Composition Kills: A Case Study of Email Sender Authentication


Component-based software design is a primary engineering approach for building modern software systems. This pro- gramming paradigm, however, creates security concerns due to the potential for inconsistent interpretations of messages be- tween different components. In this paper, we leverage such inconsistencies to identify vulnerabilities in email systems. We identify a range of techniques to induce inconsistencies among different components across email servers and clients. We show that these inconsistencies can enable attackers to bypass email authentication to impersonate arbitrary senders, and forge DKIM-signed emails with a legitimate site’s signa- ture. Using a combination of manual analysis and black-box testing, we discovered 18 types of evasion exploits and tested them against 10 popular email providers and 19 email clients— all of which proved vulnerable to various attacks. Absent knowledge of our attacks, for many of them even a consci- entious security professional using a state-of-the-art email provider service like Gmail cannot with confidence readily determine, when receiving an email, whether it is forged.

USENIX Security Symposium