We're pleased to announce notqmail 1.09.

notqmail is the collaborative Open Source successor to qmail and netqmail. It begins with stable, compatible, small releases to which existing qmail users can safely update, and aims to become a more extensible, more easily packaged, and more modern Mail Transport Agent suitable for most needs.

qmail's design principles haven't _always_ prevented bugs or holes, nor have they _always_ made adding new functionality easy. But pretty often we get both. And that's why we continue to invest in this codebase.

Project goals that have made particular progress in the 1.09 release:

- Preserve qmail's hard-earned security properties
- Reduce marginal cost of development
- Make packaging easier
- Provide sensible defaults

Some well-known patches have been merged; others will need some adjustment.

Full release notes: https://notqmail.org/releases/1.09

It's been almost four years since 1.08. Thanks for your patience. With continued focus on making development safer and faster, our next release will arrive much sooner. Feedback welcome, as always.

#email #selfhosting #qmail #netqmail #notqmail #smtp #smtpsmuggling #mailserver
1.09

Pour le détail technique du SMTP Smuggling : https://smtpsmuggling.com/

Et l'excellente présentation au CCC en décembre dernier : https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide

#smtpSmuggling #smtp #security

SMTP Smuggling

🏆 Achievement unlocked : être crédité comme "Reporter" sur un advisory de sécurité Github 🔒

https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2

👏 to @login for all the hard work

#smtpSmuggling #smtp #postal #email #security #CVE

SMTP Smuggling

### Impact Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service,...

GitHub
Only noticed today that there's a new long-term fix for #smtpsmuggling in #postfix for versions ≥ 3.5.24 using “smtpd_forbid_bare_newline = normalize”. The old “yes” setting for this option is now an alias for the new “normalize”. Also took some time for extended #smtpsmuggling testing using the “SMTP-Smuggling-Tools” from https://github.com/The-Login/SMTP-Smuggling-Tools.
GitHub - The-Login/SMTP-Smuggling-Tools: Tools for finding SMTP smuggling vulnerabilities.

Tools for finding SMTP smuggling vulnerabilities. Contribute to The-Login/SMTP-Smuggling-Tools development by creating an account on GitHub.

GitHub

Timo Longin @login introduces SMTP smuggling, a novel technique to spoof fully SPF-validated emails from various popular domains including @microsoft.com.

Wow. It's incredible nobody found this before. It's the first of its kind. Probably not the last...!

https://youtu.be/V8KPV96g1To

Related:
https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide
https://www.postfix.org/smtp-smuggling.html
https://www.malwarebytes.com/blog/news/2024/01/explained-smtp-smuggling

#SmtpSmuggling #37C3 #SMTP #vulnerability #infosec #TimoLongin #security

37C3 - SMTP Smuggling – Spoofing E-Mails Worldwide

YouTube

It's a wrap! 🌯 Our technical guideline "BSI TR-03108 (Secure Email Transport)" is now accompanied by "BSI TR-03182 (Email Authentication)" providing guidance for email services to protect their users against impersonation attacks like Spoofing and Phishing 

https://bsi.bund.de/dok/tr-03182-en

#TeamBSI #EmailAuthentication #DNSSEC #DMARC #DKIM #SPF #SMTP #SMTPSmuggling

BSI TR-03182 Email Authentication

Federal Office for Information Security

Finally the two missing options against #smtpsmuggling arrived in #debian buster this morning.

https://security-tracker.debian.org/tracker/CVE-2023-51764

smtpd_forbid_bare_newline = normalize

and if needed:

smtpd_forbid_bare_newline_exclusions = $mynetworks

see

https://www.postfix.org/smtp-smuggling.html

CVE-2023-51764

Explained: SMTP smuggling | Malwarebytes

Researchers have found flaws in the way SMTP servers handle messages, allowing them to send spoofed emails to and from targets.

Malwarebytes

SPF-valid spoofed mail from [email protected] 😈 ?

Timo Longin @login stumbled upon SMTP Smuggling while looking for vulnerabilities in the Simple Mail Transfer Protocol.

Great work and great talk!

#Smtp #SmtpSmuggling #TimoLongin #37c3

https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-mails_worldwide

SMTP Smuggling – Spoofing E-Mails Worldwide

media.ccc.de

Ich: »Ich habe gerade mal getestet, ob Ihr für #SmtpSmuggling anfällig seid, aber anscheinend kann ich auch einfach so Mails als jeder beliebige Absender über Eure Server verschicken.«

Mail-Provider: »Ja, das ist ganz normales Phishing, aber das ist so gewollt, damit man mit mehreren Absendern dasselbe Sammelpostfach bedienen kann.«

Ich: »Es ist gewollt, dass ich mich als Ihr oder jeder Eurer anderen Kunden ausgeben kann? Inklusive gültiger DKIM-Signatur?«

Mail-Provider: 🤷‍♂️

Es gibt so Tage...