Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Check out the TLS SNI exploit. The attack allows embedding CRLF in a TLS payload. The entire handshake leading up to it is ignored by an SMTP server, and the next command is valid SMTP. Meaning that if you ask something to e.g. load an image from, or send a callback to "https://smtp.targetcorp.com<space><CR><LF>...smtp instructions to send mail here...:25/" it'll actually work. As far as I understand this is the TLS handshake so even before any HTTP is done; post, get, whatever. All works.

Good moment to lock down outgoing requests, I guess. At least to port 25 :)



I've not communicated with SMTP servers manually all that much, but I remember my ISP's SMTP server would just close the connection if you sent it something it didn't understand.


That sounds like most SMTP servers - they just reject what they don't understand.

The wrinkle here that might be, in the opinion of some, worth noting is that this gives SMTP servers something they understand fully. The HTTP server has been convinced to send perfectly well-formed and valid SMTP commands.


Wait, how does "targetcorp.com<space>etc" even DNS resolve? Trying to wrap my head around this one.


That’s covered in the slides. Check Glibc section on gethostbyaddr().


That sounds like a good second mitigation then. Only allow known HTTP ports.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: