TLDR Tech / InfoSec
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address
InfoGuard's "Ghost-Sender" lets attackers send spoofed internal or external email (including from real CEO or noreply addresses, with Outlook resolving profile pictures) to Exchange Online and hybrid on-prem tenants that use a third-party MX record via a one-line PowerShell command, bypassing SPF, DKIM, and DMARC entirely. It is reportedly being abused in the wild. Microsoft is treating it as an architectural limitation rather than a vulnerability. Defenders should disable Direct Send, deploy a partner connector with IP/certificate validation, or add a mail flow rule quarantining mail where X-MS-Exchange-Organization-AuthAs is not Internal from unexpected IPs.
Read the full story