Phish & Furious: Campaign Builder Vulnerabilities in a Blink &...

Phish & Furious: Campaign Builder Vulnerabilities in a Blink &...

Speakers: Raae Wolfram

Conference: BSidesSF 2024

YouTube: https://www.youtube.com/watch?v=W6sMOLNFZh0

Overview

This talk, "Phish & Furious: Campaign Builder Vulnerabilities in a Blink &...", presented by Raae Wolfram, a Senior Product Manager at Microsoft, delves into the often-overlooked security vulnerabilities inherent in popular email campaign builders and marketing platforms, such as MailChimp. The presentation meticulously dissects how these legitimate tools, designed for mass email distribution, can be readily exploited by malicious actors to craft highly convincing phishing attacks. Wolfram highlights critical aspects of these exploits, including trust manipulation and the scalability of such attacks, while also offering practical strategies for mitigation.

The core of the discussion revolves around the persistent gaps in email security, even in the wake of significant industry pushes for stronger authentication protocols like DMARC. Wolfram demonstrates how, despite some improvements in securing HTML-based email campaigns, a critical vulnerability remains in the handling of plain text emails. This oversight allows attackers to spoof sender identities and manipulate URLs, making phishing attempts appear legitimate, especially on mobile devices. The talk serves as a crucial wake-up call for cybersecurity practitioners, emphasizing the need to understand and combat these evolving phishing threats by reinforcing fundamental security practices and advocating for shared responsibility between organizations and service providers.

Background

▶ Watch: Talk introduction: exploiting campaign builders for phishing. (01:20)

To fully grasp the vulnerabilities discussed, it's essential to establish a foundational understanding of email security protocols. Raae Wolfram begins by outlining the "trio" or "trifecta" of email security: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). While each protocol can function independently, their true power and the resilience of an organization's cybersecurity posture are unleashed when they are deployed in concert.

SPF is the ground floor of this security framework. Conceptually, it acts like an employee directory for a domain, validating whether a specific email server is authorized to send mail on behalf of that domain. When a mail server receives an email, it checks the sender's IP address against the SPF record, which lists permitted IP addresses. If the IP address doesn't match, the email fails the SPF check, indicating a potential spoofing attempt. SPF records can be configured with either a soft fail (more permissive, allowing the email to be delivered but flagged) or a hard fail (more restrictive, leading to the email being dropped). While SPF is crucial for validating the sender's identity, it does not address the integrity of the email's content.

This is where DKIM comes into play. DKIM provides a mechanism to validate the integrity of the email content, ensuring that it has not been tampered with or compromised during transit. It uses cryptographic signatures to verify that the email's content and certain headers have not been altered since they were signed by the sender's domain. DKIM builds upon SPF, working to confirm that the message itself is authentic and untampered.

Finally, DMARC brings these two protocols together, providing a policy layer that dictates how receiving mail servers should handle emails that fail SPF or DKIM checks. DMARC allows organizations to specify actions such as "none" (monitor only), "quarantine" (send to spam), or "reject" (block entirely). Crucially, DMARC also provides reporting and auditing logs, offering invaluable insights into email traffic and activity, which is vital for security operations centers (SOCs) to proactively identify and respond to threats. The speaker emphasizes that DMARC's effectiveness is entirely dependent on both SPF and DKIM being properly enabled and operational within an environment.

The problem arises when legitimate tools, designed for mass communication, are not fully aligned with these security protocols or have inherent design flaws that can be exploited. Email campaign builders like MailChimp are essentially "glorified content builders" that enable organizations to distribute emails at scale. While incredibly useful for marketing and legitimate communications, their very nature of sending emails on behalf of various domains makes them a prime target for abuse if not adequately secured. The talk explores how attackers can leverage these platforms, even with basic access, to bypass traditional email security checks and launch sophisticated phishing campaigns.

Key Findings

▶ Watch: Attack methodology: 4 steps to exploit campaign builders. (08:30)

Raae Wolfram's research uncovered several critical findings regarding the vulnerabilities in email campaign builders, particularly highlighting the disparity in security controls between different email formats.

Initially, the speaker found that platforms like MailChimp were "a lot more permissive." It was possible to construct elaborate HTML campaigns using outdated, non-administrative domain credentials. This meant that an attacker with access to even a basic, non-privileged email account within a target domain could create highly polished, simulated phishing campaigns that appeared legitimate. This capability represented a significant risk, as HTML emails can be visually convincing and often contain interactive elements designed to trick users.

However, a significant industry initiative led by Google and Yahoo in early 2024 introduced new requirements. These tech giants mandated that services sending at least 5,000 emails per day must have DMARC enabled in their environment, which in turn necessitates the deployment of SPF and DKIM. In response to this "Brave New World," MailChimp implemented technical controls that restricted the ability to arbitrarily set the sender for HTML campaigns. Now, if a user attempts to send an HTML email from a sender not validated with the account, MailChimp requires confirmation, often through multi-factor authentication (MFA), effectively closing this particular vulnerability.

Despite this improvement, Wolfram identified a critical remaining vulnerability in plain text email campaigns. Even after the DMARC-driven changes, it is still possible to create a campaign builder account using a legitimate, validated email address (e.g., [email protected]) and then send plain text emails with a spoofed "from" name and an illegitimate "from" email address. For instance, the "from" name could be altered to "University help desk," "the bursar," "Hospital provider," or "Financial services," while the "from" email address could be set to something like [email protected], which doesn't even need to exist. This allows for highly effective impersonation across various industries.

The most alarming finding related to plain text emails is the platform's automatic URL transformation. When any URL is dropped into a plain text email within the campaign builder, the platform automatically prepends the domain associated with the registered account to the beginning of the URL. This creates a vanity URL that appears to be part of the legitimate, spoofed domain. For example, if the account was registered with [email protected] and a link to a Rick Rolling YouTube video is inserted, the recipient will see a URL that looks like school.edu/rickroll or similar, making it appear as a legitimate sub-page of the university's domain.

Furthermore, the presentation highlighted a crucial difference in how these spoofed emails appear on different devices. While desktop email clients might append a "via MailChimp" or similar flag next to the sender's name, serving as a potential red flag for savvy users, this indicator is often absent on mobile devices. On mobile, the impersonated identity, modified "from" name, and transformed URL appear "pristine" and "seamless," significantly increasing the likelihood of deception.

When these findings were reported to the service provider (MailChimp), the HTML vulnerability was addressed due to the DMARC initiative. However, the plain text vulnerability was deemed "out of scope" because it was not considered a "technical code infrastructure" issue for the platform itself. The service support team explicitly stated that the responsibility for mitigating this plain text feature falls squarely on the shoulders of the individual organizations using the platform, creating a significant gap in shared responsibility.

Technical Deep Dive

▶ Watch: Key finding: MailChimp's HTML restrictions vs. plain text vulnerability due t... (11:00)

The technical deep dive into the "Phish & Furious" attack methodology reveals a four-part saga, leveraging the inherent design of email campaign builders to bypass traditional security controls.

Step 1: Obtain Domain Credentials. The initial phase of the attack requires access to active domain credentials. Wolfram notes that these do not necessarily need to be administrative privileges. Even an outdated or non-privileged account, such as a student account, can suffice if its credentials remain active. This initial access can be gained through various means, including insider threats, compromised accounts, or organizations failing to adhere to fundamental security operations like regular credential expiration. As long as an attacker has access to an active email account within the target domain, they are "off to the races."

Step 2: Set Up Campaign Builder Account. With valid domain credentials in hand, the attacker proceeds to set up an account on an email campaign builder platform, such as MailChimp. This process is described as "pretty straightforward." The key requirement here is to validate the account using a legitimate email address from the target domain (e.g., [email protected]). While other registration information can be fictitious, the legitimate domain email address is crucial for the platform's validation process, establishing a deceptive veneer of authenticity.

Step 3: Craft the Campaign/Email. This is where the attacker leverages the platform's features to create the phishing lure.

Initially, before the industry-wide DMARC push, MailChimp was highly permissive. Attackers could build "more elaborate HTML campaigns" and arbitrarily set the sender's identity. This allowed for the creation of visually convincing emails that could mimic legitimate organizational communications, complete with branding, images, and interactive elements. The speaker's early research demonstrated the ease with which "really polished looking simulated fishing campaigns" could be created without any special administrative privileges.

However, the landscape shifted in early 2024 due to a joint initiative by Google and Yahoo. These companies began requiring DMARC enablement for services sending over 5,000 emails per day. In response, MailChimp implemented a crucial technical control: it restricted the ability to arbitrarily set the sender for HTML campaigns. Now, if an account registered with [email protected] attempts to send an HTML email from a different sender, the platform requires validation, often through multi-factor authentication (MFA), to confirm the sender's legitimacy. This effectively closed the HTML campaign vulnerability.

Despite this improvement, a significant technical control gap persists for plain text emails. The speaker demonstrated that even after the DMARC-driven changes, an attacker can still:

• Alter the "from" name: The plain text "from" name can be changed from the registered name (e.g., "John Smith") to a highly convincing, spoofed identity like "University help desk," "the bursar," "Hospital provider," or "Financial services." This adds a layer of legitimacy and believability to the email.
• Modify the "from" email address: The actual "from" email address can also be changed. Crucially, this email address "doesn't even have to be legitimate, doesn't even have to exist." The speaker successfully sent messages using [email protected], highlighting the lack of validation for the plain text sender's email address.
• Automatic URL Prepending: This is the "pièce de résistance" of the plain text exploit. When any URL is inserted into the plain text email content, the campaign builder platform automatically modifies it. It prepends the domain that the account was registered with to the beginning of the URL. For example, if the account was registered with [email protected] and the attacker inserts https://www.youtube.com/watch?v=dQw4w9WgXcQ (a Rick Roll link), the recipient will see a URL that appears as school.edu/youtube-link or similar. This transformation makes the malicious link appear to be an internal or legitimate sub-page of the spoofed organization's domain, significantly enhancing its credibility.

Step 4: Reak Havoc. Once the plain text campaign is crafted with the spoofed sender and manipulated URL, the attacker can distribute it at scale. The speaker notes that while HTML emails might seem "more compelling," plain text emails are frequently used by organizations for "broadcast messages, critical alerts, important time-sensitive information." This makes plain text a highly effective vector for phishing, as users are conditioned to trust such communications. The seamless appearance of these spoofed emails on mobile devices, without the "via MailChimp" flag seen on desktops, further amplifies their effectiveness.

The speaker's theory for why plain text remains vulnerable while HTML is secured is that plain text might be perceived as "not as compelling" or "not as sophisticated." However, this overlooks the critical scenarios where plain text is used, making it a "riskier vector" that needs urgent attention.

Demo / Proof of Concept

▶ Watch: Vendor response: MailChimp deems plain text spoofing 'out of scope' / organiz... (18:00)

Raae Wolfram provided a clear demonstration, or proof of concept, of the plain text phishing vulnerability within a campaign builder platform. While not a live, real-time attack, the presentation included screenshots and detailed descriptions of the steps taken to illustrate the exploit.

The demonstration began by showing the setup of a plain text fishing email. The speaker explained that they had registered an account with a legitimate-looking email address, for instance, [email protected]. This initial registration with a valid domain email is crucial for the platform's internal validation, even if the subsequent sender details are spoofed.

Next, the speaker demonstrated how the "from" name could be altered. Instead of the name associated with the registered account, it was modified to a more authoritative and trustworthy identity, such as "University help desk." The flexibility to change this name was highlighted, noting that it could be adapted to various industries, including "the bursar" for education, "Hospital provider" for healthcare, or "Financial services." This capability significantly enhances the believability of the impersonation.

Following this, the "from" email address was also modified. The speaker successfully sent messages where the "from" email address was set to [email protected]. A key point emphasized was that this modified email address "doesn't even have to be legitimate, doesn't even have to exist," yet the platform still allowed the email to be sent, further underscoring the lack of sender validation for plain text.

The most impactful part of the demonstration involved the URL transformation. The speaker explained that when a URL, even a benign one like a "Rick Rolling YouTube video," is dropped into the plain text email content during creation, the campaign builder platform automatically modifies it. It prepends the domain that the account was registered with (e.g., school.edu) to the beginning of the URL. This results in a "vanity URL" that appears to be a legitimate part of the spoofed domain (e.g., school.edu/rickroll-link), regardless of the original URL's destination. This automatic modification makes the link seem trustworthy to the recipient.

Finally, the demonstration included a visual comparison of how the spoofed email appears on different devices. On a desktop view, the email might show a "via MailChimp" or similar tag appended to the sender's name, which could serve as a "red flag" for more "savvy end users." However, the speaker stressed that on mobile devices, this crucial indicator is typically absent. On mobile, the email appears "pristine," "seamless," and "flawlessly" delivered, with the impersonated identity, modified title, and transformed URL all contributing to a highly convincing phishing attempt. This difference in rendering significantly increases the risk for mobile users.

The speaker confirmed that these were simulated phishing campaigns, not actual attacks, designed to expose the vulnerability. The demonstration effectively illustrated how, despite the platform's appropriate addressing of HTML vulnerabilities, a significant gap remains in the handling of plain text emails, making them a potent tool for trust manipulation.

Defensive Implications

▶ Watch: Call to action: Shared responsibility and impact of industry leaders. (20:00)

The findings presented by Raae Wolfram carry significant defensive implications for organizations striving to protect themselves against sophisticated phishing attacks. Given that service providers like MailChimp have, in some cases, deemed these plain text vulnerabilities "out of scope" and placed the burden on individual organizations, a multi-faceted defensive strategy is crucial.

Firstly, organizations must rigorously implement and configure the email security trio: SPF, DKIM, and DMARC. While SPF and DKIM are foundational, the speaker emphasizes that DMARC is the "hallmark" of a robust email security program. Organizations should move beyond a "none" (monitoring) DMARC policy and aim for a "quarantine" or, ideally, a "reject" policy to actively block emails that fail authentication checks. This requires careful planning and monitoring to avoid legitimate emails being blocked, but it is essential for preventing spoofing. Furthermore, SPF records should be configured conservatively, opting for "hard fail" where appropriate to ensure that unauthorized senders are unequivocally rejected.

Secondly, end-user education is paramount. While technical controls are vital, the human element remains the weakest link. Organizations must invest in continuous training to educate employees about the evolving nature of phishing threats. Users should be taught to recognize red flags, even subtle ones. For instance, while the "via MailChimp" tag might appear on desktop, users should be aware that such indicators might be absent on mobile. Training should cover how to scrutinize sender names, email addresses, and especially URLs, even if they appear to be part of a legitimate domain. Emphasizing the importance of reporting suspicious emails, regardless of how convincing they seem, is also critical.

Thirdly, organizations can implement internal technical controls to augment their defenses. This could include deploying email gateway solutions that perform advanced threat analysis, URL rewriting, and content inspection. Some solutions can add internal banners or flags to emails originating from external sources, even if they appear to come from an internal domain. This provides a clear visual cue to the recipient that the email did not originate from within the organization's trusted network, regardless of the spoofed sender information.

Fourthly, credential hygiene is a fundamental defensive measure. The attack's first step relies on obtaining active domain credentials, even non-administrative ones. Organizations must enforce strong password policies, multi-factor authentication (MFA) for all accounts, and regular credential expiration. Implementing least privilege principles ensures that even if an account is compromised, the attacker's lateral movement and capabilities are severely limited. Regular auditing of active accounts and their privileges can help identify and deactivate outdated or unnecessary credentials.

Finally, organizations should actively engage with their service providers and advocate for improved security. While MailChimp deemed the plain text vulnerability out of scope, the speaker highlights the concept of "shared responsibility" and "good upstanding cyber citizenship." If enough organizations raise concerns and demand parity in security controls across all email functionalities (HTML and plain text), it could incentivize vendors to address these gaps. Leaders in the space, like Google and Yahoo, have demonstrated the impact of setting industry standards, and organizations should leverage this precedent to push for better security from their vendors.

In summary, defending against these campaign builder vulnerabilities requires a holistic approach: strengthening core email authentication, empowering users through education, implementing supplementary technical controls, maintaining stringent credential hygiene, and advocating for greater vendor responsibility.

Key Takeaways

• Email campaign builders, despite their legitimate uses, harbor significant vulnerabilities that can be exploited for highly effective phishing attacks. The ease with which these platforms can be leveraged for malicious intent, even with basic domain credentials, poses a substantial risk.
• Industry-led DMARC initiatives have improved security for HTML email campaigns, but a critical gap persists in plain text email functionality. While platforms like MailChimp have implemented controls for HTML sender validation, plain text emails remain largely unaddressed, creating an asymmetrical security posture.
• Plain text phishing, though seemingly less sophisticated, is highly effective due to automatic URL transformation and seamless mobile rendering. The platform's feature of prepending the registered domain to any inserted URL makes malicious links appear legitimate, and the absence of "via" tags on mobile devices significantly enhances deception.
• Service providers often shift the burden of mitigating plain text email vulnerabilities to individual organizations, highlighting a gap in shared responsibility. This necessitates that organizations take proactive measures, as vendors may not consider these issues as "technical code infrastructure" vulnerabilities.
• Comprehensive email security requires robust implementation of SPF, DKIM, and DMARC, coupled with vigilant end-user education and internal controls. Organizations must move towards stricter DMARC policies, educate users on identifying subtle phishing cues, and consider internal email flagging mechanisms.
• Preventing initial access through strong credential hygiene is fundamental. As the attack's first step relies on obtaining active domain credentials, enforcing strong passwords, MFA, and regular credential expiration is crucial to mitigate the risk.

About the Speaker(s)

Raae Wolfram is a Senior Product Manager at Microsoft, where she contributes to building the company's managed security services organization. With over a decade of experience in the technology space, Wolfram has taken an "incredibly unconventional route" to her current role, having previously served as an IT system administrator and project manager. She describes herself as a "native New Yorker" and a "Puerto Rican kid from the Bronx," expressing pride in her journey and representation. Wolfram is also a mother to a 5-year-old, a Star Trek fan, and openly shares that she underwent brain surgery and radiation in 2022. Humorously, she notes the irony of presenting a "Fast and Furious"-themed talk despite not driving herself. Her diverse background and personal experiences underscore her unique perspective on cybersecurity challenges.