From: anyone@icloud.com — Spoofing Any Apple iCloud Sender

Timo Longin of the SEC Consult Vulnerability Lab, known for his SMTP smuggling research, has detailed two exotic email spoofing flaws in Apple iCloud's mail services. Both let an attacker send messages from an arbitrary @icloud.com address.

From smuggling to header smuggling

Classic SMTP smuggling, which made headlines in late 2023, exploited differences in how servers interpret the end-of-data sequence of a message. By 2024 the major implementations — Postfix, Sendmail, Exim and others — had shipped fixes. Attempts to find new ways to break out of the message body and inject a second SMTP command failed: none of the hundreds of test cases worked.

So the researcher took a different angle. What matters to the recipient is not the MAIL FROM address but the From header inside the message. Apple blocks setting a foreign address there directly, returning "From address is not one of your addresses." But the check can be bypassed by making iCloud's two internal processors parse the same message differently.

Two different parsers

Mail sent to smtp.mail.me.com passes through two stages. The first checks the From header against the authenticated user; the second — which, by its signatures, appears to be Postfix-based — builds the final message and signs it with DKIM.

The first trick uses bare carriage-return characters. Because of them, the first processor sees a "valid" header with the user's own address and lets the message through, while the second strips the characters and pushes the legitimate header down into the body, leaving the forged admin@icloud.com on top. Since the DKIM signature is applied after all the transformations, the message passes SPF, DKIM and thus DMARC.

When Apple tightened its header parsing, Longin found a second route via the SMTP dot-stuffing rules (adding and removing leading dots on lines). The first processor ignores them, once again splitting the interpretations of the two parsers. As proof, he sent a message from the address of Apple's former CEO — tim.cook@icloud.com.

Eighteen months of back-and-forth, and $15,000

Disclosure took roughly a year and a half. Apple did not treat the finding lightly: it paid a $15,000 Apple Security Bounty. The author suggests this could set a precedent — spoofing bugs are usually deemed not dangerous enough and ruled out of scope, even though sender forgery is the foundation of phishing.

The takeaway is sobering: parsing an old, complex protocol like SMTP will keep producing bugs, and the authenticity of an email's sender is far shakier than most users assume.

Source: Lobsters