Exploiting the Trust Hierarchy among Email Systems - Ximenes, Pablo; Santos, André dos (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2008: Anais do VIII Simpósio Brasileiro de Segurança da Informação e de Sistemas ComputacionaisDO - 10.5753/sbseg.2008.20887, 2008)
This paper presents a critique of the current status of the trust hierarchy found among SMTP based email systems. We evaluate current trends and present real evidence that the prevalence of ad-hoc initiatives for trust classification is a potential risk in itself. In that sense, we describe a vulnerability found in Google’s free email service (Gmail) that allows an attacker to exploit the current trust hierarchy that exists between email providers in order to assemble powerful spam/phishing attacks. We demonstrate this vulnerability by crafting a proof of concept attack software that is able to send whitelisted open relayed unlimited spam and phishing messages through Google’s email servers, thus giving concrete evidence of the presented threat.