Rackspace Hosted Email Flaw Actively Exploited by Attackers

guest · Nov 5, 2020

Rackspace Hosted Email Flaw Actively Exploited by Attackers
Fraudsters Have Been Using SMTP Multipass Flaw for Business Email Compromise Schemes
November 5, 2020
https://www.inforisktoday.com/rackspace-hosted-email-flaw-actively-exploited-by-attackers-a-15309

Attackers have been actively exploiting a flaw in Rackspace's hosted email service to send phishing emails, bearing legitimate and validated domain names, as part of business email compromise scams.

So warns 7 Elements, an IT security testing consultancy based in Edinburgh, Scotland, which says that attackers have been using what it's dubbed as an "SMTP Multipass" attack - SMTP refers to simple mail transfer protocol - since it's designed to subvert multiple accounts and bypass DNS-based defenses against spoofed emails.
All organizations that use Rackspace's hosted email services appear to have been vulnerable to having their email domains get misused in this manner.
Click to expand...

Coordinated Disclosure
As noted, 7 Elements says one of its clients received a phishing email - tied to a BEC scheme - on July 20. After investigating, the firm said it was able to identify and reproduce the SMTP Multipass flaw about 10 days later.
Technical Details
Specifically, the flaw subverts sender policy framework, or SPF, which is used to verify that an email has originated from a genuine sender, using a domain's DNS records to ensure that the IP address from which the email has been sent is doing so on behalf of the genuine domain, according to a full technical teardown of the flaw released by 7 Elements on Thursday.
Click to expand...

Log in or Sign up

Rackspace Hosted Email Flaw Actively Exploited by Attackers

guest Guest

Log in or Sign up

Rackspace Hosted Email Flaw Actively Exploited by Attackers

guest Guest

Useful Searches