1 00:00:00,060 --> 00:00:03,240 Our next talk comes from Turkey. 2 00:00:03,520 --> 00:00:15,550 It is with great pleasure to welcome and introduce you to Oskan Mustafa Akkus and his talk, The Vulnerability that Gmail Overlooked and Enabled Threat Hunting. 3 00:00:20,300 --> 00:00:22,140 Take it away, Oskan. 4 00:00:25,970 --> 00:00:29,170 Hello, I wish happy days to everyone. 5 00:00:29,170 --> 00:00:31,430 I am Oskan Mustafa Akkus. 6 00:00:31,470 --> 00:00:43,330 Today I'm going to talk about the threats that the SMTP protocol can pose and show you how large mail providers such as Gmail overlooked and enabled threat hunting. 7 00:00:43,330 --> 00:00:53,350 It makes me sad not to be in Vegas right now, but health is more important than anything, so please be careful and don't go out without a mask. 8 00:00:54,350 --> 00:00:57,710 First of all, I want to talk about myself. 9 00:00:57,950 --> 00:01:02,290 I'm a vulnerable researcher and penetration tester in Turkey. 10 00:01:02,290 --> 00:01:10,410 While studying sports science and technologies, I decided to leave the university and step into the world of cybersecurity. 11 00:01:10,690 --> 00:01:20,350 My purpose is to provide added value to the world of cybersecurity through the training I had given and the research I had conducted. 12 00:01:20,710 --> 00:01:27,430 I published security vulnerabilities on international platforms that I had discovered. 13 00:01:27,450 --> 00:01:31,110 I entries my exploit to CVE and EDP databases. 14 00:01:31,110 --> 00:01:37,770 You can also access my previous works on my personal blog pentes.com.tr. 15 00:01:38,370 --> 00:01:41,560 I would like to mention presentation schedule. 16 00:01:42,050 --> 00:01:47,710 First, we will focus on SMTP protocol structure and threats. 17 00:01:47,710 --> 00:01:59,230 We're going to analyze by sending training emails inspired by SMTP, and then we're going to review and result and scheme of the research. 18 00:01:59,230 --> 00:02:04,190 Finally, I'm going to share an explosive tool as a bonus with you. 19 00:02:04,910 --> 00:02:10,450 I don't have the DEF CON 28 badge today. 20 00:02:10,450 --> 00:02:15,350 Because of that, I am using DEF CON 26 and 27 badges. 21 00:02:16,110 --> 00:02:18,830 I miss it using them very much. 22 00:02:20,130 --> 00:02:22,590 So, let's start. 23 00:02:24,090 --> 00:02:26,510 Let's look at what SMTP is. 24 00:02:26,510 --> 00:02:32,350 Also, let's take a look at the structure of this protocol and examine the logic of operation. 25 00:02:32,350 --> 00:02:36,390 As everyone knows, SMTP is simple mail transfer protocol. 26 00:02:36,390 --> 00:02:39,190 As mentioned in the name, it's very simple protocol. 27 00:02:39,190 --> 00:02:43,690 We know that the simple structure can always pose a danger. 28 00:02:43,750 --> 00:02:49,170 So, new solutions and models contribute to the straightening of the simple structure. 29 00:02:49,170 --> 00:02:54,070 Different solutions were used for many security problems in SMTP. 30 00:02:54,070 --> 00:02:56,830 We're going to touch this issue again later. 31 00:02:57,690 --> 00:03:04,070 SMTP was published as IFC 788 by Postel in November 1981. 32 00:03:04,070 --> 00:03:14,610 This protocol structure was finalized as IFC 821, IFC 2821, and IFC 5321. 33 00:03:14,610 --> 00:03:20,410 IFC 5321 is the last standard published in 2008. 34 00:03:20,410 --> 00:03:35,990 Today, there are famous structures that high mail transfer agent is the use of the SMTP protocol such as Gmail, Postfix, Microsoft Exchange Server, Yandex, Mail.ru, Yahoo, and so on. 35 00:03:35,990 --> 00:03:44,030 You can examine the history and final version of the SMTP protocol in detail through the link below. 36 00:03:45,510 --> 00:03:53,530 According to Internet Engineering Task Force, the simple structure of the SMTP protocol can be shown as follows. 37 00:03:53,970 --> 00:03:59,150 Let's follow a path from the simple structure to complex structure. 38 00:03:59,150 --> 00:04:04,750 Below, we can see the structure that is not separated into its components. 39 00:04:04,750 --> 00:04:08,230 So, SMTP clients communicate via the internet. 40 00:04:08,690 --> 00:04:13,510 Let's continue the review by adding protocol components. 41 00:04:13,510 --> 00:04:19,170 If we move to from general to detail, it will be more memorable. 42 00:04:19,450 --> 00:04:29,750 In the diagram below, you can see that we have divided the SMTP client and SMTP server into two components such as mail transfer agent and user agent. 43 00:04:29,750 --> 00:04:33,850 The user agent creates the envelope then puts the message in the envelope. 44 00:04:33,850 --> 00:04:35,930 So, it prepares the message. 45 00:04:35,930 --> 00:04:40,610 The mail transfer agent transfers his prepared mail across the internet. 46 00:04:40,610 --> 00:04:47,050 This is done in the same way on the parties receiving the mail and delivering the mail. 47 00:04:47,050 --> 00:04:51,790 Up this time, the SMTP protocol was in a very simple state. 48 00:04:51,790 --> 00:04:54,690 Spring made trails with the simple structure. 49 00:04:54,690 --> 00:05:00,190 Therefore, different structures are included to strengthen the SMTP protocol. 50 00:05:00,190 --> 00:05:04,250 For example, extended SMTP has been released. 51 00:05:04,330 --> 00:05:18,170 Extended SMTP defines a framework for extending SMTP service by defining a means whereby a server SMTP can inform a client SMTP as to the server extension it supports. 52 00:05:18,290 --> 00:05:25,510 So, control has been added to DNS site which is used especially for email transfer. 53 00:05:25,510 --> 00:05:40,430 Authentication to SMTP server, domain case identification mail, domain-based message authentication, reporting and conformance, and standard policy framework are the controls provided on the DNS site. 54 00:05:40,430 --> 00:05:49,030 While many standards have been published to strengthen the SMTP protocol, the most important of this is the standard policy framework. 55 00:05:49,030 --> 00:05:52,490 This will be the point we will focus on today. 56 00:05:52,490 --> 00:05:57,590 At this point, we will review the Internet Engineering Task Force's documents again. 57 00:05:57,590 --> 00:06:08,210 According to Internet Engineering Task Force, IFC 7108 is version 1 for standard policy framework for authorizing use of domains in email. 58 00:06:08,350 --> 00:06:12,570 You can get detailed information from the link below. 59 00:06:12,570 --> 00:06:16,410 There's a sentence like this in the abstract description. 60 00:06:16,410 --> 00:06:19,130 This sentence is exactly like this. 61 00:06:19,130 --> 00:06:22,810 Email on the internet can be forgotten in a number of ways. 62 00:06:22,810 --> 00:06:33,870 In particular, existing protocols place no restriction on what a sending host can use as the mail from of a message or the domain given on the SMTP hello, hello comments. 63 00:06:33,870 --> 00:06:35,810 This part is very important. 64 00:06:35,810 --> 00:06:43,130 Existing protocols place no restriction on what a sending host can use as the mail from of a message or the domain. 65 00:06:43,130 --> 00:06:47,470 This means that the SMTP protocol is a very primitive structure. 66 00:06:47,470 --> 00:06:54,590 It's ironic that the millions of the servers are not using mail from control while using this protocol. 67 00:06:54,950 --> 00:07:03,250 Our main subject today is how famous mail transfer agent services can pause a trade event thought they use SPF. 68 00:07:03,250 --> 00:07:19,210 In fact, today I was gonna just share a situation related to Gmail, but it was March 3 when I applied for Package Hacking Village, so I continued my research and perform a test on other famous email providers. 69 00:07:19,290 --> 00:07:26,190 So today we will examine also other famous mail providers, not only the Gmail. 70 00:07:26,570 --> 00:07:35,790 These will be Gmail, Yandex Mail, Mail.ru, Outlook, Hotmail, Yahoo, Zoho Mail, Hi.com, and HubSpot. 71 00:07:35,810 --> 00:07:47,240 Because of that, it will be more correct to change the presentation title as the vulnerability that famous email providers overlooked at enabling trade hunting. 72 00:07:47,750 --> 00:07:53,210 Let's send emails that can pause trades and analyze the situation later. 73 00:07:53,210 --> 00:07:56,990 I worked on Exploit to send these training emails. 74 00:07:56,990 --> 00:08:03,770 I'm so sorry to say that, but I'm not gonna share the details of Exploit because it's so dangerous. 75 00:08:03,770 --> 00:08:06,930 However, I'm gonna show you with live examples. 76 00:08:06,930 --> 00:08:12,470 I'm gonna use an SMTP server as a gateway by authentication with user information. 77 00:08:12,470 --> 00:08:16,550 This server will be an SMTP server without open relay. 78 00:08:16,550 --> 00:08:26,850 In addition, this server must be a trusted server that has been previously approved by famous email providers and has no problem with mail delivery. 79 00:08:27,030 --> 00:08:32,570 The server I use in Exploit for this process will be my university's mail server. 80 00:08:32,590 --> 00:08:47,930 The servers of large companies and universities are in constant communication with famous email providers, so we can bypass most of the DNS-based controls. 81 00:08:47,930 --> 00:08:53,870 If you try to do this by creating a new server, you're gonna definitely fail. 82 00:08:54,110 --> 00:09:03,570 There's also another detail in the Exploit I wrote about that, but I'm not gonna share these details as I said before. 83 00:09:03,970 --> 00:09:09,890 We're gonna conduct internal and external tests on famous mail providers. 84 00:09:09,890 --> 00:09:17,810 In internal tests, we will try to send arbitrary mail via mail providers' own domain name, for example, gmail2gmail. 85 00:09:17,810 --> 00:09:26,090 In external tests, we will try to send arbitrary mail using the domain name walloffship.com. 86 00:09:26,630 --> 00:09:30,990 Let's analyze these training emails by sending them. 87 00:09:30,990 --> 00:09:34,610 I created a special account on all of the famous email providers. 88 00:09:34,610 --> 00:09:38,590 We're gonna perform internal and external tests throughout these accounts. 89 00:09:38,590 --> 00:09:49,170 We're gonna do tests on Gmail, Yamnix Mail, Mail.ru, Outlook, Yahoo Mail, Zoho Mail, Hai.com, and HubSpot. 90 00:09:49,170 --> 00:09:54,750 My Gmail account was forwarded to HubSpot. 91 00:09:55,450 --> 00:10:00,250 It's also forwarded to Hai.com too. 92 00:10:00,790 --> 00:10:08,810 Therefore, we're gonna also test Hai.com and HubSpot with email we sent to Gmail. 93 00:10:10,150 --> 00:10:18,230 In internal tests, we will try to send arbitrary mail via mail provider's own domain name. 94 00:10:18,230 --> 00:10:21,290 And then we're gonna analyze the results. 95 00:10:22,770 --> 00:10:32,610 We're gonna send the mail from defconn.gmail.com to defconn.pishui.gmail.com first. 96 00:10:32,930 --> 00:10:35,310 Let's start with Gmail. 97 00:10:40,180 --> 00:10:42,660 I'm gonna send it. 98 00:10:43,300 --> 00:10:44,960 It will be passed. 99 00:10:50,750 --> 00:10:52,220 We need to wait a little. 100 00:10:56,250 --> 00:10:58,510 And mail has been sent successfully. 101 00:10:58,830 --> 00:11:03,390 As you can see, the mail dropped on the inbox. 102 00:11:03,390 --> 00:11:10,370 However, there's a big warning that this mail could not be verified that it came from defconn.gmail.com. 103 00:11:12,330 --> 00:11:17,170 But when we look at Hai.com, there is no warning here. 104 00:11:17,850 --> 00:11:20,350 This is a very dangerous situation. 105 00:11:21,630 --> 00:11:30,750 Similarly, when we check the HubSpot, we see that the mail is successfully forwarded and does not contain any warning too. 106 00:11:31,870 --> 00:11:35,430 I'm gonna explain the source of this vulnerability to you later. 107 00:11:36,050 --> 00:11:39,230 Let's continue our test with Yandex Mail. 108 00:11:39,310 --> 00:11:45,890 Now I'm gonna send email from defconn.yandex.com to defconn.pishui.yandex.com. 109 00:11:45,890 --> 00:11:51,950 I'm passing information here. 110 00:11:52,270 --> 00:11:52,910 Yeah 111 00:11:58,210 --> 00:12:02,230 , mail has been sent successfully. 112 00:12:02,490 --> 00:12:04,650 I will check the inbox. 113 00:12:04,650 --> 00:12:08,710 And I reflect the page and check the inbox and spam box again. 114 00:12:10,710 --> 00:12:12,870 But no email came. 115 00:12:12,870 --> 00:12:16,470 Yandex didn't allow us to construct its own domain name. 116 00:12:17,050 --> 00:12:20,630 So let's continue the test with mail.ru. 117 00:12:20,630 --> 00:12:28,910 I'm gonna send email from defconn.mail.ru to defconn.pishui.mail.ru. 118 00:12:30,230 --> 00:12:32,550 I'm passing information. 119 00:12:40,750 --> 00:12:43,870 Mail has been sent successfully. 120 00:12:44,470 --> 00:12:46,150 I will check the inbox. 121 00:12:52,100 --> 00:12:55,000 I'm gonna check back again to make sure. 122 00:13:00,010 --> 00:13:02,010 No email came. 123 00:13:02,010 --> 00:13:07,090 Mail.ru didn't allow us to control its own domain name such as Yandex. 124 00:13:07,690 --> 00:13:11,750 So let's continue the test with Hotmail. 125 00:13:12,450 --> 00:13:19,450 I'm gonna send email from defconn.hotmail.com to defconn.pishui.hotmail.com. 126 00:13:29,340 --> 00:13:31,720 Mail has been sent successfully. 127 00:13:32,580 --> 00:13:34,680 I'm checking the inbox. 128 00:13:35,400 --> 00:13:39,680 No email inbox, but as you can see it dropped into the spam box. 129 00:13:40,580 --> 00:13:42,420 The mail is here. 130 00:13:43,260 --> 00:13:46,020 And let's continue the test with Yahoo Mail. 131 00:13:46,320 --> 00:13:53,020 I'm gonna send email from defconn.yahoo.com to defconn.pishui.yahoo.com. 132 00:14:02,680 --> 00:14:05,020 Mail has been sent successfully. 133 00:14:05,880 --> 00:14:07,740 I'm checking the boxes. 134 00:14:20,160 --> 00:14:22,540 Oh, Trump came to his own mail. 135 00:14:25,020 --> 00:14:27,240 And no mail came. 136 00:14:27,240 --> 00:14:30,560 Yandex didn't allow us to control its own domain name too. 137 00:14:30,560 --> 00:14:32,940 Let's continue the test with Zoho Mail. 138 00:14:33,780 --> 00:14:40,500 I'm gonna send email from defconn.zohomail.com to defconn.pishui.zohomail.com. 139 00:14:52,430 --> 00:14:54,750 Mail has been sent successfully. 140 00:14:56,810 --> 00:14:59,130 Let's check the page by reflashing. 141 00:15:02,280 --> 00:15:04,000 I'm checking the boxes. 142 00:15:08,270 --> 00:15:09,590 No mail came. 143 00:15:09,590 --> 00:15:12,310 Zoho didn't allow us to control its own domain name too. 144 00:15:12,310 --> 00:15:13,770 So internal tests are over. 145 00:15:13,770 --> 00:15:15,910 We can pass to external tests. 146 00:15:16,210 --> 00:15:18,150 Time to external tests. 147 00:15:18,150 --> 00:15:23,430 I'm gonna use the email address mink at walloffship.com for external testing. 148 00:15:23,430 --> 00:15:28,270 We're gonna send email from mink at walloffship.com to other email addresses. 149 00:15:28,370 --> 00:15:29,730 Let's start with Gmail. 150 00:15:29,890 --> 00:15:31,450 I'm passing. 151 00:15:42,420 --> 00:15:44,700 Mail has been sent successfully. 152 00:15:44,760 --> 00:15:48,180 At the same time, the mail dropped into the inbox already. 153 00:15:48,300 --> 00:15:52,720 As you can see, we cannot see the warning here as internal tests. 154 00:15:52,720 --> 00:15:57,740 When you browse the first mail, you can see the difference, but there is a small detail. 155 00:15:57,740 --> 00:16:00,580 There is a question mark in the profile photo. 156 00:16:00,620 --> 00:16:06,500 When we move the cursor to this point, we notice that there is a warning again here. 157 00:16:06,500 --> 00:16:13,440 It says your mail could not verify that walloffship.com actually sent this message. 158 00:16:13,440 --> 00:16:17,740 But I don't know which user cares about this. 159 00:16:17,740 --> 00:16:21,320 I'm gonna show an example later on this situation. 160 00:16:22,060 --> 00:16:26,460 Let's check out hey.com and HubSpot now. 161 00:16:26,800 --> 00:16:32,940 As you can see, mail has been forwarded without any warning such as an internal test. 162 00:16:32,940 --> 00:16:36,480 The situation looks the same for HubSpot too. 163 00:16:37,100 --> 00:16:41,480 There is no warning and mail is cleanly forwarded. 164 00:16:41,480 --> 00:16:46,100 I also want to show you what's happening in the Gmail application. 165 00:16:47,640 --> 00:16:51,320 I'm gonna show you an older version. 166 00:16:51,420 --> 00:16:56,600 There is no warning even in the profile photo in the mobile application. 167 00:16:56,680 --> 00:17:03,840 However, until two months ago, it was affected by this weakness in the last version. 168 00:17:03,840 --> 00:17:08,180 I didn't report them, but they fixed the vulnerability. 169 00:17:08,180 --> 00:17:10,680 I don't know how they learned. 170 00:17:12,500 --> 00:17:15,460 Maybe my mails may be under review. 171 00:17:15,460 --> 00:17:16,760 I don't know. 172 00:17:17,140 --> 00:17:23,620 But still, I want you to know that the old versions are still vulnerable. 173 00:17:24,740 --> 00:17:27,900 Let's continue tasks with Yandex Mail. 174 00:17:28,220 --> 00:17:34,740 I'm gonna send email from mink at walloffship.com to defcomph3 at yandex.com. 175 00:17:36,580 --> 00:17:39,360 I will pass the information. 176 00:17:50,600 --> 00:17:52,560 Mail has been sent successfully. 177 00:17:54,160 --> 00:17:56,060 I will check inbox. 178 00:18:00,100 --> 00:18:03,680 As you can see, mail dropped directly into the inbox. 179 00:18:03,680 --> 00:18:06,880 Also, there is no warning in the mail content. 180 00:18:06,920 --> 00:18:09,220 It's a very dangerous situation. 181 00:18:09,280 --> 00:18:12,440 I'm not Mink, but it doesn't matter for Yandex. 182 00:18:13,000 --> 00:18:17,720 Therefore, we can say that Yandex is affected by this situation. 183 00:18:18,240 --> 00:18:24,660 I'm taking note of this and let's continue tasks with mail.ru. 184 00:18:25,220 --> 00:18:32,180 I'm gonna send email from mink at walloffship.com to defcomph3 at mail.ru. 185 00:18:44,110 --> 00:18:47,130 Mail has been sent successfully. 186 00:18:47,530 --> 00:18:51,360 As you can see, the mail has arrived quickly. 187 00:18:51,920 --> 00:18:57,300 Just like Yandex, mail.ru didn't check if I was Mink or not. 188 00:18:57,300 --> 00:19:02,860 Therefore, we can say that Yandex is affected by this situation too. 189 00:19:03,160 --> 00:19:05,880 Let's continue tasks with Hotmail. 190 00:19:06,060 --> 00:19:14,060 Now is I'm gonna send email from mink at walloffship.com to defcomph3 at hotmail.com. 191 00:19:28,090 --> 00:19:30,290 Mail has been sent successfully. 192 00:19:30,750 --> 00:19:34,650 Now I will check. 193 00:19:35,590 --> 00:19:40,510 And no mail inbox, but as you can see, it dropped into the spam box. 194 00:19:40,610 --> 00:19:45,500 Hotmail sent this message to the spam box because it couldn't verify its owner. 195 00:19:45,910 --> 00:19:48,470 So I am taking note of this. 196 00:19:48,790 --> 00:19:51,260 Let's continue tasks with Yahoo mail. 197 00:19:51,690 --> 00:19:57,510 I'm gonna send email from mink at walloffship.com to defcomph3 at yahoo. 198 00:19:57,530 --> 00:19:58,510 com. 199 00:20:14,310 --> 00:20:15,890 Mail has been sent successfully. 200 00:20:17,270 --> 00:20:19,270 I'm checking the boxes. 201 00:20:28,710 --> 00:20:31,470 I'll tramp again, I think tramp is after me. 202 00:20:31,870 --> 00:20:34,730 I will check boxes a few times to be sure. 203 00:20:39,810 --> 00:20:41,850 No mail has been received. 204 00:20:42,350 --> 00:20:45,050 Yahoo is very strict about this. 205 00:20:45,050 --> 00:20:50,210 I take note of this and pass the final external test of Zaha mail. 206 00:20:50,210 --> 00:20:57,830 I'm gonna send email from mink at walloffship.com to defcomph3 at zahomail.com 207 00:21:09,370 --> 00:21:09,970 . 208 00:21:10,010 --> 00:21:12,130 Mail has been sent successfully. 209 00:21:12,610 --> 00:21:14,310 I'm checking the boxes. 210 00:21:18,850 --> 00:21:24,250 And no mail has been received, so Zaha mail is very strict about this, such as Yahoo. 211 00:21:24,770 --> 00:21:27,250 This was our last test. 212 00:21:27,250 --> 00:21:30,030 It's time to analyze the information we collect. 213 00:21:31,090 --> 00:21:35,210 As an example of my research, I caught a very interesting example. 214 00:21:35,230 --> 00:21:37,590 I want to present this to you. 215 00:21:37,830 --> 00:21:41,210 My friend was accepted by defcom Red Team Village. 216 00:21:41,210 --> 00:21:48,670 This news came to him from omar at redteamvillage.io. 217 00:21:48,750 --> 00:21:56,050 When I review this email, there's a warning in the Gmail proper photo area, just like our external test. 218 00:21:56,050 --> 00:22:01,290 My friend did not pay attention to this situation and answered this email. 219 00:22:01,930 --> 00:22:08,770 Fortunately, the mail really came from Omar, but this could be a fake mail. 220 00:22:08,910 --> 00:22:16,570 Now I'm gonna send an email from omar at redteamvillage.io to my friend gmail artist. 221 00:22:17,230 --> 00:22:27,630 We're gonna also carry out internal and external testing and look at the response of the email application on the Apple Mac device to this vulnerability. 222 00:22:28,570 --> 00:22:30,970 Let's send the mails. 223 00:22:30,970 --> 00:22:35,430 I'm gonna send these test mails from my second screen. 224 00:22:41,450 --> 00:22:50,390 As you can see, the mail from defcom at gmail.com also cancels a warning in the Gmail web application. 225 00:22:51,070 --> 00:23:00,830 However, in the email application of the Mac operating system, this mail does not cancels any warnings. 226 00:23:00,830 --> 00:23:03,290 This is a very interesting finding, too. 227 00:23:03,730 --> 00:23:14,890 In addition, the mail I sent from Omar successfully reached the application allowed me to pass whether I was Omar or not. 228 00:23:14,890 --> 00:23:20,670 Now, time to examine where this vulnerability is caused. 229 00:23:20,670 --> 00:23:24,470 Now I'm gonna show where the vulnerability originated. 230 00:23:24,470 --> 00:23:37,930 As I have shown before, we're gonna examine why third-party applications cannot detect this little warning in the profile photo area and why are they receiving this training mail cleanly from Gmail. 231 00:23:38,030 --> 00:23:40,250 Let's look at what's happening again. 232 00:23:40,250 --> 00:23:42,590 Hair.com does not have any warning. 233 00:23:43,430 --> 00:23:50,330 Also, HubSpot does not have any warning, too, as you can see. 234 00:23:51,050 --> 00:23:58,290 Mail that is perceived as dangerous in Gmail looks completely clean on these platforms. 235 00:23:58,290 --> 00:24:02,230 To show that, I'm gonna use Python library writing for the Gmail API. 236 00:24:02,230 --> 00:24:08,380 With this library, we're gonna check the email contents by making a request to the Gmail API. 237 00:24:09,130 --> 00:24:14,750 First, we need to learn the ID value of the message we want to link. 238 00:24:16,890 --> 00:24:20,190 And I think that should be it. 239 00:24:20,710 --> 00:24:24,010 I need to put this ID value into the library properly. 240 00:24:24,010 --> 00:24:26,950 We also need to use GET instead of LIST. 241 00:24:29,560 --> 00:24:31,450 It is now ready to make request again. 242 00:24:32,700 --> 00:24:37,000 As you can see, all the details of the mail are here. 243 00:24:37,120 --> 00:24:48,110 After a little examination, we realized that the warning in the Gmail web application is not among the information received with the Gmail API. 244 00:24:48,110 --> 00:25:01,810 Therefore, we have proved that third-party applications such as Hair.com, HubSpot, and Apple email applications cannot detect this warning because they use the Gmail API. 245 00:25:01,910 --> 00:25:11,490 There are dozens of applications using the Gmail API, so this vulnerability caused by Gmail affects them all. 246 00:25:11,490 --> 00:25:17,150 In this case, it leaves millions of people directly in danger. 247 00:25:17,710 --> 00:25:25,790 These applications which can connect with Gmail need to make a new update considering this situation. 248 00:25:25,890 --> 00:25:33,970 Once and for all, let's examine the result of our internal and external test again. 249 00:25:33,970 --> 00:25:37,330 Let's take a brief look at the result of our test. 250 00:25:37,330 --> 00:25:39,930 I'm going to summarize this part quickly. 251 00:25:40,010 --> 00:25:42,390 The meaning of the signs are here. 252 00:25:43,270 --> 00:26:08,530 In internal tests, training mails drops into the inbox with warning in Gmail and doesn't drop into any box in Yandex and doesn't drop into any box in Mail.ru and drops into the spam box in Outlook and doesn't drop into any box in Yahoo and doesn't drop into any box in Zahoomail too. 253 00:26:08,670 --> 00:26:36,730 In external tests, the training mails drops into the inbox without warning in Gmail and drops into inbox without warning in Yandex and drops into the inbox without warning in Mail.ru and drops into the spam box in Outlook and doesn't drop into any box in Yahoo and doesn't drop into any box in Zahoomail too. 254 00:26:36,770 --> 00:26:44,510 Unfortunately, third-party applications using APIs of famous mail providers cannot reflect warnings. 255 00:26:44,510 --> 00:26:49,450 Initially, the incoming email is forwarded directly without an error message. 256 00:26:49,750 --> 00:26:56,090 So, Hide.com forwarded training mails and mails dropped into the inbox without warning. 257 00:26:56,090 --> 00:27:03,610 Also, HubSpot forwarded training mails and mails dropped into the inbox without any warning too. 258 00:27:03,610 --> 00:27:06,370 This was the test result with it. 259 00:27:06,370 --> 00:27:11,170 I'm sharing an exclusive tool with you at the last stage of my presentation. 260 00:27:11,170 --> 00:27:13,490 Its name is DraftChat. 261 00:27:13,490 --> 00:27:17,170 DraftChat allows persons to chat throughout mail providers. 262 00:27:17,170 --> 00:27:23,570 You can access the GOD chat module, which is the first module and uses the Gmail API. 263 00:27:24,130 --> 00:27:32,350 DraftChat allows persons to chat throughout a single Gmail account in the Gmail that does not record drafts. 264 00:27:32,350 --> 00:27:43,790 It encrypts the sent message first with DES and then with the AES algorithm and writes them to the created draft. 265 00:27:43,830 --> 00:27:49,490 The message of person I've written in encrypted form on the same draft. 266 00:27:49,490 --> 00:27:54,850 Message can only be read with the correct case to be determined. 267 00:27:54,850 --> 00:27:59,230 In this way, a completely hidden chatroom is created with a single Gmail account. 268 00:27:59,230 --> 00:28:08,870 Therefore, DraftChat makes person-hundred private communication opportunity by turning a non-URL mail server into a chat server. 269 00:28:09,050 --> 00:28:13,510 You need to set up a common Gmail account to chat with your partner. 270 00:28:13,550 --> 00:28:17,650 Remember, you will only perform this operation once. 271 00:28:17,650 --> 00:28:22,350 You will not have to do this configuration every time you chat. 272 00:28:22,490 --> 00:28:26,870 Let's do the installation pace in a practical way. 273 00:28:26,870 --> 00:28:29,590 First step is turn on the Gmail API. 274 00:28:29,590 --> 00:28:35,430 First of all, we need to allow for quick start from our Gmail account, because we are using fighting quick start. 275 00:28:35,430 --> 00:28:38,090 Click on enable the Gmail API button. 276 00:28:38,090 --> 00:28:42,230 In this section, you should choose the desktop. 277 00:28:43,070 --> 00:28:51,310 In zone link dialog, click download client configuration and save the file credentials.json to your DraftChat directory. 278 00:28:51,310 --> 00:28:57,890 After running DraftChat, it will first ask you for your nickname. 279 00:28:58,030 --> 00:29:05,350 Once you have determined your nickname, you must determine whether you want to be a server or a client. 280 00:29:05,350 --> 00:29:08,090 Client-server relationship is very simple. 281 00:29:08,090 --> 00:29:15,090 If you want to be a server, the DES and AES keys that you determine will be used. 282 00:29:15,090 --> 00:29:21,910 If you choose to be a client, you have to get keys for these algorithms from your server partner. 283 00:29:21,910 --> 00:29:24,330 Let's say you choose the server option. 284 00:29:24,790 --> 00:29:40,690 After the retirement and 8-digit DES key, DraftChat generates a 16-digit random AES key for you and a new draft is created for the chat rooms that your client partner is expected. 285 00:29:40,690 --> 00:29:44,330 So you need to pass this case over to your partner. 286 00:29:45,070 --> 00:29:48,470 Let's take a look at the client option. 287 00:29:48,470 --> 00:29:51,590 In this case, I have taken an entrant from the server partner. 288 00:29:51,590 --> 00:29:58,090 If the keys are wrong, there is no server rating for the client, the program will give an error. 289 00:29:58,750 --> 00:30:02,430 The taken keys were entered and the information was verified. 290 00:30:02,430 --> 00:30:06,910 So you can communicate with your partner in peace of mind. 291 00:30:06,910 --> 00:30:14,830 When the draft box of our Gmail account is checked, you can see that a new draft has been created here. 292 00:30:14,990 --> 00:30:22,770 All messages are written here and the draft is continuously encrypted with algorithms. 293 00:30:22,770 --> 00:30:26,290 We can test this by writing a new message. 294 00:30:28,450 --> 00:30:30,330 It's for grids. 295 00:30:30,770 --> 00:30:40,030 The fact that you are offered a private chat room does not mean that the communication you provide while using this tool may be illegal. 296 00:30:40,110 --> 00:30:44,250 Remember that all the responsibility belongs to you. 297 00:30:44,490 --> 00:30:46,850 You can download DraftChat from GitHub. 298 00:30:46,850 --> 00:30:48,990 It also opened the development. 299 00:30:48,990 --> 00:30:53,110 You can contribute to this tool if you wish. 300 00:30:53,110 --> 00:30:55,010 Yes guys, now it's over. 301 00:30:55,010 --> 00:30:56,670 Thank you so much for listening to me. 302 00:30:56,670 --> 00:31:02,230 You can contact me from my social media accounts and you can ask your question whenever you want. 303 00:31:02,230 --> 00:31:06,550 I was honored to be here at DEF CON 28 Package Hacking Village. 304 00:31:06,550 --> 00:31:12,350 I hope to present my research at that best hacking conference in the world next year again. 305 00:31:12,370 --> 00:31:14,270 I wish healthy days to everyone. 306 00:31:14,270 --> 00:31:15,110 Best regards. 307 00:31:15,110 --> 00:31:15,950 Goodbye.