expand...

And "that's the rub" since the majority of phishing attacks, especially spear phishing ones, are targeted toward them.

For home users, the mitigation for this should be directed to ISP's and e-mail providers since they are already scanning all incoming e-mails to their servers.

itman · Aug 23, 2017

Bleepingcomputer.com has a lot more detail on the attack here: https://www.bleepingcomputer.com/ne...-attackers-change-your-emails-after-delivery/

Also this comment:

ROPEMAKER is more hype than danger

While the attack looks scary, in reality, users have very little to fear. This is because most email clients are in the habit of stripping out header tags for emails in HTML format, including any tags calling for remote CSS files.

This practice of header stripping is why most tutorials for writing HTML emails encourage web developers to use only inline CSS and avoid embedded or remote CSS.

Mimecast, who tested ROPEMAKER against various email clients, says that browser-based email interfaces are not affected by the ROPEMAKER attack. Not surprisingly, these interfaces are known to strip header tags as a precautionary measure not to interfere with the page's normal headers.

Furthermore, as one Reddit user points out, "this attack as described would be extremely easy to filter," as sysadmins could just block the loading of remote CSS resources when requested by email clients.

All in all, ROPEMAKER is a clever attack technique but is not that useful in real-world scenarios.
Click to expand...

Log in or Sign up

Ropemaker Allows Attackers to Change the Content of an Email—After It's Delivered

itman Registered Member

Peter2150 Global Moderator

itman Registered Member

Rmus Exploit Analyst

Rmus Exploit Analyst

itman Registered Member

itman Registered Member

Log in or Sign up

Ropemaker Allows Attackers to Change the Content of an Email—After It's Delivered

itman Registered Member

Peter2150 Global Moderator

itman Registered Member

Rmus Exploit Analyst

Rmus Exploit Analyst

itman Registered Member

itman Registered Member

Useful Searches