Inbox Invasion - Exploiting MIME Ambiguities to Evade Email Attachment Detectors

Discover how adversaries exploit parsing discrepancies between email detectors and clients to evade malware detection in this 29-minute Black Hat conference talk. Learn about the first systematic evaluation of email attachment detection vulnerabilities through MIMEminer, a novel testing methodology that systematically uncovers evasion techniques in email systems. Explore findings from comprehensive testing against 16 content detectors from popular email services including Gmail and iCloud, plus 7 email clients like Outlook and Thunderbird, which revealed 19 new evasion methods affecting all tested platforms. Examine three primary categories of malware evasions identified through vulnerability analysis and understand how researchers responsibly disclosed these security flaws to major providers including Google Gmail, Apple iCloud, Coremail, Tencent, Amavis, and Perl MIME-tools. Gain insights into MIME parsing ambiguities and their exploitation for bypassing email security measures from cybersecurity researchers at Tsinghua University's Network and Information Security Lab.