Hello, welcome to the Monday, May 24, 2021 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich. Entertainment recording from Jacksonville, Florida, still, but virtually teaching this week in London. So the podcast may be published at a little bit odd times. And actually, we will be

switching back to a life training, or at least for sort of a hybrid mode. And London is one of

the cities that I'm scheduled in teaching in July and then August. No guarantees yet whether or not this will be in person.

It could also be still virtually, but in a classroom. But let's take a look at diaries that came in

over the weekend. Xavier ran across an interesting fishing email that

performs fishing without any servers. Not only is the HTML page embedded in the email,

that's a fairly common trick, but usually JavaScript within that HTML will then submit harvested credentials to a particular

web service that collects them. This particular phishing email took a little bit

a different approach. It took advantage of an API that's offered by SMTPJS.com.

And that API essentially sort of creates a gateway between JavaScript and SMTP.

You register with SMTPJS.com and then you obtain JavaScript that will send a request to SMTPJS.com and then relay it via your

SMTP server. Personally, I would actually recommend against using SMTPJS.com even for legitimate

purposes. Yes, the credentials are not directly exposed to the user via JavaScript. Instead, the credentials are not directly exposed to the use of your JavaScript.

Instead, the credentials are turned to a token that's then included in the JavaScript.

However, you have to deposit your credentials for your SMTP server with SMTPjs.com.

So really all they're doing is then connecting to your SMTP server.

There are, I think, a couple better APIs that use their own SMTP servers.

Of course, that can be a little bit more tricky if you have to use a specific SMTP server for email security purposes like DMARC.

The token that's exposed to the user is static, so each user gets the same token.

You can limit it to a certain domain, but still looks like there are probably ways how an attacker could use the token to send spam on your behalf.

So overall, fine for fishing and fine for some smaller websites, probably, but there are probably some better options if you just want to

trigger email from a JavaScript, and that typically would involve you running a server with

...