Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let us say that I send an email using Yahoo Mail or GMail. Can this email be intercepted using a packet sniffer?

On which port does the email travel? HTTP, SMTP, POP3?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Let us break this down into three parts:

  1. Between domains, the protocol is SMTP, which is essentially a relayed protocol. If SSL/TLS is not being used, a sniffer will detect anything. If SSL/TLS is being used, a packet sniffer will be able to know the from and to IP addresses, and any relay on the way would have to decrypt and then re-encrypt the email.

  2. If using POP/IMAP/SMTP from a thick client (e.g. Outlook) to any one of these services, the port numbers vary but there are well-known ones.

  3. If using the Web interface of these services, then the ports are 80 (HTTP) and/or 443 (HTTPS) from your user agent (browser) to the originating domain - (Google or Yahoo). There, the packets are de-crypted to clear-text and then optionally re-encrypted if the target domain or a relay supports SSL/TLS over SMTP. After that, the process reverses itself: If your target domain's user is also using a browser, then the reverse will happen and clear-text email stored on the target domain's mail server will be encrypted to HTTPS sent over client ports (random ports) to the end user.

In short,

  • if not using SSL/TLS, everything is visible.
  • if using SSL/TLS, everything is visible to the relays but not in transit.
  • port numbers may vary.
share|improve this answer
    
Thank you so much for your response. I want to ask you another question if possible. This morning, I was experimenting with a few keyloggers. Two of these keyloggers had an optiion to send the logs to an email account using a Gmail account provided by the user. Now let us say that when the keylogger sends the email, the user has a packet sniffer running and is not doing anything web-related (that is, web browser closed, no downloading etc). Will the packet sniffer be able to pick up this email? On what port should the packet sniffer listen? –  Matthew Mar 27 '13 at 16:01
    
@Matthew Yes, a packet sniffer will be able to pick this up. It might be an encrypted connection though, then you can't read it. The default port for this is 25, but any could theoretically be used. The browser or other programs do not need to be closed (though it helps for inexperienced users to find the packet). –  Luc Mar 28 '13 at 15:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.