#Seppmail
LightNews LightNews
ralf-ladner.bsky.social
E-Mail-Sicherheit in der Cloud darf nicht am Postfach enden

#Cybersecurity #Cybersicherheit #EMail #EMailSicherheit #Malware #Phishing @Seppmail #spam

netzpalaver.de/2026/...
September 23, 2026 at 2:11 PM
kennyog.bsky.social
If you want to be truly terrified, check out Andris’ Master’s thesis, where he reports 56 vulnerabilities against SEPPmail, including RCE. ethz.ch/content/dam/...
ethz.ch
September 10, 2026 at 8:21 AM
kennyog.bsky.social
Our latest “Crypto in the Wild” project, analysing secure email gateways. We give 29 cryptographic attacks on 4 different products, from SEPPmail, Cisco, Proton and CipherMail. Paper to appear at ACM CCS 2026.
eprint.ing.bot ePrint Updates @eprint.ing.bot · 19d
Why Johnny Should Not Delegate Email Encryption to Gateways (Andris Suter-Dörig, Matteo Scarlata, Kenneth G. Paterson) ia.cr/2026/1911
Abstract. Email encryption based on S/MIME and, to a lesser extent, PGP is widely deployed in enterprise environments, often through centralised server-side encryption gateways that decrypt and sign messages on behalf of end users. Gateways can also be run locally to implement encryption for email clients that do not natively support it. We systematically analyse the security of four such products: SEPPmail, CipherMail, Cisco Email Security Appliance, and the Proton Mail Bridge. We identify 29 attacks which allow an adversary to fully decrypt messages and confuse users on the authenticity of received emails. To this end, we exploit the legacy cryptographic primitives in S/MIME and the backwards compatibility features for PGP, adapt well-known attacks such as EFAIL (Poddebniak et al., USENIX Security 2018) to this setting, and expose novel attack vectors such as the error signals produced by email infrastructure. Our findings show that moving cryptographic operations to gateways strips important signals that email clients rely on. This re-enables attacks like EFAIL, which were largely considered resolved, and introduces exploitable features in how the security status of emails is communicated. Such systems also expose sensitive decrypted plaintext to intermediate email infrastructure, which was not designed to handle it. We conclude that delegating cryptographic operations to a gateway undermines the end-to-end security model that PGP and S/MIME were designed to provide. Image showing part 2 of abstract.
September 10, 2026 at 8:12 AM
eprint.ing.bot
Why Johnny Should Not Delegate Email Encryption to Gateways (Andris Suter-Dörig, Matteo Scarlata, Kenneth G. Paterson) ia.cr/2026/1911
Abstract. Email encryption based on S/MIME and, to a lesser extent, PGP is widely deployed in enterprise environments, often through centralised server-side encryption gateways that decrypt and sign messages on behalf of end users. Gateways can also be run locally to implement encryption for email clients that do not natively support it. We systematically analyse the security of four such products: SEPPmail, CipherMail, Cisco Email Security Appliance, and the Proton Mail Bridge. We identify 29 attacks which allow an adversary to fully decrypt messages and confuse users on the authenticity of received emails. To this end, we exploit the legacy cryptographic primitives in S/MIME and the backwards compatibility features for PGP, adapt well-known attacks such as EFAIL (Poddebniak et al., USENIX Security 2018) to this setting, and expose novel attack vectors such as the error signals produced by email infrastructure. Our findings show that moving cryptographic operations to gateways strips important signals that email clients rely on. This re-enables attacks like EFAIL, which were largely considered resolved, and introduces exploitable features in how the security status of emails is communicated. Such systems also expose sensitive decrypted plaintext to intermediate email infrastructure, which was not designed to handle it. We conclude that delegating cryptographic operations to a gateway undermines the end-to-end security model that PGP and S/MIME were designed to provide. Image showing part 2 of abstract.
September 10, 2026 at 8:07 AM
ralf-ladner.bsky.social
E-Mail-Sicherheit in Behörden erfordert Schutz ohne zusätzliche Hürden

#Behörde #Cybersecurity #Cybersicherheit #EMail #EMailSicherheit @Seppmail #Verschlüsselung #Zertifikat

netzpalaver.de/2026/...
September 9, 2026 at 1:52 PM
neonotu.bsky.social
🟠 HOCH · SEPPmail Secure E-Mail Gateway: mehrere Schwachstellen

CERT-Bund (BSI)
SEPPmail Secure E-Mail Gateway: mehrere Schwachstellen
CERT-Bund (BSI) meldet mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway mit dem Schweregrad hoch. Die vollständige Beschreibung mit betroffenen Versionen und empfohlenen Maßnahmen steht beim …
www.neonotu.com
September 4, 2026 at 1:08 PM
ralf-ladner.bsky.social
Der blinde Fleck der E-Mail-Sicherheit - ausgehende E-Mails

#Cybersecurity #Cybersicherheit #EMailSicherheit @Seppmail #Verschlüsselung #EMailSecurity #EMailVerschlüsselung

netzpalaver.de/2026/...
September 2, 2026 at 1:00 PM
neonotu.bsky.social
🟠 HOCH · SEPPmail Secure E-Mail Gateway: mehrere Schwachstellen

CERT-Bund (BSI)
SEPPmail Secure E-Mail Gateway: mehrere Schwachstellen
CERT-Bund (BSI) meldet mehrere Schwachstellen in SEPPmail Secure E-Mail Gateway mit dem Schweregrad hoch. Die vollständige Beschreibung mit betroffenen Versionen und empfohlenen Maßnahmen steht beim …
www.neonotu.com
August 25, 2026 at 12:08 PM
inside-it.ch
Die Phishing-Simulationen und Security-Awareness-Trainings von Cyberpilot sollen künftig Teil einer rein europäischen Sicherheitsplattform von Seppmail werden.
Seppmail kauft dänische Cyberpilot
Der E-Mail-Spezialist erweitert sein Portfolio um Phishing-Simulationen und Security-Awareness-Trainings. Dafür wird bewusst auf europäische Technologie gesetzt.
www.inside-it.ch
August 20, 2026 at 10:10 AM
itreseller.bsky.social
Seppmail übernimmt Cyberpilot
Seppmail erweitert mit der Übernahme von Cyberpilot sein Portfolio um den Bereich Human Risk Protection. Dabei setzt man weiter auf einen klaren Europa-Fokus und den exklusiven Vertrieb via Channel.
dlvr.it
August 20, 2026 at 8:54 AM
ralf-ladner.bsky.social
Cloud-Sicherheit endet nicht beim Provider

#Authentifizierung #Authentizität #CloudSicherheit #Cybersicherheit #EMail #Rechenzentrum #SecureEMailGateway @Seppmail #Signatur #Transportverschlüsselung #Verschlüsselung

netzpalaver.de/2026/...
August 18, 2026 at 1:44 PM
pressewelle.de
Cloud-Sicherheit endet nicht beim Provider #IT #Software
Cloud-Sicherheit endet nicht beim Provider
Artikel von SEPPmail Deutschland GmbH
dlvr.it
August 18, 2026 at 9:06 AM
ralf-ladner.bsky.social
Seppmail übernimmt Cyberpilot und beginnt den Ausbau einer führenden europäischen Plattform für E-Mail-Security

Cyberpilot #Cybersicherheit #EMailSecurity #HumanRiskManagement #HumanRiskPrevention #SecurityAwareness @Seppmail #Sovereignty

netzpalaver.de/2026/...
August 13, 2026 at 2:53 PM
pressewelle.de
SEPPmail übernimmt CyberPilot und beginnt den Ausbau einer führenden europäischen Plattform für E-Mail-Security #IT #Software
SEPPmail übernimmt CyberPilot und beginnt den Ausbau einer führenden europäischen Plattform für E-Mail-Security
Buy-and-Build für datensouveräne E-Mail-Security aus Europa
dlvr.it
August 13, 2026 at 8:32 AM
ralf-ladner.bsky.social
Interview mit Seppmail – E-Mail-Sicherheit in der Cloud

#Netzpalaver #Cloud #CloudEMail #Cybersecurity #Cybersicherheit #EMail #EMailInfrastruktur #EMailSicherheit #PostQuantumCryptography #PQC @seppmaildach.bsky.social #Signatur #Verschlüsselung

netzpalaver.de/2026/08/05/i...
August 6, 2026 at 2:41 PM
martinsteiger.ch
#KI in allerlei Varianten, #SEPPmail und #HIN Mail, Phishing-E‑Mails und Creative Commons-Lizenzen.

Anders gesagt: Viele Follow-up-Themen in den aktuellen «Datenschutz-Plaudereien»! 🎧

podcast.datenschutzpartner.ch/410-follow-u...
DAT410 KI: Amerikanische Anbieter, lokale Hardware und Alternativen in der Schweiz (Follow-up)
Andreas Von Gunten und Martin Steiger diskutieren Rückmeldungen und Themen aus früheren Podcast-Episoden. Es geht insbesondere um KI in verschiedenen Varianten, aber auch um Creative Commons-Lizenzen,...
podcast.datenschutzpartner.ch
July 21, 2026 at 6:19 AM
cve.skyfleet.blue
CVE-2026-9592 - Sensitive Information Disclosure in HTTP header
CVE ID : CVE-2026-9592

Published : July 17, 2026, 2:17 p.m. | 1 hour, 20 minutes ago

Description : SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay &amp...
CVE-2026-9592 - Sensitive Information Disclosure in HTTP header
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
cvefeed.io
July 17, 2026 at 5:48 PM
euvd-bot.bsky.social
🚨 EUVD-2026-45174
📊 7.5/10

📝 SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session t...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45174

#cybersecurity #infosec #cve #euvd
July 17, 2026 at 4:00 PM
ralf-ladner.bsky.social
Kalender-Phishing: Wenn der Angriff nicht mehr im Postfach landet

#Cyberangriff #Cybersecurity #Cybersicherheit #EMailSicherheit #Kalender #KalenderPhishing @Seppmail #SocialEngineering #TeamsMeeting #Termin

netzpalaver.de/2026/...
July 15, 2026 at 12:22 PM
pressewelle.de
Kalender-Phishing: Wenn der Angriff nicht mehr im Postfach landet #IT #Software
Kalender-Phishing: Wenn der Angriff nicht mehr im Postfach landet
Artikel von SEPPmail Deutschland GmbH
dlvr.it
July 15, 2026 at 11:06 AM
cve.skyfleet.blue
CVE-2026-8811 - Path traversal in PDF generation module
CVE ID : CVE-2026-8811

Published : June 18, 2026, 9:05 a.m. | 2 hours, 30 minutes ago

Description : SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An...
CVE-2026-8811 - Path traversal in PDF generation module
SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory, potentially placing files in web-accessible locations.
cvefeed.io
June 18, 2026 at 12:04 PM
euvd-bot.bsky.social
🚨 EUVD-2026-37866
📊 7.1/10
🏢 SEPPmail AG

📝 SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to creat...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37866

#cybersecurity #infosec #cve #euvd
June 18, 2026 at 11:00 AM
seppmaildach.bsky.social
SEPPmail präsentiert auf der Public-IT-Security (PITS) 2026 in Berlin seine aktuellen Lösungen für sichere E-Mail-Kommunikation, -Verschlüsselung und den Schutz digitaler Identitäten.

📍 Stand 5 (Erdgeschoss)

Wir freuen uns auf den Austausch vor Ort!

#seppmail #pits2026 #itsecurity #cybersecurity
June 10, 2026 at 9:05 AM
ralf-ladner.bsky.social
Seppmail auf der PITS 2026 - Sichere E-Mail-Kommunikation für Behörden und öffentliche Verwaltung

#Behörde #Cybersicherheit #EMailKommunikation #Identitätsdiebstahl #PITS2026 #PublicITSecurity @Seppmail

netzpalaver.de/2026/...
June 3, 2026 at 12:15 PM