EN-Bypass：针对邮件代发提醒机制的安全评估方法

袁静怡; 李子川; 彭国军

doi:10.11959/j.issn.2096-109x.2023041

您当前的位置：

首页 >

文章列表页 >

EN-Bypass：针对邮件代发提醒机制的安全评估方法

学术论文 | 更新时间：2024-06-03

- EN-Bypass：针对邮件代发提醒机制的安全评估方法
- EN-Bypass: a security assessment method on e-mail user interface notification
- 网络与信息安全学报 2023年9卷第3期页码：90-101
- 作者机构：
- 作者简介：
  
  [ "袁静怡（1998- ），女，湖南常德人，武汉大学硕士生，主要研究方向为网络安全" ]
  [ "李子川（1999- ），男，河北邯郸人，武汉大学硕士生，主要研究方向为网络安全" ]
  [ "彭国军（1979- ），男，湖北荆州人，武汉大学教授、博士生导师，主要研究方向为网络安全、信息系统安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62172308);国家自然科学基金;The National Natural Science Foundation of China(U1626107);国家自然科学基金;The National Natural Science Foundation of China(61972297);国家自然科学基金;The National Natural Science Foundation of China(62172144)
- DOI：10.11959/j.issn.2096-109x.2023041
  中图分类号： TP393
- 网络首发：2023-06，
  
  纸质出版：2023-06-25
- 稿件说明：
移动端阅览
袁静怡, 李子川, 彭国军. EN-Bypass：针对邮件代发提醒机制的安全评估方法[J]. 网络与信息安全学报, 2023,9(3):90-101.

Jingyi YUAN, Zichuan LI, Guojun PENG. EN-Bypass: a security assessment method on e-mail user interface notification[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 90-101.
袁静怡, 李子川, 彭国军. EN-Bypass：针对邮件代发提醒机制的安全评估方法[J]. 网络与信息安全学报, 2023,9(3):90-101. DOI： 10.11959/j.issn.2096-109x.2023041.

Jingyi YUAN, Zichuan LI, Guojun PENG. EN-Bypass: a security assessment method on e-mail user interface notification[J]. Chinese Journal of Network and Information Security, 2023, 9(3): 90-101. DOI： 10.11959/j.issn.2096-109x.2023041.

摘要

电子邮件是人们日常生活、工作中非常重要的通信手段，往往被攻击者作为钓鱼攻击的入口，而发件人伪造则是实现邮件钓鱼攻击的关键步骤。为防止发件人伪造攻击，邮件厂商往往会部署 SPF、DKIM和 DMARC 等邮件安全协议来验证发件人身份，除此之外，部分厂商会在前端添加代发提醒机制辅助用户判断邮件的真实来源，以降低用户受到钓鱼邮件威胁的可能。但是业界并没有统一标准对代发提醒机制的实现进行规范，各厂商的代发提醒机制实现各不相同，其实现上能否有效防止发件人伪造攻击仍缺少测试和验证。对邮件服务厂商代发提醒机制进行研究，旨在评估厂商邮件代发提醒机制的安全性，消除攻击者绕过代发提醒机制实现发件人伪造的潜在安全威胁。对10个国内外邮件厂商进行调研，其中有7个厂商部署了代发提醒机制。在测试基础上提出了一种新型发件人伪造攻击——EN-Bypass 攻击，该攻击通过构造和变换邮件头中的From和Sender字段，绕过邮件代发提醒机制以实现发件人伪造。为了自动化验证代发提醒机制的安全性和可靠性，基于EN-Bypass攻击的思路实现了工具EmailSenderChecker，用于对厂商代发提醒机制进行自动化测试。实验结果表明，7 个厂商的代发提醒机制均存在不同程度的安全漏洞，攻击者通过构造特殊的邮件头部可以绕过代发提醒机制，实现发件人伪造攻击。最后，为了提高邮件服务的安全性，就邮件厂商代发提醒机制存在的问题，向邮件服务厂商提出了安全建议。

Abstract

Email plays an important role in people’s daily communications

while also attracts the attention of hackers.Email is frequently used in phishing attacks

with email sender spoofing being a key step.To prevent sender-spoofing attacks

email vendors often deploy email security protocols such as SPF

DKIM

and DMARC to verify the sender’s identity.Moreover

some vendors add email UI notification mechanism on email clients to help users identify the real sender.However

there is no uniform standard in the implementation of the email UI notification mechanism

which varies among vendors.Whether the mechanism effectively prevents sender-spoofing attacks still needs verification.In this paper

the security evaluation of the email UI notification mechanism was studied to gain better understanding of its efficacy and to eventually protect users from sender-spoofing attacks.Ten world-famous email services were researched and evaluated

of which seven deployed the email UI notification mechanism.Consequently

a new type of sender-spoofing attack was proposed which was called EN-Bypass

aiming to bypass the email UI notification mechanism by forging the “From” and “Sender” fields in the email header.To verify the email UI notification mechanism’s security and reliability

EmailSenderChecker was implemented

which can automatically evaluate the existence of the EN-Bypass attack.The result shows that all seven email service vendors suffer from EN-Bypass attack.Attackers could bypass the email UI notification mechanism by constructing special email headers and spoofing the sender.Finally

to improve the mail service security

three suggestions about the email UI notification mechanism were proposed for the mail service vendors.

关键词

Keywords

references

AL-MUSIB N S , AL-SERHANI F M , HUMAYUN M , et al . Business email compromise (BEC) attacks [J ] . Materials Today:Proceedings , 2021 .

WONG M , SCHLITT W . Request for comments 7208,sender policy framework (SPF) for authorizing use of domains in email,version 1 [S ] . RFC Editor , 2006 .

CROCKER D , HANSEN T , KUCHERAWY M . Request for comments 6376,Domainkeys identified mail (dkim) signatures [S ] . RFC Editor , 2011 .

KUCHERAWY M , ZWICKY E . Request for comments 7489,domain-based message authentication,reporting,and conformance (DMARC) [S ] . RFC Editor , 2015 .

HU H , PENG P , WANG G . Towards understanding the adoption of anti-spoofing protocols in email systems [C ] // IEEE Secure Development Conference (SecDev) . 2018 : 94 - 101 .

HU H , WANG G . End-to-end measurements of email spoofing attacks [C ] // 27th USENIX Security Symposium (USENIX Security 18) . 2018 : 1095 - 1112 .

尚菁菁 , 朱宇佳 , 刘庆云 . 电子邮件安全扩展协议应用分析 [J ] . 网络与信息安全学报 , 2020 , 6 ( 6 ): 69 - 79 .

SHANG J J , ZHU Y J , LIU Q Y . Analysis of security extension protocol in e-mail system [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 6 ): 69 - 79 .

CHEN J , PAXSON V , JIANG J . Composition kills:a case study of email sender authentication [C ] // 29th USENIX Security Symposium (USENIX Security 20) . 2020 : 2183 - 2199 .

SHEN K , WANG C , GUO M , et al . Weak links in authentication chains:a large-scale analysis of email sender spoofing attacks [C ] // 30th USENIX Security Symposium (USENIX Security 21) . 2021 : 3201 - 3217 .

DECCIO C , YADAV T , BENNETT N , et al . Measuring email sender validation in the wild [C ] // Proceedings of the 17th International Conference on Emerging Networking Experiments and Technologies . 2021 : 230 - 242 .

KLENSIN J . Request for comments 5321,simple mail transfer protocol [S ] . RFC Editor , 2008 .

RESNICK P . Request for comments 5322,Internet message format [S ] . RFC Editor , 2008 .

浏览量

183

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

电子邮件安全扩展协议应用分析