Story image

It's possible for cyber attackers to change what's in your emails

24 Aug 17

The contents of a seemingly legitimate email could turn dangerous at second glance, all because of a newly-discovered exploit that allows an attacker to remotely change the content of any email post-delivery.

Researchers at Mimecast discovered the proof-of-concept email attack, dubbed ROPEMAKER, which takes advantages of common web technologies such as HTML, CSS and hypertext.

 The company released a security advisory that details the potential for ROPEMAKER to take advantage of dynamic webpages. Those webpages house resources that are hosted separately but interoperate with each other.  Web control models allow remote hosting and for resources to be fetched without the local user’s control.

This, according to Mimecast, can allow attackers to use technologies like CSS.

“If supported by the presenting application such as the many email clients, a CSS file can be used locally with the markup language file or accessed remotely across the network (generally the Internet).  And of course, the key of this exploit is from a security point of view, is that part of the system is controlled in an untrusted zone.  And instead of controlling just the style of the email, as will be shown below, the remote CSS can actually control the content of the email,” researchers explain.

Attackers can use this technique and others like it to switch a ‘good’ URL to a malicious one, just by changing the remote CSS that is in their control. They could also change text into a malicious content or the perceived wording in that document.

“Or a malicious actor could change the “content” (the presentation of this content) of a delivered email thus impacting the integrity of a business record – changing ‘yes’ to ‘no’ or ‘$1’ to ‘$1M’,” researchers state.

They believe that the possibilities for the exploit go as far as sending the ‘same’ email to different targets but modified content could affect everyone’s replies. They also point out that email archives could no longer be trustworthy.

Although the exploit has not been spotted in the wild, but it doesn’t necessarily mean attackers aren’t already using these techniques.

The only way to prevent attacks is to disable HTML and only allow plain text emails within an organisation, but particular email clients such as Gmail, Outlook and iCloud support presentation of HTML emails but are apparently not affected by these types of exploits.

A response from Microsoft says that the ROPEMAKER style of exploit is not a vulnerability. Apple suggested that every individual user disable the loading of remote content, however Mimecast says this tactic adds risk and complexity.

“Is ROPEMAKER a software vulnerability, a form of potential application abuse/exploit, or a fundamental design flaw resulting from the intersection of Web technologies and email?  Does it really matter which it is? For sure attackers don’t care why a system can be exploited, only that it can be,” researchers conclude. 

Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Preparing for e-invoicing requirements
The New Zealand and Australian governments are working on a joint approach to create trans-Tasman standards to e-invoicing that’ll make it easier for businesses in both countries work with each other and across the globe
5c more per share: Trade Me bidding war heats up
Another bidder has entered the bidding arena as the potential sale of Trade Me kicks up a notch.
Hootsuite's five social trends marketers should take note of
These trends should keep marketers, customer experience leaders, social media professionals and executives awake at night.
Company-X celebrates ranking on Deloitte's Fast 500 Asia Pacific
Hamilton-based software firm Company-X has landed a spot on Deloitte Technology’s Fast 500 Asia Pacific 2018 ranking - for the second year in a row.
Entrepreneur reactivates business engagement in AU Super funds
10 million workers leave it up to employers to choose their Super fund for them – and the majority of employers are just as passive and unengaged at putting that fund to work.
Tether: The Kiwi startup fighting back against cold, damp homes
“Mould and mildew are the new asbestos. But unlike asbestos, detecting the presence – or conditions that encourage growth – of mould and mildew is nearly impossible."
Capitalising on exponential IT
"Exponential IT must be a way of life, not just an endpoint."