HexBrain

MCUboot · Report #1186701

DMARC and DNS Records not found on mcuboot.com

Validstatus
5upvotes
10 May 2021disclosed

How it was found

Found no DMARC and DNS record on mcuboot.com .

I am also able to send an email to me on your behalf . The mail sent didnot even landed in spam folder which could make the users believe on the attacker as a legitimate person or authority. Any attacker could do so by using any fake mailer .For exmple : Emkei's Fake mailer - emkei.cz Screenshots have been attached for the same.

Impact

An attacker can spoof any mcuboot.com email address . This could allow them to appear to be a high-profile individual or company.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original