Salesforce Tower Camera 4

COVID-19 hospitalizations rose about 60% in the first week of August compared to just a month ago, according to CDC data. With the new COVID booster likely to be rolled out as early as mid-September, medical experts are advising the public to get both their flu and COVID booster shots. Errol Barnett has more.

Hackers exploited Salesforce zero-day in Facebook phishing attack

Hackers exploited a zero-day vulnerability in Salesforce's email services and SMTP servers to launch a sophisticated phishing campaign targeting valuable Facebook accounts.

The attackers chained a flaw dubbed "PhishForce," to bypass Salesforce's sender verification safeguards and quirks in Facebook's web games platform to mass-send phishing emails.

The benefit of using a reputable email gateway like Salesforce to distribute phishing emails is the evasion of secure email gateways and filtering rules, ensuring that the malicious emails reach the target's inbox.

The campaign was discovered by Guardio Labs analysts Oleg Zaytsev and Nati Tal, who reported the unknown vulnerability to Salesforce and helped them with the remediation process.

However, the discovered issues in Facebook's game platform are outstanding, as Meta's engineers are still trying to figure out why the existing mitigations failed to stop the attacks.

The Salesforce CRM allows customers to send emails as their own brand using custom domains that the platform must first verify. This protects customers from sending out emails through Salesforce as other brands that they do not have permission to impersonate.

However, Guardio Labs says the attackers figured out a way to exploit Salesforce's "Email-to-Case" feature, which organizations use for converting incoming customer emails to actionable tickets for their support teams.

Specifically, the attackers set up a new "Email-to-Case" flow to gain control of a Salesforce-generated email address, then created a new inbound email address on the "salesforce.com" domain.

Next, they set that address as an "Organization-Wide Email Address," which Salesforce's Mass Mailer Gateway uses for outbound emails, and finally went through the verification process to confirm ownership of the domain.

This process allowed them to use their Salesforce email address to send out messages to anyone, bypassing both Salesforce's verification protections and any other email filters and anti-phishing systems in place.

Indeed, this is what Guardio Labs observed in the wild, with phishing emails that supposedly came from "Meta Platforms" using the "case.salesforce.com" domain.

Clicking on the embedded button takes the victim to a phishing page hosted and displayed as part of the Facebook gaming platform ("apps.facebook.com"), which adds further legitimacy to the attack and makes it even harder for the email recipients to realize the fraud.

The goal of the phishing kit employed in this campaign is to steal Facebook account credentials, even featuring two-factor authentication bypassing mechanisms.

After confirming the issues by replicating the creation of a Salesforce-branded address capable of disseminating phishing emails, Guardio Labs notified the vendor of their discovery on June 28, 2023

Salesforce reproduced the vulnerability and resolved the problem exactly a month later, on July 28, 2023.

Regarding the abuse of "apps.facebook.com," Guardio Labs notes that it should be impossible for the attackers to create the game canvass used as a landing page since Facebook retired this platform in July 2020.

However, legacy accounts that used the platform before its deprecation still have access, and threat actors might be paying a premium for those accounts on the dark web.

Meta removed the violating pages upon Guardio Labs' report; however, its engineers are still investigating why existing protections failed to stop the attacks.

As phishing actors continue to explore every potential abuse opportunity on legitimate service providers, novel security gaps constantly threaten to expose users to severe risks.

Thus, it is essential not to rely solely on email protection solutions, and also scrutinize every email that lands on your inbox, look for inconsistencies, and double-check all claims made in those messages.

PhishForce: New phishing attack involving Salesforce and Facebook uncovered

A new, unpatched exploit that involves a sophisticated email phishing campaign has been discovered by security researchers at Guardio Labs.

The targets are Salesforce Inc. customers, and the threat involves spoofing the company’s email servers and domain names. The process of finding and fixing the issue reveals a lot about how security teams can work together to fight phishing.

Called PhishForce, the attack is quite clever, designed to avoid detection by both Salesforce and Meta Platforms Inc.’s Facebook. It uses an old technique: sending malicious emails and hiding them inside ordinarily trusted mail gateways so that the emails won’t be challenged by protective shields. The researchers found a single questionable email message, as shown in the screen capture below, that triggered their  investigation. 

The circled part of the message shows an “@salesforce.com” domain, but labeled as coming from “Meta Platforms.” That should be the tipoff that this is a phishing email. The big blue button is also mislabeled with “Request a Review.” It doesn’t: By clicking on this button, a user is sent to a phishing page that’s designed to grab their Facebook account details.

The second tipoff is that the phishing page is hosted by Facebook and is supposed to be some sort of game. Yet the page has other content that has nothing to do with games. This is where the clever part comes into play: The malicious email has a legitimate link to facebook.com and is sent from a legitimate email address of salesforce.com, using its legit email gateway services. Essentially, the malicious email is hiding beneath this patina of respectability.

The researchers found that the attackers did something else that tied everything together. It took advantage of a trouble-ticketing system to use the email address “case.salesforce.com” – which normally is used to receive emails – but to send the emails instead.

This sounds simple, but the role reversal is key to how the entire attack happened. Guardio notified Salesforce at the end of June, and the vulnerability was fixed within a month and deployed across the company’s infrastructure. It also contacted Facebook, which then removed the malicious gaming accounts.

“The Salesforce security team was effective and responsive, taking these kinds of issues very seriously and prioritizing it accordingly,” the researchers said in their blog post Wednesday describing the exploit. “Bad actors are continuously testing the limits of email distribution infrastructure and existing security measures. [Service providers should] take proactive steps to keep scammers away from secure and reputable mail gateways.”

The battle against phishing will no doubt continue. The takeaway from PhishForce is to be always watching for elements that don’t quite add up, and also never to assume that email is harmless just because it originates from a legit domain.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU