In my latest security research I found that due to severe misconfigurations, I was able to deliver SPF authenticated emails on behalf of the Ukrainian MoD, MIT and 1000+ others.
https://t.co/rUEKC94H5Q
Next week I'll be presenting two talks at two conferences! If you're at the AWS Public Sector Summit in Canberra or CrikeyCon in Brisbane, please come by and say hello!
AWS Public Sector Summit Talk: Cloud-focused security for speed and scale
CrikeyCon Talk: The Art of Phishing
@dkulshitsky Thanks Dmitry! After reviewing many of the SPF records, quite a few seem to be a simple mistake. Perhaps whoever implemented the record had enough understanding that an SPF needed to be implemented but not enough to know what the "+all" mechanism did.
Checkout our latest blog post! After scanning 1.7 million Australian domains we found 1.62 million SPF and DMARC security issues. 542 domains were misconfigured to such an extent that any public IP address could send SPF authenticated emails as them!
https://t.co/AxgCrE9v3W
Over the past month I've been researching IP-takeover vulnerabilities specific to email sender supply chains. After some initial testing I decided scan 1.8 Million Australian domains... and found some pretty interesting results. Check it out the blog!
https://t.co/M4p7bIXL57
I learnt something new just now. If you want the #privacy protection of DuckDuckGo but your search results from #Google then just prepend "!Google" to your DuckDuckGo search. Et voila, your google search gets laundered and your privacy remains respected.
I finally wrote a small tool I've wanted for a long time: A parallel testcase minimizer. It's called halfempty, and I'm already finding it useful as part of my fuzzing workflow. /cc @lcamtuf https://t.co/SIC2y0k0p0
New breach: Online booking service FlexBooker had 3.7M accounts breached last month. Data included email addresses, names, phone numbers and for some accounts, partial credit card data. 69% were already in @haveibeenpwned https://t.co/LGaAnj1hUA
Compromising the email supply chain of 190 Australian organisations through a single IT Managed Service Provider via /r/netsec https://t.co/cnXyWWFa7A #cybersecurity#netsec#news
What a brilliant idea!
Phishious provides the ability to see how various Secure Email Gateway technologies behave when presented with phishing material.
https://t.co/mBEyoDkP17