Later archive addition

Composition Kills: 18 Attacks on Email Sender Authentication

Jianjun Chen, Vern Paxson and Jian Jiang

Inconsistent message parsing between the components of email systems lets attackers bypass SPF, DKIM, and DMARC to impersonate arbitrary senders and forge DKIM-signed mail with a legitimate site's signature. Manual analysis plus black-box fuzzing found 18 evasion techniques that worked against 10 email providers and 19 clients, all vulnerable.

Record

Researcher

Jianjun Chen, Vern Paxson and Jian Jiang

In the archive

• Added to the 2020 archive after the original list was published

Related sources

• Tool
• Paper project page
• Talk recording
• Talk recording

Tags

• email
• smtp
• parser-differential
• auth-bypass
• injection
• fuzzing
• measurement-study
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Jianjun Chen, Vern Paxson and Jian Jiang, first published at the original source. Preserved copies are kept so the citation survives its host.