From: anyone@icloud.com – Spoofing Arbitrary Apple iCloud Identities

Following the discovery of SMTP smuggling in 2023, many SMTP implementations released security updates in 2024. But does that mean email spoofing is a thing of the past?

As part of a research project conducted together with the SEC Consult Vulnerability Lab, Timo Longin, known for his work on SMTP smuggling, investigated Apple iCloud’s email infrastructure and uncovered two unusual email spoofing vulnerabilities.

The research explores a subclass of email spoofing called header smuggling, highlighting how parsing discrepancies in SMTP implementations can still be exploited. Using Apple iCloud as a case study, the findings demonstrate how messages could be sent from arbitrary icloud.com addresses, once again exposing the risks of relying solely on trust in email communications.

Read the full post here