Marcello Salvati: Spoofing Emails from Over 2 Million Domains
A DEF CON 31 talk on a critical vulnerability in email infrastructure. The researcher demonstrated how a combination of Cloudflare Workers and the MailChannels service allowed sending emails on behalf of more than 2 million domains, bypassing SPF and DMARC checks.
This made it possible to spoof senders and deliver emails directly to inboxes.
The talk also explains why email security remains fragile and how architectural flaws and implicit trust between services can lead to large-scale risks.
This made it possible to spoof senders and deliver emails directly to inboxes.
The talk also explains why email security remains fragile and how architectural flaws and implicit trust between services can lead to large-scale risks.