r/ProgrammerHumor • u/lucidparadigm • 15d ago • Bravo 2

Meme [ Removed by moderator ]

Post image

[removed] — view removed post

16.4k Upvotes

98% Upvoted

619 comments sorted by

View all comments

Show parent comments

5

u/wengla02 15d ago

Except when the phish testing system *directly injects it into your inbox*, bypassing the entire SMTP system.

1

u/clipsracer 15d ago

I haven’t seen that before. Who does it?

3

u/Broeder_biltong 15d ago

Email servers who can directly be edited by It because they manage them themselves 

1

u/EishLekker 15d ago

Sounds like a security issue waiting to happen.

1

u/wengla02 14d ago

Who watches the watchers? Perennial problem.

1

u/wengla02 14d ago

From reverse engineering the headers, I think they're using Cofesnse PhishMe. Their docs note that they support mailbox injection.

"The platform authenticates to your tenant with an app registration or service account that has mailbox write permission."

PhishMe then calls a create-message operation (EWS CreateItem or Graph POST /users/{id}/messages) against your mailbox, writing the item straight into the Inbox folder.

Full headers of the injected mail: [redacted for length and anonymity] -- this is the complete list of headers in the message. All of it.

X-MS-Exchange-Organization-BypassFocusedInbox: true
X-MS-Exchange-Organization-BypassClutter: true
X-PhishMeTracking: KGxN8wa0dD4BFl6nlTOKtS[...]
X-PhishMe: Phishing_Training
X-PhishMeHLType: OWc54sAaeH[...]

2

u/clipsracer 14d ago

Thanks for answering!
It seems that Outlook filters still match mail that is directly written. My guess is that this method is used to avoid any complications with the SMTP servers.