Sebastian Salla

Founder & CEO at • Cloud Security Architect at Palo Alto Networks • Finding ways to sneak into your Inbox

[Sebastian Salla @sebsalla]

In my latest security research I found that due to severe misconfigurations, I was able to deliver SPF authenticated emails on behalf of the Ukrainian MoD, MIT and 1000+ others.
https://t.co/rUEKC94H5Q

[Sebastian Salla @sebsalla]

Next week I'll be presenting two talks at two conferences! If you're at the AWS Public Sector Summit in Canberra or CrikeyCon in Brisbane, please come by and say hello!

AWS Public Sector Summit Talk: Cloud-focused security for speed and scale
CrikeyCon Talk: The Art of Phishing

[Sebastian Salla @sebsalla]

@dkulshitsky Thanks Dmitry! After reviewing many of the SPF records, quite a few seem to be a simple mistake. Perhaps whoever implemented the record had enough understanding that an SPF needed to be implemented but not enough to know what the "+all" mechanism did.

[Sebastian Salla @sebsalla]

Checkout our latest blog post! After scanning 1.7 million Australian domains we found 1.62 million SPF and DMARC security issues. 542 domains were misconfigured to such an extent that any public IP address could send SPF authenticated emails as them!
https://t.co/AxgCrE9v3W

[Sebastian Salla @sebsalla]

@thomas_federer Glad to hear! I imagine the findings are pretty juicy :)

[Sebastian Salla @sebsalla]

Over the past month I've been researching IP-takeover vulnerabilities specific to email sender supply chains. After some initial testing I decided scan 1.8 Million Australian domains... and found some pretty interesting results. Check it out the blog!
https://t.co/M4p7bIXL57

[Sebastian Salla @sebsalla]

I've just made CanIPhish's email templates public. Check them out! https://t.co/OaWJYtYRnX

[Sebastian Salla @sebsalla]

Maintaining control over all the IPs in your SPF record are crucial to ensuring you're not vulnerable to IP takeover attacks!

[ZDNET @ZDNET]

Check your SPF records: Wide IP ranges undo email security and make for tasty phishes https://t.co/uXM2fFFtfr by @dobes

[Sebastian Salla @sebsalla]

I learnt something new just now. If you want the #privacy protection of DuckDuckGo but your search results from #Google then just prepend "!Google" to your DuckDuckGo search. Et voila, your google search gets laundered and your privacy remains respected.

[Tavis Ormandy @taviso]

I finally wrote a small tool I've wanted for a long time: A parallel testcase minimizer. It's called halfempty, and I'm already finding it useful as part of my fuzzing workflow. /cc @lcamtuf https://t.co/SIC2y0k0p0

[Have I Been Pwned @haveibeenpwned]

New breach: Online booking service FlexBooker had 3.7M accounts breached last month. Data included email addresses, names, phone numbers and for some accounts, partial credit card data. 69% were already in @haveibeenpwned https://t.co/LGaAnj1hUA

[kevin @CybrXx0]

Compromising the email supply chain of 190 Australian organisations through a single IT Managed Service Provider via /r/netsec https://t.co/cnXyWWFa7A #cybersecurity #netsec #news

[Tim Medin @TimMedin]

What a brilliant idea!
Phishious provides the ability to see how various Secure Email Gateway technologies behave when presented with phishing material.
https://t.co/mBEyoDkP17