Things I broke
PhishForce
A flaw in Salesforce’s email gateway that let anyone send mail as @salesforce.com — signed, trusted, and straight past every filter.
- @salesforce.com
- spoofable by anyone · patched globally
- SPF + DKIM + DMARC
- passed by every phishing email
- 30 days
- from disclosure to global fix
It started as one Facebook phishing email that should never have reached an inbox. It came from a real @salesforce.com address, through Salesforce’s own mail servers.
We traced it to Email-to-Case, a feature meant only for inbound support mail. By routing the address-verification link back into Salesforce’s own ticket system, attackers could verify — and send as — a Salesforce address. Salesforce shipped a global fix after our disclosure.
In the press
BleepingComputerHackers exploited Salesforce zero-day in Facebook phishing attack The Hacker NewsPhishers Exploit Salesforce's Email Services Zero-Day in Targeted Facebook Campaign SecurityWeekSalesforce Email Service Zero-Day Exploited in Phishing Campaign Dark ReadingSalesforce Zero-Day Exploited to Phish Facebook Credentials
Read the research
AgentBaiting