Vulnerabilities in your site - Ethical hacker?

A while ago I received an email. I figured it's just spam, but wasn't sure so I left it in my inbox. The guy contacted me two more times after that, asking for a bounty/reward, but I ignored.

So let me ask you guys, here is the email:

-----------

Hello Team,

As an Ethical Hacker I found some Vulnerabilities in your site few of them are as follows.

DESCRIPTION:

I just sent a forged email to my email address that appears to originate from [email protected] I was able to do this because of the following :

DMARC record lookup and validation for site.com

“No DMARC Record found”
And/ OR
"DMARC Quarantine/Reject policy not enabled"

Fix:
1) Publish DMARC Record. (If not already Published)
2)Enable DMARC Quarantine/Reject policy
3)Your DMARC record should look like
"v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:[email protected]"

And
As I have seen the SPF and TXT record for the site.com which is :

Found v=spf1 record for site.com :
v=spf1 include:_spf.google.com ~all

so valid record will look like :

Found v=spf1 record for site.com :


v=spf1 include:_spf.google.com -all

What's the issue :

What’s the issue: as u can see in the article difference between softfail and hardfail you should be using fail as Hardfail as it doesn’t allow anyone to send spoofed emails from your domains, In current SPF record you should replace (?) or
(~) with (-) at last before all , - is strict which prevents all spoofed emails except if you are sending

You can validate by testing yourself over here: mxtoolbox.com

This is useful in phishing, and this type of vulnerability is newsworthy (http://bits.blogs.nytimes.com/2015/...s-used-to-attack-coinbase-a-bitcoin-exchange/

https://medium.com/@hotbit/official...nterfeit-email-listing-hotbit-io-d1d240005d35

This can be done using any php mailer tool like this ,

<?php
$to = "[email protected]";
$subject = "Password Change";
$txt = "Change your password by visiting here - [VIRUS LINK HERE]l";
$headers = "From: [email protected]";
mail($to,$subject,$txt,$headers);
?>

IMPACT:
Due to this vulnerability, any hacker can send a forged email to your customers using your domain .Thus, getting sensitive information of your customers like login details, downloading a virus/malware etc.

Also When an attacker sends an email to your customers asking them to change their password. The customer, after seeing the mail, might consider the mail as legit and falls for the trap.

In doing this the attacker can take them to his website where certain JavaScript is executed which steals the customer's session id and password.

The results can be more dangerous and impactful.

A study shows why DMARC and SPF are crucial:

1) $1.6 million on average is what one single spear phishing attack costs for organizations
2) $500 million every year is scammed by phishing attacks
3) Just 3% of all users will report phishing emails to their management
4) More than 400 businesses are targeted by BEC scams every day
5) 76% of organizations have reported that they have been victim of a phishing attack.
6) 1 in 3 companies have been victims of CEO fraud emails
7) 70% of all global emails is malicious
8) Fake invoice messages are the #1 type of phishing lure

You can find the SPF fix over here : https://www.digitalocean.com/commun...o-prevent-spoofing-improve-e-mail-reliability


For DMARC record : https://easydmarc.com/blog/how-to-fix-no-dmarc-record-found/

and DMARC policy here: https://support.rackspace.com/how-to/create-a-dmarc-policy/

Let me know if you need me to send a forged email.

Note: I am expecting a bounty for this responsible disclosure and I would like to report more in the future.

Regards,
Harry style

-----------

These screenshots were included:





-----------

This legit? @BlogPro

I got the same email & endless follow-ups

Ignore these clowns

ignore this shit

Scorpion Ghost said:

-----------

This legit? @BlogPro

Click to expand...

This is not a vulnerability.

It's a softfail record that is recommended by most ESPs. When ~all exists in the spf records, receiving servers will read the spf entry and accept the email, while marking emails not sent through the ESP mentioned on the SPF as suspicious.

This is fear based extortion.

You can ignore this.

Just forget replying back just spam but whoever spent you it is clearly good at spam.

It's also worth noting that in general running scans like this on people's websites is illegal and no ethical hacker would do it without permission (they would then, by definition, not be an ethical hacker)

There are plenty of security measures you could take in case you have not already done this

Everything stated in this email is real to some extent.
https://securityboulevard.com/2020/09/missing-dmarc-records-lead-to-phishing/
This is like the SEO audits that some companies send to some emails feeling the ratio of response could ramp, sometimes they just point out one element (for example, you have forgot to put a metadescription in certain important pages).

Technically this SEO guys could give you more insights and work for you if you pay them, similarly this security guys, also could find some extra measures in your system that may make it a little bit more robust

Obviously if your site doesn't have a ton of clients, with hundreds if not thousands of account involved, then that security measure is almost useless and would almost never hurt you.

But if you were BHW, obviously leaving SPF and DMARC unchecked could make people do things with the BHW email domain that could be potentially harmful for their reputation, which is relatively big, given the number of users they manage.

Okay guys thanks for the replies. I'll just ignore it and move on