Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability

Chuhan Wang, Chenkai Wang, Songyi Yang, Sophia Liu, Jianjun Chen, Haixin Duan, Gang Wang

34th USENIX Security Symposium · Day 1

This groundbreaking research paper delves into the profound implications of **SMTP smuggling**, a sophisticated email spoofing vulnerability that bypasses established authentication protocols like **SPF** (Sender Policy Framework) and **DMARC** (Domain-based Message Authentication, Reporting & Conformance). First publicly disclosed in December 2023, SMTP smuggling exploits inconsistencies in how different Mail Transfer Agents (MTAs) process the end-of-data indicator within an SMTP DATA command, allowing attackers to embed malicious SMTP commands within an email body and "smuggle" a second, spoofed email. The study provides the first comprehensive evaluation of this vulnerability, assessing its prevalence across public email services, open-source email software, and email security gateways.

AI review

Solid measurement paper that does the unglamorous work of systematically quantifying SMTP smuggling's real-world footprint. The null-byte payload variants are a genuine contribution, and the shared-SPF amplification analysis is the kind of thing defenders actually need to prioritize patching. Not a novel attack class, but the first rigorous treatment of one.