{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,1,5]],"date-time":"2025-01-05T13:10:16Z","timestamp":1736082616766,"version":"3.32.0"},"publisher-location":"New York, NY, USA","reference-count":37,"publisher":"ACM","funder":[{"DOI":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272265"],"id":[{"id":"10.13039\/https:\/\/doi.org\/10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3670386","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T17:19:20Z","timestamp":1733764760000},"page":"467-481","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-3537-8845","authenticated-orcid":false,"given":"Jiahe","family":"Zhang","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7511-1117","authenticated-orcid":false,"given":"Jianjun","family":"Chen","sequence":"additional","affiliation":[{"name":"Tsinghua University & Zhongguancun Laboratory, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-5707-3223","authenticated-orcid":false,"given":"Qi","family":"Wang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-6219-504X","authenticated-orcid":false,"given":"Hangyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4715-4667","authenticated-orcid":false,"given":"Chuhan","family":"Wang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-9570-3335","authenticated-orcid":false,"given":"Jianwei","family":"Zhuge","sequence":"additional","affiliation":[{"name":"Tsinghua University & Zhongguancun Laboratory, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0083-733X","authenticated-orcid":false,"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[{"name":"Tsinghua University & Zhongguancun Laboratory, Beijing, China"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","unstructured":"1982. STANDARD FOR THE FORMAT OF ARPA INTERNET TEXT MESSAGES. RFC 822. https:\/\/doi.org\/10.17487\/RFC0822","DOI":"10.17487\/RFC0822"},{"key":"e_1_3_2_1_2_1","unstructured":"3PROXY. 2008. Bypassing the content filtering software. https:\/\/web.archive.org\/ web\/20221129194843\/https:\/\/3proxy.ru\/advisories\/content.asp."},{"key":"e_1_3_2_1_3_1","unstructured":"Amavis. 2024. Amavis. https:\/\/gitlab.com\/amavis\/amavis."},{"key":"e_1_3_2_1_4_1","volume-title":"Muhammad Ikram, Giang Nguyen, Dali Kaafar, Sean Lamont, and Daniel Coscia.","author":"Asghar Hassan","year":"2022","unstructured":"Hassan Asghar, Benjamin Zi Hao Zhao, Muhammad Ikram, Giang Nguyen, Dali Kaafar, Sean Lamont, and Daniel Coscia. 2022. SoK: Use of Cryptography in Malware Obfuscation. Cryptology ePrint Archive, Paper 2022\/1699. https: \/\/eprint.iacr.org\/2022\/1699 https:\/\/eprint.iacr.org\/2022\/1699."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","unstructured":"Curtis Carmony Mu Zhang Xunchao Hu Abhishek Bhaskar and Heng Yin. 2016. Extract Me If You Can: Abusing PDF Parsers in Malware Detectors. In NDSS. https:\/\/doi.org\/10.14722\/ndss.2016.23483","DOI":"10.14722\/ndss.2016.23483"},{"key":"e_1_3_2_1_6_1","volume-title":"Composition Kills: A Case Study of Email Sender Authentication. In 29th USENIX Security Symposium (USENIX Security 20)","author":"Chen Jianjun","year":"2020","unstructured":"Jianjun Chen, Vern Paxson, and Jian Jiang. 2020. Composition Kills: A Case Study of Email Sender Authentication. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, USA, 2183--2199. https:\/\/www.usenix.org\/ conference\/usenixsecurity20\/presentation\/chen-jianjun"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Jianjun Chen Xiaofeng Zheng Hai-Xin Duan Jinjin Liang Jian Jiang Kang Li Tao Wan and Vern Paxson. 2016. Forwarding-Loop Attacks in Content Delivery Networks. In NDSS.","DOI":"10.14722\/ndss.2016.23442"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00127"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786835"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","unstructured":"Dave Crocker Dr. John C. Klensin Dr. Marshall T. Rose and Ned Freed. 2011. SMTP Service Extension for 8-bit MIME Transport. RFC 6152. https:\/\/doi.org\/10.17487\/RFC6152","DOI":"10.17487\/RFC6152"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom56396"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2049"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2045"},{"key":"e_1_3_2_1_14_1","volume-title":"Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types. RFC 2046. https:\/\/doi.org\/10.17487\/ RFC2046","author":"Freed Ned","year":"1996","unstructured":"Ned Freed and Dr. Nathaniel S. Borenstein. 1996. Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types. RFC 2046. https:\/\/doi.org\/10.17487\/ RFC2046"},{"key":"e_1_3_2_1_15_1","volume-title":"End-to-End Measurements of Email Spoofing Attacks. In 27th USENIX Security Symposium (USENIX Security 18)","author":"Hu Hang","year":"2018","unstructured":"Hang Hu and Gang Wang. 2018. End-to-End Measurements of Email Spoofing Attacks. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 1095--1112. https:\/\/www.usenix.org\/conference\/ usenixsecurity18\/presentation\/hu"},{"key":"e_1_3_2_1_16_1","unstructured":"Fortune Business Insights. 2024. Email Security Market Size Share & COVID-19 Impact Analysis By Deployment (Cloud On-Premises and Hybrid) By Application (BFSI Government Healthcare IT & Telecom Media & Entertainment and Others (Retail Defense)) and by Regional Forecast 2023--2030. https:\/\/www.fortunebusinessinsights.com\/email-security-market-106607."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485384"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.15"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC6530"},{"key":"e_1_3_2_1_20_1","unstructured":"Timo Longin. 2023. SMTP Smuggling - Spoofing E-Mails Worldwide. https:\/\/secconsult. com\/blog\/detail\/smtp-smuggling-spoofing-e-mails-worldwide\/."},{"key":"e_1_3_2_1_21_1","unstructured":"Timo Longin. 2023. SMTP Smuggling -- Spoofing E-Mails Worldwide. https: \/\/media.ccc.de\/v\/37c3--11782-smtp_smuggling_spoofing_e-mails_worldwide."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","unstructured":"Wei MAO and Jiankang Yao. 2012. SMTP Extension for Internationalized Email. RFC 6531. https:\/\/doi.org\/10.17487\/RFC6531","DOI":"10.17487\/RFC6531"},{"key":"e_1_3_2_1_23_1","volume-title":"MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text. RFC 2047","author":"Moore Keith","year":"1996","unstructured":"Keith Moore. 1996. MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text. RFC 2047. https:\/\/doi.org\/10. 17487\/RFC2047"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2048"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_9"},{"key":"e_1_3_2_1_26_1","volume-title":"HDiff: A Semi-automatic Framework for Discovering Semantic Gap Attack in HTTP Implementations. In 2022 52nd Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN)","author":"Shen Kaiwen","year":"2022","unstructured":"Kaiwen Shen, Jianyu Lu, Yaru Yang, Jianjun Chen, Mingming Zhang, Haixin Duan, Jia Zhang, and Xiaofeng Zheng. 2022. HDiff: A Semi-automatic Framework for Discovering Semantic Gap Attack in HTTP Implementations. In 2022 52nd Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE Computer Society, Los Alamitos, CA, USA, 1--13. https:\/\/doi.org\/10. 1109\/DSN53405.2022.00014"},{"key":"e_1_3_2_1_27_1","unstructured":"Dianne Skoll. 2024. MIME-tools. https:\/\/metacpan.org\/dist\/MIME-tools."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP"},{"key":"e_1_3_2_1_29_1","unstructured":"Steffen Ullrich. 2014. Dubious mime - conflicting content-transfer-encoding headers. https:\/\/noxxi.de\/research\/content-transfer-encoding.html."},{"key":"e_1_3_2_1_30_1","unstructured":"Steffen Ullrich. 2015. Dubious mime - conflicting multipart boundaries. https: \/\/noxxi.de\/research\/mime-conflicting-boundary.html."},{"key":"e_1_3_2_1_31_1","unstructured":"Steffen Ullrich. 2022. Mime is broken. https:\/\/2022.bsidesmunich.org\/talks\/001_ 07-W9SSVK-mime_is_broken\/."},{"key":"e_1_3_2_1_32_1","unstructured":"Steffen Ullrich. 2022. Mime is broken. https:\/\/github.com\/noxxi\/mime-is-broken."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"crossref","unstructured":"Verizon. 2019. 2019 Data Breach Investigations Report. https:\/\/www.verizon.com\/business\/resources\/reports\/2019-data-breach-investigations-report-emea.pdf.","DOI":"10.1016\/S1361-3723(19)30060-0"},{"key":"e_1_3_2_1_34_1","volume-title":"BREAKSPF: HowShared Infrastructures Magnify SPF Vulnerabilities Across the Internet. In NDSS.","author":"Wang Chuhan","year":"2024","unstructured":"Chuhan Wang, Yasuhiro Kuranaga, Yihang Wang, Mingming Zhang, Linkai Zheng, Xiang Li, Jianjun Chen, Haixin Duan, Yanzhong Lin, and Qingfeng Pan. 2024. BREAKSPF: HowShared Infrastructures Magnify SPF Vulnerabilities Across the Internet. In NDSS."},{"key":"e_1_3_2_1_35_1","volume-title":"31st USENIX Security Symposium (USENIX Security . USENIX Association","author":"Wang Chuhan","year":"2022","unstructured":"Chuhan Wang, Kaiwen Shen, Minglei Guo, Yuxuan Zhao, Mingming Zhang, Jianjun Chen, Baojun Liu, Xiaofeng Zheng, Haixin Duan, Yanzhong Lin, and Qingfeng Pan. 2022. A Large-scale and Longitudinal Measurement Study of DKIM Deployment. In 31st USENIX Security Symposium (USENIX Security . USENIX Association, Boston, MA, 1185--1201. https:\/\/www.usenix.org\/ conference\/usenixsecurity22\/presentation\/wang-chuhan"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00129"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Linkai Zheng Xiang Li Chuhan Wang Run Guo Haixin Duan Jianjun Chen Chao Zhang and Kaiwen Shen. 2024. ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies with Differential Fuzzing. In NDSS.","DOI":"10.14722\/ndss.2024.24031"}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Salt Lake City UT USA","acronym":"CCS '24"},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3670386","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,5]],"date-time":"2025-01-05T12:53:45Z","timestamp":1736081625000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3670386"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":37,"alternative-id":["10.1145\/3658644.3670386","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3670386","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}