认证链中的薄弱环节：电子邮件欺骗攻击的大规模分析
Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks
摘要：
电子邮件作为一种基本的通信服务，在个人和企业通信中发挥着重要作用，这也使其成为最常见的攻击载体之一。电子邮件的真实性基于涉及多个协议、角色和服务的身份验证链，这些协议、角色和服务之间的不一致会造成安全威胁。因此，它取决于链中最薄弱的环节，因为任何失败的部分都可以打破整个基于链的防御。本文系统地分析了电子邮件的传输，并确定了一系列能够绕过SPF，DKIM，DMARC和用户界面保护的新攻击。特别是，通过进行“鸡尾酒”联合攻击，可以伪造更真实的电子邮件，以渗透到著名的电子邮件服务，如Gmail和Outlook。我们对30个流行的电子邮件服务和23个电子邮件客户端进行了大规模的实验，发现它们都容易受到某些类型的新攻击。我们已向相关电邮服务供应商报告发现的漏洞，并获得其中11家供应商的正面回应，包括Gmail、Yahoo、iCloud及阿里巴巴。此外，我们提出了关键的缓解措施，以抵御新的攻击。因此，这项工作对于识别电子邮件欺骗攻击和提高电子邮件生态系统的整体安全性具有重要价值。
英文摘要：
As a fundamental communicative service, email is playing an important role in both individual and corporate communications, which also makes it one of the most frequently attack vectors. An email's authenticity is based on an authentication chain involving multiple protocols, roles and services, the inconsistency among which creates security threats. Thus, it depends on the weakest link of the chain, as any failed part can break the whole chain-based defense. This paper systematically analyzes the transmission of an email and identifies a series of new attacks capable of bypassing SPF, DKIM, DMARC and user-interface protections. In particular, by conducting a "cocktail" joint attack, more realistic emails can be forged to penetrate the celebrated email services, such as Gmail and Outlook. We conduct a large-scale experiment on 30 popular email services and 23 email clients, and find that all of them are vulnerable to certain types of new attacks. We have duly reported the identified vulnerabilities to the related email service providers, and received positive responses from 11 of them, including Gmail, Yahoo, iCloud and Alibaba. Furthermore, we propose key mitigating measures to defend against the new attacks. Therefore, this work is of great value for identifying email spoofing attacks and improving the email ecosystem's overall security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
