start	end	text
60	8040	Our next talk comes from Turkey. It is with great pleasure to welcome and introduce you to Oskan
8040	15550	Mustafa Akkus and his talk, The Vulnerability that Gmail Overlooked and Enabled Threat Hunting.
20300	22140	Take it away, Oskan.
25970	33270	Hello, I wish happy days to everyone. I am Oskan Mustafa Akkus. Today I'm going to talk about
33270	37970	the threats that the SMTP protocol can pose and show you how large mail
38710	45570	providers such as Gmail overlooked and enabled threat hunting. It makes me sad not to be in
45570	51350	Vegas right now, but health is more important than anything, so please be careful and don't
51350	59770	go out without a mask. First of all, I want to talk about myself. I'm a vulnerable researcher
59770	65030	and penetration tester in Turkey. While studying sports science and technologies,
65030	72390	I decided to leave the university and step into the world of cybersecurity. My purpose is to
72390	78530	provide added value to the world of cybersecurity through the training I had given and the research
78530	84830	I had conducted. I published security vulnerabilities on international platforms
84830	93010	that I had discovered. I entries my exploit to CVE and EDP databases. You can also access my
93010	101560	previous works on my personal blog pentes.com.tr. I would like to mention presentation schedule.
102050	109310	First, we will focus on SMTP protocol structure and threats. We're going to analyze by sending
109310	117670	training emails inspired by SMTP, and then we're going to review and result and scheme
117670	124190	of the research. Finally, I'm going to share an explosive tool as a bonus with you.
124910	135350	I don't have the DEF CON 28 badge today. Because of that, I am using DEF CON 26 and 27 badges.
136110	142590	I miss it using them very much. So, let's start.
144090	149990	Let's look at what SMTP is. Also, let's take a look at the structure of this protocol and
149990	156390	examine the logic of operation. As everyone knows, SMTP is simple mail transfer protocol.
156390	160750	As mentioned in the name, it's very simple protocol. We know that the simple structure
160750	167730	can always pose a danger. So, new solutions and models contribute to the straightening of
167730	174070	the simple structure. Different solutions were used for many security problems in SMTP.
174070	182550	We're going to touch this issue again later. SMTP was published as IFC 788 by Postel in November
182550	194610	1981. This protocol structure was finalized as IFC 821, IFC 2821, and IFC 5321.
194610	203470	IFC 5321 is the last standard published in 2008. Today, there are famous structures that
203470	210250	high mail transfer agent is the use of the SMTP protocol such as Gmail, Postfix,
210250	218730	Microsoft Exchange Server, Yandex, Mail.ru, Yahoo, and so on. You can examine the history and
218730	224030	final version of the SMTP protocol in detail through the link below.
225510	231430	According to Internet Engineering Task Force, the simple structure of the SMTP protocol can
231430	239150	be shown as follows. Let's follow a path from the simple structure to complex structure.
239150	246010	Below, we can see the structure that is not separated into its components. So, SMTP clients
246010	253970	communicate via the internet. Let's continue the review by adding protocol components. If we move
253970	262490	to from general to detail, it will be more memorable. In the diagram below, you can see that we have
262490	268750	divided the SMTP client and SMTP server into two components such as mail transfer agent and
268750	274330	user agent. The user agent creates the envelope then puts the message in the envelope. So, it
274330	280610	prepares the message. The mail transfer agent transfers his prepared mail across the internet.
280610	287050	This is done in the same way on the parties receiving the mail and delivering the mail.
287050	293770	Up this time, the SMTP protocol was in a very simple state. Spring made trails with the simple
293770	300330	structure. Therefore, different structures are included to strengthen the SMTP protocol. For
300330	309110	example, extended SMTP has been released. Extended SMTP defines a framework for extending SMTP
309110	316010	service by defining a means whereby a server SMTP can inform a client SMTP as to the server
316010	324430	extension it supports. So, control has been added to DNS site which is used especially for email
324430	332610	transfer. Authentication to SMTP server, domain case identification mail, domain-based message
332610	338910	authentication, reporting and conformance, and standard policy framework are the controls provided
338910	344870	on the DNS site. While many standards have been published to strengthen the SMTP protocol,
344870	351750	the most important of this is the standard policy framework. This will be the point we will focus on
351750	357890	today. At this point, we will review the Internet Engineering Task Force's documents again. According
357890	364950	to Internet Engineering Task Force, IFC 7108 is version 1 for standard policy framework for
364950	372570	authorizing use of domains in email. You can get detailed information from the link below.
372570	379130	There's a sentence like this in the abstract description. This sentence is exactly like this.
379130	385890	Email on the internet can be forgotten in a number of ways. In particular, existing protocols place
385890	391650	no restriction on what a sending host can use as the mail from of a message or the domain given on
391650	398430	the SMTP hello, hello comments. This part is very important. Existing protocols place no restriction
398430	404730	on what a sending host can use as the mail from of a message or the domain. This means that the
404730	410850	SMTP protocol is a very primitive structure. It's ironic that the millions of the servers are not
410850	418310	using mail from control while using this protocol. Our main subject today is how famous mail transfer
418310	425810	agent services can pause a trade event thought they use SPF. In fact, today I was gonna just
425810	432670	share a situation related to Gmail, but it was March 3 when I applied for Package Hacking Village,
432670	439210	so I continued my research and perform a test on other famous email providers.
439290	447370	So today we will examine also other famous mail providers, not only the Gmail. These will be
447370	455790	Gmail, Yandex Mail, Mail.ru, Outlook, Hotmail, Yahoo, Zoho Mail, Hi.com, and HubSpot.
455810	461070	Because of that, it will be more correct to change the presentation title as
461790	467240	the vulnerability that famous email providers overlooked at enabling trade hunting.
467750	474610	Let's send emails that can pause trades and analyze the situation later. I worked on Exploit
474610	480890	to send these training emails. I'm so sorry to say that, but I'm not gonna share the details
480890	487290	of Exploit because it's so dangerous. However, I'm gonna show you with live examples. I'm gonna
487290	494190	use an SMTP server as a gateway by authentication with user information. This server will be an SMTP
494890	501190	server without open relay. In addition, this server must be a trusted server that has been
501190	507770	previously approved by famous email providers and has no problem with mail delivery. The server I
507770	513710	use in Exploit for this process will be my university's mail server. The servers of large
513710	522790	companies and universities are in constant communication with famous email providers,
522790	531510	so we can bypass most of the DNS-based controls. If you try to do this by creating a new server,
531510	538110	you're gonna definitely fail. There's also another detail in the Exploit I wrote about that,
538110	546530	but I'm not gonna share these details as I said before. We're gonna conduct internal and external
547350	553830	tests on famous mail providers. In internal tests, we will try to send arbitrary mail via
553830	560430	mail providers' own domain name, for example, gmail2gmail. In external tests, we will try to
560430	569070	send arbitrary mail using the domain name walloffship.com. Let's analyze these training
569070	574610	emails by sending them. I created a special account on all of the famous email providers.
574610	579570	We're gonna perform internal and external tests throughout these accounts. We're gonna do tests
579570	589170	on Gmail, Yamnix Mail, Mail.ru, Outlook, Yahoo Mail, Zoho Mail, Hai.com, and HubSpot.
589170	600250	My Gmail account was forwarded to HubSpot. It's also forwarded to Hai.com too.
600790	608810	Therefore, we're gonna also test Hai.com and HubSpot with email we sent to Gmail.
610150	616250	In internal tests, we will try to send arbitrary mail via mail provider's own
616250	621290	domain name. And then we're gonna analyze the results.
622770	632610	We're gonna send the mail from defconn.gmail.com to defconn.pishui.gmail.com first.
632930	642660	Let's start with Gmail. I'm gonna send it.
643300	652220	It will be passed. We need to wait a little.
656250	663390	And mail has been sent successfully. As you can see, the mail dropped on the inbox.
663390	668050	However, there's a big warning that this mail could not be verified that it came from
668050	677170	defconn.gmail.com. But when we look at Hai.com, there is no warning here.
677850	685070	This is a very dangerous situation. Similarly, when we check the HubSpot,
685070	690750	we see that the mail is successfully forwarded and does not contain any warning too.
691870	695430	I'm gonna explain the source of this vulnerability to you later.
696050	699230	Let's continue our test with Yandex Mail.
699310	705890	Now I'm gonna send email from defconn.yandex.com to defconn.pishui.yandex.com.
705890	711950	I'm passing information here.
712270	724650	Yeah, mail has been sent successfully. I will check the inbox.
724650	728710	And I reflect the page and check the inbox and spam box again.
730710	736470	But no email came. Yandex didn't allow us to construct its own domain name.
737050	745270	So let's continue the test with mail.ru. I'm gonna send email from defconn.mail.ru
745270	752550	to defconn.pishui.mail.ru. I'm passing information.
760750	766150	Mail has been sent successfully. I will check the inbox.
772100	775000	I'm gonna check back again to make sure.
780010	787090	No email came. Mail.ru didn't allow us to control its own domain name such as Yandex.
787690	796810	So let's continue the test with Hotmail. I'm gonna send email from defconn.hotmail.com
796810	811720	to defconn.pishui.hotmail.com. Mail has been sent successfully.
812580	819680	I'm checking the inbox. No email inbox, but as you can see it dropped into the spam box.
820580	826020	The mail is here. And let's continue the test with Yahoo Mail.
826320	833020	I'm gonna send email from defconn.yahoo.com to defconn.pishui.yahoo.com.
842680	847740	Mail has been sent successfully. I'm checking the boxes.
860160	862540	Oh, Trump came to his own mail.
865020	870560	And no mail came. Yandex didn't allow us to control its own domain name too.
870560	876980	Let's continue the test with Zoho Mail. I'm gonna send email from defconn.zohomail.com
876980	894750	to defconn.pishui.zohomail.com. Mail has been sent successfully.
896810	904000	Let's check the page by reflashing. I'm checking the boxes.
908270	912310	No mail came. Zoho didn't allow us to control its own domain name too.
912310	915910	So internal tests are over. We can pass to external tests.
916210	920130	Time to external tests. I'm gonna use the email address mink
920130	925090	at walloffship.com for external testing. We're gonna send email from mink at
925090	929730	walloffship.com to other email addresses. Let's start with Gmail.
929890	944700	I'm passing. Mail has been sent successfully.
944760	948180	At the same time, the mail dropped into the inbox already.
948300	952720	As you can see, we cannot see the warning here as internal tests.
952720	956060	When you browse the first mail, you can see the difference,
956060	960580	but there is a small detail. There is a question mark in the profile photo.
960620	966500	When we move the cursor to this point, we notice that there is a warning again here.
966500	973440	It says your mail could not verify that walloffship.com actually sent this message.
973440	981320	But I don't know which user cares about this. I'm gonna show an example later on this situation.
982060	989820	Let's check out hey.com and HubSpot now. As you can see, mail has been forwarded
989820	996480	without any warning such as an internal test. The situation looks the same for HubSpot too.
997100	1001480	There is no warning and mail is cleanly forwarded.
1001480	1006100	I also want to show you what's happening in the Gmail application.
1007640	1013740	I'm gonna show you an older version. There is no warning even in the profile
1013740	1019440	photo in the mobile application. However, until two months ago,
1019440	1023840	it was affected by this weakness in the last version.
1023840	1030680	I didn't report them, but they fixed the vulnerability. I don't know how they learned.
1032500	1036760	Maybe my mails may be under review. I don't know.
1037140	1043620	But still, I want you to know that the old versions are still vulnerable.
1044740	1049960	Let's continue tasks with Yandex Mail. I'm gonna send email from
1049960	1054740	mink at walloffship.com to defcomph3 at yandex.com.
1056580	1072560	I will pass the information. Mail has been sent successfully.
1074160	1083680	I will check inbox. As you can see, mail dropped directly into the inbox.
1083680	1089220	Also, there is no warning in the mail content. It's a very dangerous situation.
1089280	1092440	I'm not Mink, but it doesn't matter for Yandex.
1093000	1097720	Therefore, we can say that Yandex is affected by this situation.
1098240	1104660	I'm taking note of this and let's continue tasks with mail.ru.
1105220	1112180	I'm gonna send email from mink at walloffship.com to defcomph3 at mail.ru.
1124110	1131360	Mail has been sent successfully. As you can see, the mail has arrived quickly.
1131920	1137300	Just like Yandex, mail.ru didn't check if I was Mink or not.
1137300	1142860	Therefore, we can say that Yandex is affected by this situation too.
1143160	1148740	Let's continue tasks with Hotmail. Now is I'm gonna send email from
1148740	1154060	mink at walloffship.com to defcomph3 at hotmail.com.
1168090	1174650	Mail has been sent successfully. Now I will check.
1175590	1180510	And no mail inbox, but as you can see, it dropped into the spam box.
1180610	1185500	Hotmail sent this message to the spam box because it couldn't verify its owner.
1185910	1191260	So I am taking note of this. Let's continue tasks with Yahoo mail.
1191690	1197510	I'm gonna send email from mink at walloffship.com to defcomph3 at yahoo.
1197530	1215890	com. Mail has been sent successfully.
1217270	1231470	I'm checking the boxes. I'll tramp again, I think tramp is after me.
1231870	1234730	I will check boxes a few times to be sure.
1239810	1245050	No mail has been received. Yahoo is very strict about this.
1245050	1250210	I take note of this and pass the final external test of Zaha mail.
1250210	1269970	I'm gonna send email from mink at walloffship.com to defcomph3 at zahomail.com.
1270010	1274310	Mail has been sent successfully. I'm checking the boxes.
1278850	1284250	And no mail has been received, so Zaha mail is very strict about this, such as Yahoo.
1284770	1290030	This was our last test. It's time to analyze the information we collect.
1291090	1295210	As an example of my research, I caught a very interesting example.
1295230	1301210	I want to present this to you. My friend was accepted by defcom Red Team Village.
1301210	1308670	This news came to him from omar at redteamvillage.io.
1308750	1315090	When I review this email, there's a warning in the Gmail proper photo area, just like our external
1315090	1321290	test. My friend did not pay attention to this situation and answered this email.
1321930	1328770	Fortunately, the mail really came from Omar, but this could be a fake mail.
1328910	1336570	Now I'm gonna send an email from omar at redteamvillage.io to my friend gmail artist.
1337230	1340550	We're gonna also carry out internal and external testing and
1340550	1347630	look at the response of the email application on the Apple Mac device to this vulnerability.
1348570	1355430	Let's send the mails. I'm gonna send these test mails from my second screen.
1361450	1370390	As you can see, the mail from defcom at gmail.com also cancels a warning in the Gmail web application.
1371070	1378610	However, in the email application of the Mac operating system, this mail does not
1378610	1383290	cancels any warnings. This is a very interesting finding, too.
1383730	1389750	In addition, the mail I sent from Omar successfully reached the application
1389750	1399290	allowed me to pass whether I was Omar or not. Now, time to examine where this vulnerability is
1399290	1406130	caused. Now I'm gonna show where the vulnerability originated. As I have shown before,
1406130	1412010	we're gonna examine why third-party applications cannot detect this little warning in the profile
1412010	1417930	photo area and why are they receiving this training mail cleanly from Gmail.
1418030	1422590	Let's look at what's happening again. Hair.com does not have any warning.
1423430	1430330	Also, HubSpot does not have any warning, too, as you can see.
1431050	1438290	Mail that is perceived as dangerous in Gmail looks completely clean on these platforms.
1438290	1442230	To show that, I'm gonna use Python library writing for the Gmail API.
1442230	1448380	With this library, we're gonna check the email contents by making a request to the Gmail API.
1449130	1454750	First, we need to learn the ID value of the message we want to link.
1456890	1464010	And I think that should be it. I need to put this ID value into the library properly.
1464010	1471450	We also need to use GET instead of LIST. It is now ready to make request again.
1472700	1478930	As you can see, all the details of the mail are here. After a little examination,
1479290	1485450	we realized that the warning in the Gmail web application is not among the information
1485450	1493490	received with the Gmail API. Therefore, we have proved that third-party applications such as
1493490	1499410	Hair.com, HubSpot, and Apple email applications cannot detect this warning because
1499410	1507070	they use the Gmail API. There are dozens of applications using the Gmail API,
1507070	1514710	so this vulnerability caused by Gmail affects them all. In this case, it leaves millions of
1514710	1522390	people directly in danger. These applications which can connect with Gmail need to make a
1522390	1531810	new update considering this situation. Once and for all, let's examine the result of our internal
1531810	1537330	and external test again. Let's take a brief look at the result of our test.
1537330	1545590	I'm going to summarize this part quickly. The meaning of the signs are here. In internal tests,
1545590	1554190	training mails drops into the inbox with warning in Gmail and doesn't drop into any box in Yandex
1554190	1562950	and doesn't drop into any box in Mail.ru and drops into the spam box in Outlook and doesn't drop
1562950	1570990	into any box in Yahoo and doesn't drop into any box in Zahoomail too. In external tests,
1570990	1578950	the training mails drops into the inbox without warning in Gmail and drops into inbox without
1578950	1588670	warning in Yandex and drops into the inbox without warning in Mail.ru and drops into the spam box in
1588670	1596730	Outlook and doesn't drop into any box in Yahoo and doesn't drop into any box in Zahoomail too.
1596770	1603470	Unfortunately, third-party applications using APIs of famous mail providers cannot reflect
1603470	1609450	warnings. Initially, the incoming email is forwarded directly without an error message.
1609750	1616650	So, Hide.com forwarded training mails and mails dropped into the inbox without warning. Also,
1616650	1623610	HubSpot forwarded training mails and mails dropped into the inbox without any warning too.
1623610	1630130	This was the test result with it. I'm sharing an exclusive tool with you at the last stage of my
1630130	1637170	presentation. Its name is DraftChat. DraftChat allows persons to chat throughout mail providers.
1637170	1643570	You can access the GOD chat module, which is the first module and uses the Gmail API.
1644130	1650810	DraftChat allows persons to chat throughout a single Gmail account in the Gmail that does not
1650810	1661550	record drafts. It encrypts the sent message first with DES and then with the AES algorithm and writes
1661550	1669490	them to the created draft. The message of person I've written in encrypted form on the same draft.
1669490	1676450	Message can only be read with the correct case to be determined. In this way, a completely hidden
1676450	1682850	chatroom is created with a single Gmail account. Therefore, DraftChat makes person-hundred private
1682850	1690230	communication opportunity by turning a non-URL mail server into a chat server. You need to set
1690230	1696530	up a common Gmail account to chat with your partner. Remember, you will only perform this
1696530	1703650	operation once. You will not have to do this configuration every time you chat. Let's do the
1703650	1710730	installation pace in a practical way. First step is turn on the Gmail API. First of all, we need to
1710730	1715950	allow for quick start from our Gmail account, because we are using fighting quick start. Click on
1715950	1724410	enable the Gmail API button. In this section, you should choose the desktop. In zone link dialog,
1724410	1731310	click download client configuration and save the file credentials.json to your DraftChat directory.
1731310	1739130	After running DraftChat, it will first ask you for your nickname. Once you have determined
1739130	1745870	your nickname, you must determine whether you want to be a server or a client. Client-server
1745870	1753930	relationship is very simple. If you want to be a server, the DES and AES keys that you determine
1753930	1760670	will be used. If you choose to be a client, you have to get keys for these algorithms from your
1760670	1769870	server partner. Let's say you choose the server option. After the retirement and 8-digit DES key,
1769870	1778010	DraftChat generates a 16-digit random AES key for you and a new draft is created for the chat rooms
1778010	1784330	that your client partner is expected. So you need to pass this case over to your partner.
1785070	1790650	Let's take a look at the client option. In this case, I have taken an entrant from the server
1790650	1797350	partner. If the keys are wrong, there is no server rating for the client, the program will give an
1797350	1804450	error. The taken keys were entered and the information was verified. So you can communicate
1804450	1810530	with your partner in peace of mind. When the draft box of our Gmail account is checked,
1810530	1818550	you can see that a new draft has been created here. All messages are written here and the draft
1818550	1826290	is continuously encrypted with algorithms. We can test this by writing a new message.
1828450	1834870	It's for grids. The fact that you are offered a private chat room does not mean that the
1834870	1842390	communication you provide while using this tool may be illegal. Remember that all the responsibility
1842390	1849430	belongs to you. You can download DraftChat from GitHub. It also opened the development. You can
1850070	1856670	contribute to this tool if you wish. Yes guys, now it's over. Thank you so much for listening to me.
1856670	1862230	You can contact me from my social media accounts and you can ask your question whenever you want.
1862230	1868330	I was honored to be here at DEF CON 28 Package Hacking Village. I hope to present my research
1868330	1874270	at that best hacking conference in the world next year again. I wish healthy days to everyone.
1874270	1875950	Best regards. Goodbye.