Chuhan Wang | 王楚涵

Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability

Mon, 11 Aug 2025 00:00:00 +0000

Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors

Tue, 26 Nov 2024 00:00:00 +0000

Where URLs Become Weapons: Automated Discovery of SSRF Vulnerabilities in Web Applications

Mon, 27 May 2024 00:00:00 +0000

TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets

Sun, 26 May 2024 00:00:00 +0000

Uncovering Security Vulnerabilities in Real-world Implementation and Deployment of 5G Messaging Services

Sun, 21 Apr 2024 00:00:00 +0000

31th Annual Network and Distributed System Security Symposium | NDSS 2024

Mon, 26 Feb 2024 09:00:00 +0000

It is my pleasure to have the opportunity to share our latest research work on email security live at NDSS Symposium 2024. Due to the Covid19, I didn’t have the chance to attend the international conference on site until this year.

I’m also glad to meet many old friends and make new friends here. Thanks you for the hospitality of Xintong, it’s great to see old classmates on the other side of the pacific!

A lot of interesting talks, nice beach and wonderful sunset. It was a great experience~

See you NDSS~ See you San Diego🏝️ Hope to see you again~

Moments

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

Mon, 26 Feb 2024 00:00:00 +0000

BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet

Wed, 21 Feb 2024 00:00:00 +0000

Under the Dark: A Systematical Study of Stealthy Mining Pools (Ab)use in the Wild

Fri, 26 May 2023 00:00:00 +0000

2023 International Forum for Security Research | Inforsec 2023

Sat, 08 Apr 2023 09:00:00 +0000

DomainKeys Identified Mail (DKIM) is an email authentication protocol to protect the integrity of email contents. It has been proposed and standardized for over a decade and adopted by Yahoo!, Google, and other leading email service providers. However, little has been done to understand the adoption rate and potential security issues of DKIM due to the challenges of measuring DKIM deployment at scale.
In this paper, we provide a large-scale and longitudinal measurement study on how well DKIM is deployed and managed. Our study was made possible by a broad collection of datasets, including 9.5 million DKIM records from passive DNS datasets over five years and 460 million DKIM signatures from real-world email headers. Moreover, we conduct an active measurement on Alexa Top 1 million domains. Our measurement results show that 28.1% of Alexa Top 1 million domains have enabled DKIM, of which 2.9% are misconfigured. We demonstrate that the issues of DKIM key management and DKIM signatures are prevalent in the real world, even for well-known email providers (e.g., Gmail and Mail.ru). We recommend the security community should pay more attention to the systemic problems of DKIM deployment and mitigate these issues from the perspective of protocol design.

We also proposed an online detection tool for email administrator, called “Nospoofing”. NoSpoofing: https://nospoofing.cn/

A Large-scale and Longitudinal Measurement Study of DKIM Deployment

Tue, 09 Aug 2022 00:00:00 +0000

Overview

We also proposed an online detection tool for email administrator, called “Nospoofing”. NoSpoofing: https://nospoofing.cn/

Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks

Mon, 09 Aug 2021 00:00:00 +0000

Overview

This paper systematically analyzes the transmission of an email and identiﬁes a series of new attacks capable of bypassing SPF, DKIM, DMARC and user-interface protections. We conduct a largescale experiment on 30 popular email services and 23 email clients, and ﬁnd that all of them are vulnerable to certain types of new attacks.

NoSpoofing. We designed a Chrome Extension called NoSpoofing. It is a UI notification scheme which can alert users that the emails they receive may be spoofing.

2021 West Lake Cybersecurity Conference: Cyberspace Security Tools Presentation

Sat, 24 Apr 2021 08:00:00 +0000

In the 2021 West Lake Cybersecurity Conference, I presented an email security evaluation tool. ESpoofing to the audiences.

Our colleagues Xiang Li presented his Ipv6 network scanner XMap

NoSpoofing

Fri, 02 Apr 2021 00:00:00 +0000

NoSpoofing is a UI notification scheme which can alert users that the emails they receive may be spoofing..

Email UI rendering is a significant part that affects the users’ perception of an email’s authenticity. However, most of the web mails and email clients we tested do not display SPF, DKIM, or DMARC authentication results explicitly. Thus, it is difficult for ordinary users to fully understand the details of email authentication.

An effective defense method is to provide a user-friendly UI notification, which alerts users that the emails they receive may be spoofing. This extension is such an UI notification.

Usage: Users can click the icon of the extension when reading an email. Then the web UI will show whether the email is safe or not. If users want to know the details of this email, they can click the notification message.

Mon, 01 Jan 0001 00:00:00 +0000