Are you using one of the 33 eMail clients that could be exploited by MailSploit?

German security researcher Sabri Haddouche has discovered a set of vulnerabilities that he collectively refers to as Mailsploit, and which allow an attacker to spoof email identities, and in some cases, run malicious code on the user's computer



The real issue is the email spoofing attack that circumvents all modern anti-spoofing protection mechanisms such as DMARC (DKIM/SPF) or various spam filters.



The full list is given here:
https://docs.google.com/spreadsheets/d/1jkb_ZybbAoUA43K902lL-sB7c1HMQ78-fhQ8nowJCQk/htmlview?sle=true




For More:
https://blog.knowbe4.com/mailsploit-bypasses-dmarc-and-lets-attackers-send-spoofed-phishing-emails-on-over-33-email-clients

BoundHook, GhostHook - These are not fishing terms, these are exploits

BoundHook exploits a feature in all Intel chips  -To  cause an exception in a specific memory location in a user-mode context. Next, it is able to catch the exception and gain control over the thread execution used by a specific application. For example, the technique could allow for the interception of a keyboard event message passed between Windows and a specific service, allowing an attacker to capture or manipulate a victim’s keystrokes

GhostHook - Attack method bypassed Microsoft’s attempts to prevent kernel level attacks (via PatchGuard) and used the hooking approach to take control of a device at the kernel level.

Strange but True:
Microsoft and Intel don’t see either as a vulnerability on their end. Both told CyberArk it will not patch the issue because the attack requires that the adversary already has already fully compromised the targeted system


More Here:
https://threatpost.com/boundhook-attack-exploits-intel-skylake-mpx-feature/128517/

Can you change a benign email to a malicious one after it has been sent? - YES , we have ROPEMAKER

Ropemaker - stands for Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky

A successful exploitation of the Ropemaker attack could allow an attacker to remotely modify the content of an email sent by the attacker itself, for example swapping a URL with the malicious one.

This can be done even after the email has already been delivered to the recipient and made it through all the necessary spam and security filters, without requiring direct access to the recipient’s computer or email application, exposing hundreds of millions of desktop email client users to malicious attacks.


More Details Here:
https://thehackernews.com/2017/08/change-email-content.html

You have email gateway and you think you are secure - Not if Split tunnel SMTP Tunnel Exploit works

Security vendor Securolytics this week claimed it has devised an exploit that allows an attacker to bypass an organization's email security gateway and directly unload malware on the email server by using the encryption device as a backdoor.

More Info here:

http://www.darkreading.com/attacks-breaches/split-tunnel-smtp-exploit-bypasses-email-security-gateways/d/d-id/1328963?_mc=sm_dr&hootPostID=2ed0edb846d2ad345a88517a2cab958a

Ever heard of UXSS - Universal Cross-Site Scripting

According to the article:- 

Unlike the common XSS attacks, UXSS is a type of attack that exploits client-side vulnerabilities in the browser or browser extensions in order to generate an XSS condition, and execute malicious code. When such vulnerabilities are found and exploited, the behavior of the browser is affected and its security features may be bypassed or disabled.

The net effect of this is the fact that the attacker doesn't just get access to a compromised session on a vulnerable web page, but may get access to any session belonging to web pages currently opened (or cached) by the browser at the time the attack is triggered.

Simply put, UXSS does not need a vulnerable web page in order to trigger, and can penetrate web sessions belonging to secure, well written web pages, thus creating a vulnerability where there isn’t one

Well-known vulnerabilities exploitable by UXSS:

1. Vulnerability in the Adobe Acrobat extension for Internet Explorer 6 (or Mozilla plugin)
2. Flaw in the XSS filters of Internet Explorer 8.
3. Flash Player UXSS Vulnerability - CVE-2011-2107
4. Vulnerability in Chrome for Android

The links below has more information:

http://www.acunetix.com/blog/web-security-zone/universal-cross-site-scripting-uxss

Zero Day exploit Business - Aptly called “the modern-day merchants of death” selling “the bullets of cyberwar.”

This article is 2 years old so, we can imagine what it would be today

Here is a rough price list

ADOBE READER                                     $5,000-$30,000

MAC OSX                                                $20,000-$50.000

ANDROID                                                $30,000-$60.000

FLASH OR JAVA BROWSER PLUG-INS $40,000-$100,000

MICROSOFT WORD                                 $50,000-$100,000

WINDOWS $60,000-$120,000

FIREFOX OR SAFARI $60,000-$150.000

CHROME OR INTERNET EXPLORER        $80.000-$200,000

iOS         $100,000-$250,000

The links below has more details:

http://www.forbes.com/sites/andygreenberg/2012/03/23/shopping-for-zero-days-an-price-list-for-hackers-secret-software-exploits/