Research: Exploiting Jsonpickle to Get RCE

Introduction

Jsonpickle is a python library which is widely used to serialize and deserialize python objects. Serialization is very useful to save state for an object and reconstruct the object from that state.

In this post, we will exploit the latest jsonpickle library to get remote command execution.

Installation

Jsonpickle is available on the Python Package Index (PyPI), a repository hosting over 10TB of packages that programmers use to build their applications. We install the library with the command, pip3 install jsonpickle.

Setting Up Jsonpickle

For the scope of this article, we will focus on only two functions from the jsonpickle library: encode and decode.

First, we define a class named “zoo” and create an object for it.

Figure 1: Creating a class and an object for it

Now if we want to save the state of the object, we can encode the object with jsonpickle and print the byte stream, which can be used later to reconstruct the object with its state included.

Figure 2: Encoding the object with jsonpickle

Conversely, we can reconstruct the object with a decode function.

Figure 3: Decoding the object with jsonpickle

Attack Scenario

Now that we’ve demonstrated the two functions and how they work, we are ready to move forward with the attack.

Since we are attacking the jsonpickle library, we create a sample web application with jsonpickle to attack.

Our simple web application takes the base64 encoded serialized data and then decodes the base64 to jsonpickle object. And finally convert the jsonpickle object to actual object

Figure 4: Demonstrating encoding and decoding jsonpickle object

So, when we run the application with flask run, we can pass our data to http://127.0.0.1:5000/data?serialized= to interact with jsonpickle library

Creating the Exploit

So, we create a class RCE with member function reduce which will execute our payload.

After creating the object, we need to serialize the object and encode it with base64 so it can be passed to our web application.

Figure 5: Creating RCE and a serialized object

Now we copy the base64 payload and pass it to our web application, and we see that the command execution is successful and we have compromised the application.

Figure 6: Compromised application from base64 payload

Key Takeaway

The vulnerability is in the latest version of the jsonpickle library. As there are no fixes available, use of this library should be avoided. If the need to use jsonpickle still arises, ensure that jsonpickle does not handle unprocessed user data.

#jsonpickle #python #exploit

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Error Handling

I decided to focus this article on Error handling because it is a very common security problem if it is not handled properly. This topic is very tightly coupled with logging, but for this article, I will just cover error handling.

I saw on many websites that error messages presented to the user (in this case, me) need to be handled properly so they don’t reveal implementation details. You are familiar with the fact that hackers will look deeply into these messages because they know that if they contain information that should not be revealed, they could help them and be like little clues made out of exploitable pieces.

The most common errors I have seen were detailed internal error messages which are displayed for the user, even sometimes as toast messages.

Why are internal errors presented to the users?

The first problem is always the lack of documentation for the web application. By that, I mean that often due to the time deadlines when setting up the architecture creating the documentation ends up being somewhat neglected.

Also, logging is often implemented as the last step when setting up the architecture or even after some basic functional code is written. And then, with the lack of documentation about error handling, developers often try to follow the steps of the error handling code they find in the application without any consistent guidance. And in the end, you get messy code, poorly implemented error handling, and exposed data that should not be revealed!

Where should errors be handled in the web application?

First, in the mentioned documentation for the web application. There should be defined a policy that will define which types of errors should be handled, what messages should be presented to the user, and what information should be logged.

You can choose where you should handle the errors. It would be eighter on the server side, on the client side, or even both.

*In my practice, I handled the server errors in the API and sent the proper user message to the client side to be presented to the user if needed. I created a custom error handler for the client errors and presented user-friendly error messages again.

Tips for the error messages style on the client side

In this list, I will focus just on the error messages style, which will be presented for the user eighter they are created on the client side or the server side and sent to the client side.

Error and warning messages should be short and use clear and simple language (don’t use technical language). They should provide a short explanation why the problem is occurring and how to fix it (if it is feasible). In short- give direction to the user.
Error message images should be applied differently for different scenarios broken, not found, construction, access rights, and other errors.
By broken I mean when the Error is 500 when you can not launch some content or load it. Not found I mean when you get 400 error, or the page is not loading. By construction when it is planned site maintenance or some sync of the data. When other errors occur such as some action is not completed successfully you can implement basic toast message with red color. You can also use toast messages when there are some background errors.
They can be modified as you wish, they can be closed after the user decides to close them or they can disappear after some time (delay).
Don’t use uppercase text
Put the error message in the proper place. For example, if you have validation error messages for fields in form, place them so it is easy to understand which message is for each field.

Useful links for error handling:

How to implement toast messages on the client side?

I will explain how to implement and use toast service on the client side, in this example, using Angular 13.

We want to catch and show error messages in two cases, one is when they get from HTTP response and the second one is when we decide to show them because of failure on the client side.

We need first to download ngx-toastr module by running npm i ngx-toastr. You can check out more about ngx toastr on their GitHub. On the site, you can follow the instructions on how to implement it so you can use it in code: add CSS, add ToastrModule (and BrowserAnimationsModule).

To show all error messages we are receiving from the server side, we need to intercept them from HTTP response. In this case we can create and use a custom HTTP interceptor class and implement in it toast service.

@Injectable()
export class CustomHttpInterceptor implements HttpInterceptor {
 
     constructor(private spinnerService: SpinnerService, private toastrService: ToastrService) { }
 
    intercept(req: HttpRequest, next: HttpHandler): Observable<HttpEvent> {
 
        this.spinnerService.show();
 
        return next.handle(req)
             .pipe(tap((event: HttpEvent) => {
                    if (event instanceof HttpResponse) {
                        this.spinnerService.hide();
                    }
                }, (error) => {
                    if(error.status == 400) {
                        this.toastrService.error("Warning", error.error.Error)
                    } else if(error.status == 500){
                        this.toastrService.error("System error is occured");
                    }
                    this.spinnerService.hide();
                }));
    }
}

In the first example you will see how and when we are catching errors and how we will present them to the user to be user-friendly.

  update(category: CategoryDetail) {
    this.subsink.sink = this.categoryService
      .update(category.id, category)
      .subscribe((data) => {
        if (data != null && data.error) {
          this.toastrService.error("Update failed", data.error);
        } else {
          this.toastrService.success("Update was successful");
          this.loadCategories();
        }
        this._spinnerService.hide();
        this.loadCategories();
      });
  }

In the second example, you will see how to handle errors when getting the response for update functionality.

As you can see, you can easily use ngx-toastr!

How to handle errors on the server side?

As I mentioned it is very important for you are handling errors on the server side as well. You are also creating users error messages.

I will give you just the direction on where to look and how to handle errors in ASP.NET Core 6.

When you check it out, you will see the example using interface IActionResult when sending back the response, where to register Exception Handling Middleware instances, how to create HttpResponseException by extending Exception, how to create an action filer HttpResponseExceptionFilter, etc.

Conclusion

As I mentioned before, error handling goes side by side with logging. Logging is a large topic that needs its own “space,” so it will be covered in the future. There is plenty of documentation on the internet for error handling based on different technologies. But most important is the documentation about it when you decide on the architecture you are going to use.

Also very important is the testing part of the development and also after, because hackers are going to test very uncommon cases to try to invoke errors that you didn’t have in mind to handle them.

Good luck in catching errors!

Cover photo by Eric Mclean!

#error_handling #error_messages

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Network Analysis and Automation Using Python

Introduction

Some people working as a SOC (Security Operation Center) relaying on the tools/solutions they are using in the first place for monitoring. But, some times you will need to do your own tool & automation to help you on the way you work or thinking “Your mindset”. So, this blog will explain how to use python with Scapy library along with tcpdump to analysis our network traffic & we will write an automation to detect port scanning as i will be performing the attack on the lab that contains 2 machines (Virtual Lab) first machine is the Attacker(Parrot OS) machine & the second is the Victim(Ubuntu).

Why Python and Scapy ?

As we all know Python is widely used and the reason to choose it, Is the easy syntax. It’s not effective language in performance for sure like C/C++,Go,Rust, etc.. But, it will not be complicated for these who want to use the easy way. Why specially Scapy and not other libraries ?. Basically, the Scapy library is so powerful and effective in manipulate, attack & scan networks “Low-Level library”. It’s easy to use and play with the large features. The most great thing about it is a widely used library and documentation for Scapy. Therefore, I will explain for you all the important usage for the library that you would need.

Capture the traffic

Now, we will set both of the machines to Host-Only adapter to avoid any other additional & junk traffic on the network. So, we got the attacker machine with the following IP 192.168.11.130 and the Victim machine with the following IP 192.168.11.131. We will perform some Port Scanning to discover the used services by the Victim machine, While we are running tcpdump on it to capture the network traffic will be generated by our actions. Let’s run tcpdump using the following command tcpdump -i <Interface> -w file_name.pcap.

Basically, the -i is to identify which interface the tcpdump will work on and -w to write the captured traffic into a file “You have to give the file name as a value”. Now, time to simulate our attack on the victim.

In the above picture we perform a Port Scanning using Nmap. As explain for the command in the screenshot:

-Pn: Disable ping request to the target.
-n: Disable DNS resolution.
--open: Display only open ports.
-v: For verbose.

Results show us that FTP & SSH services are running.

The reason why i disabled the ping and dns requests is to reduce the traffic & You could use nmap just to scan the 21/ftp port also, 22/ssh port using the -p option and give it the ports you wish to scan and separate it by , (e.x:-p 21,22,80,8080).

Read the traffic with

It’s the moment to analysis the traffic we captured. First, turn off tcpdump using CTRL+C keys. And after listening the files you will be able to see our captured file whicc is traffic.pcap as we saved.

Before we start we need python3 & Scapy package installed. You can install Scapy using pip as the following pip install scapy. Also, you can use a text editor for your code or an IDE, I am going to use Pycharm during this blog. let’s run our IDE and start coding.

So, Lets explain the above code to understand the basics of Scapy.

import scapy.all as scapy
import argparse

Here we import the libraries we do need, I imported Scapy as it’s the main one for our topic & i used argparse to parse the input using command line arguments.

parser = argparse.ArgumentParser()
parser.add_argument("-f", "--file", help="Read a single file.", type=str)
args = parser.parse_args()

We created our parser now and added an argument with type String. Then, we make the argument -f or --file. Then we parsed the arguments of our parser in args variable.

After that we created a function and naed it Start() and it takes one argument called file which gonna be the file path we will provide to analysis & read the data from the pcap file. Now, the actual code inside our Start() function.

print(f"[+] Reading: {file}"): Print the file path we provided.
p = scapy.rdpcap(file): Start read the pcap file and store it inside p variable.
packets = len(p): Get the length of the pcap file we have read which is also the number of packets and we stored it into packets variables.
print(f"[+] NUmber of packets {packets}"): Print the number of packets.

The following lines we created a for loop in range of packets number, that starts from index 0 to the packets number.

pkt = p[i]: Variable pkt to store the packet which the index is i referees to the packet number in the packets.

Now, to explain the rest of the code we need to under stand the format of the packets in Scapy & how its parsing them. So, we are going to use Scapy from the command Line Interface to explain it.

In the above picture we read the pcap file through the Command Line Interface for Scapy inside p variable and then we executed it and got the following output <traffic.pcap: TCP:2004 UDP:6 ICMP:0 Other:0>. It tells you information about the packets inside the file like: “Numbers of TCP,UDP, ICMP & others packets”. Now, if we try to show one of the packets for example packet number 1 using p[1] we will get the following results:

<Ether  dst=00:50:56:c0:00:01 src=00:0c:29:03:24:31 type=IPv4 |
<IP  version=4 ihl=5 tos=0x0 len=59 id=34743 flags=DF frag=0 ttl=64 proto=udp chksum=0x1b27 src=192.168.11.130 dst=192.168.11.1 |
<UDP  sport=50882 dport=domain len=39 chksum=0x980c |
<DNS  id=37950 qr=0 opcode=QUERY aa=0 tc=0 rd=1 ra=0 z=0 ad=0 cd=0 rcode=ok qdcount=1 ancount=0 nscount=0 arcount=0 qd=<DNSQR  qname='deb.parrot.sh.' qtype=AAAA qclass=IN |> an=None ns=None ar=None |>>>>

Explainig the output:

Ether: Layer 2 captured data like MAC address.
IP: Layer 3 captured data like Source & Destination address.
UDP: Layer 4 Used protocol and the Source & Destination ports.
The rest are additional information according to the service used and the packet data. Also, the UDP could be TCP depending on the used type. For example the following packet is a TCP packet.

<Ether  dst=00:0c:29:0b:30:bd src=00:0c:29:03:24:31 type=IPv4 |
<IP  version=4 ihl=5 tos=0x0 len=60 id=23363 flags=DF frag=0 ttl=64 proto=tcp chksum=0x4723 src=192.168.11.130 dst=192.168.11.131 |
<TCP  sport=56544 dport=20000 seq=1686682144 ack=0 dataofs=10 reserved=0 flags=S window=64240 chksum=0x9884 urgptr=0 options=[('MSS', 1460), ('SAckOK', b''), ('Timestamp', (17410562, 0)), ('NOP', None), ('WScale', 7)] |>>>

Why we needed to know this ?, Cause when you want informations from the packet you have to specify the Layer you want data from and what data do you want for instance, You want the Destination port. So, we gonna fetch it as this packet["TCP"].dport. (packet["Layer"].key).

Now, Back to the rest of our code. we made an exception here in the following code:

First, it’s gonna try to check if the packet is TCP and will print the packet information with type TCP. If not the exception will print it as UDP type.

try:
    if pkt["TCP"]:
        print("========================================================")
        print(f'[+] Packt Number: {i}, Version: IPv{pkt["IP"].version}, '
              f'Type: TCP, Source IP: {pkt["IP"].src}, '
              f'Destination IP: {pkt["IP"].dst}, Source Port: {pkt.sport},  Destination Port: {pkt.dport}')
        print("========================================================")
except:
    print("========================================================")
    print(f'[+] Packt Number: {i}, Version: IPv{pkt["IP"].version}, '
          f'Type: udp, Source IP: {pkt["IP"].src}, '
          f'Destination IP: {pkt["IP"].dst}, Source Port: {pkt.sport},  Destination Port: {pkt.dport}')
    print("========================================================")

The information that will be printed:

Packt Number: {i}: Packet number.
pkt["IP"].version: IP version v4/v6.
pkt["IP"].src: Source IP.
pkt["IP"].dst: Destination IP.
pkt.sport: Source Port.
pkt.dport: Destination Port.

Running the code and the results:

Here we do grep from the shell to get the lines contain udp which are the UDP packets and it’s include all the information we added to the could to be printed.

Manual Analysis for Port Scan traffic

After all what we go through. Now, it’s the time to analysis our captured file manually using wireshark to see how the port scanning we performed is working and the traffic of the opened & closed ports. Then, we will use Scapy to automate the detection of port scanning. run wireshark from the command line and provide the file to it wireshark file.pcap

we can see a big traffic and to make the analysis more easy we gonna to compare the open ports traffic with the closed one.

Using the tcp.port==22 will show us traffic of port 22 which is SSH protocol. We can see that the attacker 192.168.11.130 connecting to 192.168.11.131 which is the victim on port 22 as the following:

Attacker Sends connection request on port 22 along with SYN flag

Attacker => SYN => Victim

Victim response with SYN/ACK flags which means the port is open

Victim => SYN/ACK => Attacker

Attacker send ACK flag which now is fully connected and can start use the service

Attacker => ACK => Victim

At the end attacker send RST/ACK which will close the connection with the victim

Attacker => RST/ACK => Victim

The above analysis was for an open port. So, let’s see how is it for a closed one for example one of the ports we know it’s closed like 8080 let’s filter it out using tcp.port==8080.

Attacker Sends connection request on port 8080 along with SYN flag

Attacker => SYN => Victim

Victim Response RST/ACK which means that no open ports

Victim => RST/ACK => Attacker

After we knew the behaviour for both open/closed ports in the traffic. Therefore, Let’s automate the detection.

Automated Analysis & Detection

From what we understand in the manual analysis we can check the flags for ports packets detect port scanning by analysis the attempts of connection on different ports. So, lets take the short path and search for failed connections in the packets and see if it’s for the same IP.

import scapy.all as scapy
import argparse

parser = argparse.ArgumentParser()
parser.add_argument("-f", "--file", help="Read a single file.", type=str)
args = parser.parse_args()

flag = []

def check_flags(attacker, server, port):
    if flag[0] == "S" and flag[1] == "RA":
        print(f'[!] Failed connection: {attacker} ====> {server}:{port}')


def Start(file):
    print(f"[+] Reading: {file}")
    p = scapy.rdpcap(file)
    packets = len(p)
    print(f"[+] NUmber of packets {packets}")

    for port in range(0, 65536):
        for i in range(0, packets):
            pkt = p[i]

            try:
                if pkt.sport == port or pkt.dport == port:
                    if pkt.dport == port:

                        flag.append(str(pkt["TCP"].flags))
                    elif pkt.sport == port:
                        flag.append(str(pkt["TCP"].flags))
                        check_flags(pkt["IP"].dst, pkt["IP"].src, port)
                        flag.clear()

            except:
                pass


Start(args.file)

The code will print the failed packets that try to connect to a closed port and print us out the results.

Let’s explain the code:
There are some parts of the code are the same to the above one. So, Just the new added lines will be explained

flag= []: created array.
for port in range(0, 65536): A for loop in range of all the ports number in the exist. The following lines we created a for loop in range of packets number, that starts from index 0 to the packets number. Therefore, we gonna take all packets and check if the Source Port or Destination Port in it is equal to our port number. Then, as the Destination Port is the first sent in the packet which will carry the SYN flag with it as a try to connect to this port, we gonna save it’s flag in the array first. Aبter that we save the flag coming from the Server which come on the same port as a Source Port. then we call the function check_flags and pass the arguments to it. What this function do is the following:

def check_flags(attacker, server, port):
    if flag[0] == "S" and flag[1] == "RA":
        print(f'[!] failed connection: {attacker} ====> {server}:{port}')

This function is taking 3 arguments which is the Attacker IP, Server IP & the port number. After that it checks if the first & second elements of the array flag is equal to S & RA
Which means a failed connection on a closed port.

flag.clear(): clear the array after check.

Running the script:

As you can see a lot of failed connections from the same IP address on different ports. If you look clearly on the picture. You will see that port 22 not here cause it’s an open port and created a success connection.

Conclusion

At the end Port Scanning has a lot of types and what we saw in the blog was just an example. I would recommended that you go though Scapy documentation and try to perform different scanning types on your environment and analysis the traffic manually then automate it. Therefore, you will be able to detect that scan type.

#python #network #scanning #nmap

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

The Dark Stuff – Continued – Torrc

Default configuration should be what you’re using for a while, at least before familiarizing yourself a bit more intimately with the Tor documentation. However, aside from the GUI-based set up of the browser, I want to try and explain how you would set your Tor browser through the Torrc config file.

I will assume you’re more than familiar with Tor, or have gone through the docs, and that you know what’s the purpose of the Torrc file.

You can find your torrc file in the \Tor Browser\Browser\TorBrowser\Data\Tor path, where Tor Browser is the Tor’s installation folder.

It would look something like this (on a Windows-based machine)

On your Mac, you need to go to the Application and right-click on the Tor browser app icon, selecting the show package contents and navigate to TorBrowser/Data/Tor/Torrc.

On Linux, the file will be in the TorBrowser/Data/Tor path and Tor will also put it into /usr/local/etc/tor/torrc if compiled from source, or in the etc/tor/torrc or etc/torrc if installed as a package.

Check out the manual at this link. You will see a detailed list of options used in the torrc file. You can also do man tor, you can also check out the sample torrc file. This is good to check out since it has a lot of comments.

One of the main things people tend to change are the entry and/or exit nodes – thus changing the geographical location of the said nodes and is a good simple example for us here.

Check ExcludeNodes node,node,…

And you will notice that country codes are 2-letter ISO3166 codes and that they must be enclosed by braces. So, something like {fr} is a valid country code and would set your entry/exit node to France. Note that the country codes are not case-sensitive. And also keep in mind that {??} exists for nodes whose country can’t be identified. More about that can be found at the Tor manual link above.

I’ve now added entry/exit nodes to the torrc file:

As shown in the image above, I want to start the Tor circuit in France, and I want to exit in Great Britain.

I searched for Google.com…

And, as you can see, the change made to the torrc file has been applied. If I click on new circuit for this site:

You will note that the entry and exit nodes stayed on the same countries that were previously specified in the torrc file.

You can also specify actual relays that you want to use. Go to https://metrics.torproject.org/ and and do a relay search (bottom of the page) for a relay of your choosing. (I chose top relays options just to quickly demonstrate how you would add a relay to the torrc file)

Another important thing are the flags, they will usually tell you what’s the best use of a given relay. If its fast, suitable for entry/exit, if it is validated, and more.

If I were to pick the first relay (xor) I would copy paste the fingerprint into my torrc file

All of this depends on your risks, rather who is your adversary. For example, if they are outside those relays (and you know that) then the relay might help you stay hidden, but nothing is given. If they control the relays… well, then they might be onto you and it’s time to adapt your tactics.

One more thing, unless you’re a seasoned veteran, maybe refrain from manually changing the circuits because this can make you stand out in theory so maybe don’t do that unless you’re sure.

To apply the configuration from the newly-changed torrc file, restart the browser. You can also do pkill -sighup tor on Linux, but it might even be easier (and better) to just restart the browser.

Conclusion

Okay, this was a very short intro to the torrc but I hope you liked it and that you will find the links I shared useful! The saga continues, as I will be publishing another Tor piece shortly…

Stay tuned!

Cover image by Sandeep Swarnkar

#tor_browser #torrc

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Master Your Domain Aliases

Make it easy to send branded email signatures when using a domain alias

ack in the very early days of CloudM, we had a problem!

Even though we were talking to customers and selling as CloudM, our emails (and their signatures) would often come from our parent company, causing unnecessary confusion.

“Who are you?”, we would hear. “I’ve been talking to CloudM”. And, where there is confusion, there’s doubt. “Who am I really dealing with here?” Even if it was never brought up as a reason, we knew it was costing us – both business and reputation.

Well, the easiest way to get around this was to use a domain alias address, allowing our employees to effortlessly switch between their parent company and CloudM email addresses depending on who they were talking to, with all responses sent to the same inbox. Even today, we have centralized staff that need to represent both sides of the company.

With so many companies now having multiple brands and domains under their umbrella, using an alias is getting even more common. Did you know that, in 2020, Unilever NV had 1,181 individual domain names including Ben & Jerry’s and Dove?

But, this brings up another problem – How do you make the email signature represent the brand you are sending the email from?

Introducing Domain Alias Signatures – a new feature for Gmail within our CloudM Email Signature Management module that allows you to set bespoke email signatures that will be displayed depending on which email address the user decides to send the email from.

It could be as simple as the primary email address displaying your company logo, and the domain alias email address displaying the logo of a specific brand.

Or, completely bespoke with different brand colors, fonts, contact details, and social media links, to name a few. And the best thing is that most of this information is added as a variable so that, as soon as a field such as job title is changed in CloudM, it is automatically changed on the email signature, quickly and easily keeping it up to date.

Domain Alias Signatures is just one of many new and exciting feature changes that we have added to our redesigned Email Signature Management module in the last 6 months, joining our brand new Template Gallery and the ability to schedule signatures for the primary domain, with many more updates in the pipeline.

Want to find out more?

Check out our Smart Teams video on YouTube and visit our CloudM website, or book a 15 minute discovery call to speak to one of our brilliant team.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CloudM
CloudM is an award-winning SaaS company whose humble beginnings in Manchester have grown into a global business in just a few short years.

Our team of tech-driven innovators have designed a SaaS data management platform for you to get the most from your digital workspace. Whether it’s Microsoft 365, Google Workspace or other SaaS applications, CloudM drives your business through a simple, easy-to-use interface, helping you to work smarter, not harder.

By automating time-consuming tasks like IT admin, onboarding & offboarding, archiving and migrations, the CloudM platform takes care of the day-to-day, allowing you to focus on the big picture.

With over 35,000 customers including the likes of Spotify, Netflix and Uber, our all-in-one platform is putting office life on auto-pilot, saving you time, stress and money.

2022 CloudM