Yandex.Pochty security issues (as well as traffic and Connect)

Hi GT! I read the MikhailNsk post , and my brain transferred me to 2016, where I accidentally stumbled upon a problem with the substitution of addresses in Yandex.Mail. The threat itself is that, from the point of view, the letters DMARC and SPF are fully valid. Not only Mail users are subject to this, but also organizations that use Yandex.PDD and Yandex.Connect as a mailer with their domain (for example, this is everyone’s well-known and everywhere advertised Mailovsky GeekBrains), and this is much more serious. The vulnerability is currently working, the letter passes all checks and is delivered anywhere (including GMAIL). Implementation and the reaction of Yandex under the cut.

Attention! The following vulnerability replay algorithm is provided for educational purposes only!

Implementing Vulnerability

The very essence is very simple, Yandex allows you to log in with one address, and send it from any other where the DMARC and SPF of the Yandex rules are written, and the letter is signed with the valid DKIM signature yandex.ru.

To implement, we need a mailbox on Yandex and a third-party mail client (my choice fell on an open and functional Thunderbird).
')
We fasten our mailbox from Yandex to the latter, open the window for sending a letter



Change the sender's address to the one we need (in our case, to i@yandex.ru)



And send the letter somewhere



To the Google Mail (as well as to any other) letter came normally. Google shows the card that all good:

Morality and the answer of Yandex

This vulnerability creates tremendous opportunities for social engineering. In this way, you can use addresses, for example, GeekBrains, which uses traffic rules for traffic (or Connect).
DKIM check gives a pass, but the domain is specified by Yandex (even use a different mail domain).

Naturally, I immediately wrote about this to Yandex’s Yandex Buhunter last summer and
got the answer:



Before me, the vulnerability was sent to them on June 27, 2016. Those. For a year, Yandex failed to fix a fairly serious (in my opinion) vulnerability that could affect the security of Yandex partners who use their mailer.

UPD: there is a way to mask the sender address. To do this, it is enough to buy a more or less similar domain, screw the traffic regulations to it and send letters from it. The address is replaced in the same way, all checks are valid, and the DKIM signature and the sender's address will be from the new domain.

By the way, mail.ru and gmail are not affected. GeekBrains, I'm sorry, but I only know you, among those who use Yandex services, because you have burned an avatar.