AVID-2023-V009

Description

ProofPoint Evasion

Details

Proof Pudding (CVE-2019-20634) is a code repository that describes how ML researchers evaded ProofPoint’s email protection system by first building a copy-cat email protection ML model, and using the insights to bypass the live system. More specifically, the insights allowed researchers to craft malicious emails that received preferable scores, going undetected by the system. Each word in an email is scored numerically based on multiple variables and if the overall score of the email is too low, ProofPoint will output an error, labeling it as SPAM.

References

• ProofPoint Evasion
• National Vulnerability Database entry for CVE-2019-20634
• 2019 DerbyCon presentation “42: The answer to life, the universe, and everything offensive security”
• Proof Pudding (CVE-2019-20634) Implementation on GitHub
• 2019 DerbyCon video presentation “42: The answer to life, the universe, and everything offensive security”

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0403: Adversarial Example
• Lifecycle stages: L06: Deployment

Affected or Relevant Artifacts

• Developer:
• Deployer: ProofPoint Email Protection System
• Artifact Details:

  Type	Name
  System	ProofPoint Email Protection System

Other information

• Vulnerability Class: ATLAS Case Study
• Date Published: 2023-03-31
• Date Last Modified: 2023-03-31
• Version: 0.2
• AVID Entry