Phish & Furious: Unraveling Campaign Builder Vulnerabilities in a Blink-and-Breach World
summary
Claims that email campaign platforms let attackers spoof entire domains: in Nov 2023 MailChimp allows signing up with one verified address and sending as any address on that domain, using plain-text campaigns plus short links that MailChimp masks to the target domain to appear legitimate. Feb 2024 tightens HTML sending but plain-text bypass remains. Responsible disclosure is closed out by the vendor; recommended fixes are rollout of SPF DKIM DMARC and vendor-side controls to block the verify-one-address exploit.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:30Basics of email security
- 3:37Phishing campaign four-part saga
- 5:04MailChimp exploit in 2023
- 6:32Security changes in 2024
- 8:19Plain text email exploit demo
- 10:51Responsible disclosure and responses
- 12:39Fundamentals of security controls
- 14:50Call to action and community effort
- 20:36Q&A session begins
- 31:13Closing remarks
related talks
27mPhish & Furious: Campaign Builder Vulnerabilities in a Blink &...
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
26mDon't Blame the User! Stop the Phish Before it is Even Sent
44mModern Email Security
24mEnd-to-End Measurements of Email Spoofing Attacks
31mAnatomy of a Phishing Campaign
54mDark Fairytales From A Phisherman
20m"Return to Sender: Bypassing Email Spam & Malware Filters"