CFOtech Australia logo
Technology news for Australian CFOs and financial decision-makers
Story image

Hundreds of Australian corporations identified with email security vulnerabilities

By Sebastian Salla
Tue 11 Jan 2022

Security researcher Sebastian Salla from CanIPhish.com has found 264 often well-known Australian corporations who have email security vulnerabilities.

Here is his blog:

My name’s Sebastian Salla and I’m a Security Researcher who specialises in Cloud and Email Security. A couple of months ago I started looking into ways an attacker could compromise the email security of Australian organisations. Fortunately, I’ve created various toolings over the years (all of which are accessible at https://caniphish.com) which aided in this research.

I ultimately decided to see if I could impersonate Australian organisations while passing all email authentication checks. I started off by scanning a few hundred domains, which eventually led to me scanning 1.8 Million Australian domains. The outcome of this research would be to see if I can send SPF authenticated emails from the scanned domains and ultimately report the vulnerabilities back to those organisations affected.

To perform this scan, I would look up a domain and see if any of the IP addresses listed in their SPF records overlapped with the public IP ranges offered by Amazon Web Services (AWS). I then checked to see if I could take over any unused IPs. The results of the experiment were pretty eye-opening. I compromised the email supply chain of 264 Australian organisations, some of which are the most respected institutions in Australia.

The Scanning Process

The first challenge was to figure out how to gather up-to-date listings of Australian domains. To do this I used three methods GitHub. ASX200 and Sublist3r. Using a GitHub project called 'domains' I gathered around 99% of the domains that ended up being scanned. Some ASX200 domains were missed with the Github project - some businesses use a .com top-level domain (TLD) structure instead of .com.au. Finally, I ran Sublist3r which aggregates information from various open-source intelligence sources to collect information on domains. I queried information on all domains that use .com.au, .org.au, .net.au, .edu.au and .gov.au as their TLD structure… and with that, I had my list of domains.

I quickly realised that extracting each domain's full email-sender supply chain (SPF record) one by one just wouldn't be feasible. I’d be I'm querying 6 SPF records per domain. That's 10.8 Million DNS requests! That’s where Lambda functions came in. Lambda is an AWS cloud compute that runs code in a highly efficient manner and is designed exactly for my use case. I now had the ability to have the same piece of code running 100s of times concurrently. Each lambda function would scan 15 domains and save the results into a DynamoDB (NoSQL) database. I then kept the Lambda functions running for 25 hours!

After 25 hours, I exported the supply chain data and filtered it down to only the IP addresses associated with AWS' EC2 IP Address Pools. This gave me the idea of where I should focus my efforts: AWS' ap-southeast-2, eu-central-1, us-east-1, us-west-1 and us-west-2 regions.

Discovering available AWS IPs

Once the scan was complete I now needed to figure out how I could discover all of the available AWS IPs. To keep the costs down, I ran 50 t3a.nano EC2 instances across 5 regions and restarted them every minute. With each restart, the EC2 instances would get a new public IP and I'd then cross-reference the IP to all the IPs found during the email supply chain extraction process.
After 20 hours of restarting EC2 instances, I had a large enough sample set to begin trawling through the results. Keep in mind, AWS reserves 56,080,253 IPs for EC2 instances. That means I’ve only scanned just over 0.1% of the address space (approx. 1 in 1000 IPs), so I've barely scratched the surface!

The Results

Ultimately, I found I had compromised the email sender supply chain for 264 Australian organisations and to my shock, it contained some of the most respected institutions in Australia. These were a few that really stuck out:

  • qtc.com.au (Queensland Treasury Corporation)
  • mirvac.com (Mirvac - ASX200 Listed Company)
  • charterhall.com.au (Charter Hall - ASX200 Listed Company)
  • aph.gov (Australian Parliament House)
  • usyd.edu.au (University of Sydney)
  • sydney.edu.au (University of Sydney)

To validate that the vulnerabilities were real I sent myself a single test email, appearing to come from Australian Parliament House (aph.gov.au). The email passed all SPF and DMARC checks and went straight into my inbox - evading any spam filtering. This is in stark contrast to an otherwise flawlessly configured SPF & DMARC record for aph.gov.au, where the ultimate downfall is the inclusion of a single over-permissive IP address block. (wasn’t sure how to re-write this)

What does this mean for the Organisations?

Each of the affected 264 organisations and their recipients is significantly more susceptible to phishing attacks and business email compromise (BEC). Anyone with a credit card can sign-up for an AWS account, find a desirable IP, request AWS to remove any SMTP restrictions and start sending SPF authenticated emails, masquerading as any of these organisations.
As an example of the possible impacts and risks, a parliamentary staffer could receive an email that appears to come from a Minister, or a student could receive an email from some posing as from university admissions. The recipients in these cases have a way to determine real emails from the fake, the risks involved in both these examples don’t need to be spelt out considering the position and standing of the organisations involved.

This experiment reiterates the importance of organisations managing their email supply chain to ensure your organisation and downstream customers aren't introduced to unnecessary risks relating to email threats.

This blog originally appeared here.

Related stories
Top stories
Story image
Employment
Tech job moves - Forcepoint, Malwarebytes, SolarWinds & VMware
We round up all job appointments from May 13-20, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Vectra AI
Understanding the weight on security leader’s shoulders, and how to shift it
Millions of dollars of government funding and internal budgets are being funnelled into cybersecurity to build resilience against sophisticated threats, indicating how serious this issue has become.
Story image
Cybersecurity
More than 40% of banks worried about cloud security - report
Publicis Sapient's new report finds security and the lack of cloud skills and internal understanding of business benefits are big obstacles for banks moving to the cloud.
Story image
Ransomware
Alarming surge in Conti Ransomware Group activity - report
A new report has identified a 7.6 per cent increase in the number of vulnerabilities tied to ransomware in Q1 2022.
Story image
Talend
Talend introduces new data health solutions for businesses
Talend has announced its latest version of Talend Data Fabric, with the release of Talend Trust Score enabling data teams to establish a foundation for data health.
Story image
Tech job moves
Tech job moves - Datacom, Micro Focus, SnapLogic and VMware
We round up all job appointments from May 6-12, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Telstra
Telstra, Google and Accenture launch 5G AR experience for AFL
Telstra, Google and Accenture are developing a new 5G powered augmented reality (AR) experience at Melbourne's Marvel Stadium for the footy season.
Story image
Artificial Intelligence
SAS launches human-focused responsible innovation initiative
SAS has launched a responsible innovation initiative, furthering its commitment to equity and putting people first.
Story image
Sisense
Data and analytics could be key to higher selling prices in APAC
Sisense's latest report has found that almost half of data professionals in APAC think customised data and analytics can create better selling prices for their products.
Story image
Sift
Sift shares crucial advice for preventing serious ATO breaches
Are you or your business struggling with Account Takeover Fraud (ATO)? One of the latest ebooks from Sift can provide readers with the tools and expertise to help launch them into the new era of account security.
Story image
Testing
Google and CSIRO use AI to help protect the Great Barrier Reef
Google has partnered with CSIRO in Australia to implement AI solutions that help protect the Great Barrier Reef.
Story image
trust
9/10 Aussies to stop spending if personal data compromised
"Based on the patterns we are seeing among Australian consumers, it is evident that trust in a brand is exceptionally important."
Story image
Artificial Intelligence
Clear Dynamics closes $35M funding round, invests in global growth
The funding is a major milestone and speaks to Clear Dynamics’ vision for AI-enabled ‘composable’ enterprise software, the company states.
Story image
Remote Working
Australia’s remote workers face connectivity and security issues
SOTI's new report finds better video conferencing technology and improved security measures are top concerns for remote workers in Australia.
Story image
Customer experience
Research unveils precarious customer loyalty for retailers
New research has found customers are reassessing established brand loyalties as their priorities and behaviours shift.
Story image
Microsoft
Microsoft unveils adaptive accessories for disability access
Microsoft is introducing an expansive Inclusive Tech Lab to give people with disabilities greater access to technology through new software features and adaptive accessories.
Story image
Artificial Intelligence
SAS unveils AI experience to improve kids' batting abilities
SAS has created The Batting Lab, an interactive experience using AI, computer vision and IoT analytics to help kids improve their baseball and softball swings.
Story image
Digital Transformation
Trading up: It's time to swap core systems for flexible digital applications
This year will see more oranisations planning and commencing high tech renovations that will shake up the way they operate.
Story image
Artificial Intelligence
Updates from Google Workspace set to ease hybrid working troubles
Google Workspace has announced a variety of new features which will utilise Google AI capabilities to help make hybrid working situations more efficient and effective.
Story image
SaaS
Atturra partners with Focus HQ to support Aus organisations
Atturra has executed a partnership agreement with Focus HQ, to resell and support the company's Australian developed SaaS-based portfolio management platform.
Story image
Attain
Revenue operations is taking centre stage
As the business world continues to evolve, new demands need to be met to keep up with the ever-changing landscape. 
Story image
Wasabi Technologies
Wasabi opens new cloud storage in Australia with Equinix
Wasabi Technologies has opened a new hot cloud storage region in Sydney, Australia, using Equinix services. This is the company's 12th global storage region.
Story image
SaaS
Cloudflare launches instant serverless database for dev teams
"Today we’re announcing our first serverless database which we expect will quickly become one of the largest databases in the world."
Story image
Digital Transformation
The Huawei APAC conference kicks off with digital transformation
More than 1500 people from across APAC have gathered for the Huawei APAC Digital Innovation Congress to explore the future of digital innovation.
Story image
Adyen
Adyen expands partnership with Afterpay as BNPL payments increase
Adyen has expanded its partnership with AfterPay allowing more of Adyen’s merchants in more countries worldwide to use the BNPL provider.
Story image
Artificial Intelligence
SAS announces new products amid cloud portfolio success
Analytics and AI company SAS is deepening its broad industry portfolio with offerings that support life sciences, energy, and martech.
Story image
SAS
New SAS service overcomes subscription fatigue for media companies
SAS has launched SAS 360 Match which helps media companies move towards a AVOD model to generate revenue as subscribers cancel.
Story image
Data Protection
Barracuda launches new capabilities for API Protection
"Every business needs this type of critical protection against API vulnerabilities and automated bot attacks," Barracuda says.
Story image
Phishing
Google reveals new safety and security measures for users
Google's new measures include automatic two step verification, virtual cards and making it easier to remove contact information on Google Search results.
Story image
Digital Transformation
Unlocking the next digital frontier for educational institutions
Understanding where to invest in technology can be challenging for education institutions, especially after the COVID-19 disruptions.
Story image
Digital Transformation
Why enterprise records management should be part of any digital transformation strategy
Modern organisations create and rely upon an enormous volume of content, and digital records make up a significant proportion of that content.
Story image
Public Cloud
Cloud adoption still a work in progress, NetApp finds
NetApp has announced the results of the annual Cloud Infrastructure Report based on a survey of public cloud business and IT decision makers.
Story image
Manufacturing
HINDSITE wins Aerospace Xelerated Pitch Challenge with solution to support Boeing
Brisbane-based startup HINDSITE was the winner of the first ever Pitch Challenge organised by Aerospace Xelerated in partnership with Queensland XR Hub. 
Story image
Excel
Could your Excel practices be harming your business?
While Excel has been the de-facto standard for budgeting, planning, and forecasting, is it alone, enough to support organisations in the global marketplace that’s facing rapid changes due to digital transformation?
Story image
Infrastructure
Nutanix study reveals financial services sector lagging with multicloud adoption
Nutanix has released new research that reveals the financial services sector is lagging behind when it comes to multicloud adoption.
Story image
Fintech
Airwallex launches new bank feed integration with NetSuite
Airwallex has launched a new bank feed integration with NetSuite, developed in partnership with NetSuite solution partner, Onlineone.
Story image
Remote Working
How organisations can meet employees' changing expectations
The global employment market has shifted dramatically in favour of employees, sparking the so-called great resignation, in which people are leaving unsatisfying roles in search of greener pastures.
Story image
Artificial Intelligence
ForgeRock releases Autonomous Access solution powered by AI
ForgeRock has officially introduced ForgeRock Autonomous Access, a new solution that uses AI to prevent identity-based cyber attacks and fraud.
Story image
Mobility
Hands-on review: STM laptop bags
The advent of hybrid working has meant we need laptop bags. We got our hands on two of the most popular laptop bags from STM.
Story image
Remote Working
IT teams deploy powerful technologies to enable remote work
"We found that IT teams mastered the challenges of remote work last year in large part by employing powerful yet easy-to-use technologies."
Exabeam
Find out how a behavioural analytics-driven approach can transform security operations with the new Exabeam commissioned Forrester study.
Link image
Story image
Cybersecurity
Hard numbers: Why ambiguity in cybersecurity no longer adds up
As cybersecurity costs and risks continue to escalate, CEOs continue to struggle with what their investment in cyber protection buys. Getting rid of ambiguity becomes necessary.
Story image
Microsoft
SAS Viya on Microsoft Azure to deliver 204% return - study
The Forrester Total Economic Impact study finds SAS Viya on Microsoft Azure brings a 204% return on investment over three years.
Story image
Safety
Voxel hits total funding of $18M following ongoing wins
Since raising its seed round in September, Voxel has grown at pace, by decreasing on-site injuries by upwards of 80% and increasing operational productivity.