Subject: New Reply Received - Re: Vulnerability report -No DMARC record found / NO DEMARC REJECT POLICY
From: Splash <[email-masked]>
To: [email-masked]
Date: Thu, 30 Jan 2020 13:35:01 +0000

Hi Nikhil Bishnoi,  The customer has responded to the ticket.  Re: Vulnerability report -No DMARC record found / NO DEMARC REJECT POLICY  Ticket comment <div dir="ltr">
<div>  Hi there ,<br>I disagree with your remarks , after visiting the landmarkgroup i found splashfashion under brands tags. this issue is for splashfasion specifically, and its valid as you can see the forged mail is landing in inbox. when i saw the record for <a href="http://landmarkgroup.com" target="_blank" rel="noreferrer">landmarkgroup.com</a> it also has no DMARC record publish and reject policy enabled . also the landmark group has no email available on website but they do have a contact form, once an attacker sends any message via support form he can know the email for landmark and can send a forged or fake email from it. but for splashfasion the contact email is given on website which was used earlier in my report for demo .<br>S.S of Dmarc record is attached below for <a href="http://landmarkgroup.com" target="_blank" rel="noreferrer">landmarkgroup.com</a><br>Let me know if you want me to forged an email to any specific address. will be happy to assist. with that being said I would like to ask you to reconsider the validation of the bug and bounty reward for it (I'm expecting 150$ for responsible disclosure). Will be reporting my future findings afterwards. <br><br>Looking forward to hear from you. Thanks<br><br><br>Best Regards </div>
<div><br></div>
<div><br></div>
<div><div>
<img src="https://attachment.freshdesk.com/inline/attachment?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MjA0MzA4MzEwNjQ5MSwiZG9tYWluIjoibGFuZG1hcmtncm91cHNlcnZpY2UuZnJlc2hkZXNrLmNvbSIsImFjY291bnRfaWQiOjExMjUxNTZ9.75Mlwg3XW9r2FhDO0e-THoW9cEvOO0hE182q1TaCW0g" alt="image.png" width="514" height="247"><br>
</div></div>
</div>
<br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"></div></div>
<div class="freshdesk_quote"><blockquote class="freshdesk_quote">
<div>On Thu, 30 Jan 2020 at 00:14, Husnain Iqbal &lt;<a href="mailto:[email-masked]" target="_blank" rel="noreferrer">[email-masked]</a>&gt; wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">Hello,<br>Is there any update on this bug? I'm hoping to receive a bounty reward for responsible disclosure once your team has validated the issue. <br><br>I will be waiting for your response.<br><br>Kind Regards.<br>
</div>
<br><div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, 14 Jan 2020 at 11:26, Husnain Iqbal &lt;<a href="mailto:[email-masked]" target="_blank" rel="noreferrer">[email-masked]</a>&gt; wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif">
<span style='font-family:"Times New Roman",serif;font-size:12pt'>Hello Team ,</span><br>
</div>
<div class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif">
<span style='font-size:12pt;font-family:"Times New Roman",serif'><br>I am a security researcher and I founded this vulnerability in your website.<br>I just sent a forged email to </span><a href="mailto:[email-masked]" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>[email-masked]</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'> that appears to originate from </span><a href="mailto:[email-masked]" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>[email-masked]</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'>. I was able to do this because of the following DMARC record:<br><br>DMARC record lookup and validation for: </span><a href="http://splashfashions.com" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>splashfashions.com</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'>.<br>"No DMARC Record found"<br><br>Fix:<br>1)Publish DMARC Record.<br>2)Enable DMARC Quarantine/Reject policy<br>3)Your DMARC record should look like<br>"v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:</span><a href="mailto:[email-masked]" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>[email-masked]</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'>"<br><br>This is useful in phishing, and this type of vulnerability is news worthy (</span><a href="http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'>).<br><br>This can be done using any php mailer tool like this ,<br>&lt;?php<br>$to = "</span><a href="mailto:[email-masked]" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>[email-masked]</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'>";<br>$subject = "Password Change";<br>$txt = "Change your password by visiting here - [VIRUS LINK HERE]l";<br>$headers = "From: </span><a href="mailto:[email-masked]" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>[email-masked]</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'> ";<br>mail($to,$subject,$txt,$headers);<br><br>?&gt;<br><br>You can check your DMARC record form here : </span><a href="https://mxtoolbox.com/SuperTool.aspx?action=mx%3alition.io&amp;run=toolpage" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>https://mxtoolbox.com/SuperTool.aspx?action=mx%3alition.io&amp;run=toolpage#</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'><br><br>Reference : </span><a href="https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkim-dmarc_records" target="_blank" rel="noreferrer"><span style='font-size:12pt;font-family:"Times New Roman",serif'>https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkim-dmarc_records</span></a><span style='font-size:12pt;font-family:"Times New Roman",serif'><br><br>Let me know if you need me to send another forged email, or if have any other questions.<br><br>Thanks,</span>
</div>
<div class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style='font-size:12pt;font-family:"Times New Roman",serif'>Regards : Hasnain Iqbal</span></div>
<div class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"><span style='font-size:12pt;font-family:"Times New Roman",serif'><br></span></div>
<div class="MsoNormal" style="margin:0in 0in 0.0001pt;line-height:normal;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-size:11pt;font-family:Calibri,sans-serif"> </div>
</div>
</blockquote>
</div>
</blockquote>
</blockquote></div>  https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/433157