Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Dear SMTP and TCP/IP network security gurus: I'm curious about what is the realistic risk of sensitive information (such as a email pdf attachment) being intercepted/read by a hostile party from a regular unsecured SMTP mail message AFTER the mail is transmitted from a US-based outbound SMTP mail host to an outside relay and BEFORE the mail reaches a US-based inbound mail host.

Again, I'm only specifically interested in the transit between the outbound and inbound mail server. The sender/receiving organization context is outside the scope of this question

Many thanks in advance for any efforts to answer this question and my apologies for my initial question reading like an RFP. I'm having a bored day!

share|improve this question

closed as too broad by Iszi, Adnan, TildalWave, Xander, GdD Dec 4 '13 at 16:10

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
What do you want, free consulting? This reads like an RFP. –  Lucas Kauffman Dec 4 '13 at 15:16
1  
+1 to @LucasKauffman - either that, or homework help. –  Iszi Dec 4 '13 at 15:19
1  
There is another way to word this question to get the answers you seek. –  makerofthings7 Dec 4 '13 at 15:25
1  
Not homework or work related. I wrote this all off the top of my head and I imagine any security guru should be able to answer this off the top of their head with some thought. I'm just trying to form a basis for how risky I (or anyone else) should feel when sending sensitive documents via email. The spirit I wrote this is in is that any answer that meets the criteria would eventually earn a famous badge. –  Matias Nino Dec 4 '13 at 15:28
    
Who hosts your servers? You mention US DNS services repeatedly but who decides what routing your packets travel? If your assumption is you are never going to be a target then is the organization using postcards instead of envelops? If not there lies the concern... –  zedman9991 Dec 4 '13 at 15:42

1 Answer 1

Highly likely that it can and is being done (please note that caveat at the end of the post), the NSA has already done this before (we are talking pre-PRISM era). The operation was named Room 641A. Where they eavesdropped all traffic. Consider that AT&T is a tier 1 provider and thus operates a large part of the internet.

Another instance which could be probable is abusing the backbone protocol of the internet BGP (Border Gateway Protocol). The protocol is meant to perform policy based routing before taking cost into account. This can, for instance, impede traffic from certain geographical area's reaching another Autonomous System. In practice it has been abused several times to re-route parts of the internet (if you actually manage to do this it's highly likely you are interested in the passing traffic). Refer to this article on Arstechnica.

"This year, that potential has become reality," Renesys researcher Jim Cowie wrote. "We have actually observed live man-in-the-middle (MitM) hijacks on more than 60 days so far this year. About 1,500 individual IP blocks have been hijacked, in events lasting from minutes to days, by attackers working from various countries."

At least one unidentified voice-over-IP provider has also been targeted. In all, data destined for 150 cities have been intercepted. The attacks are serious because they affect the Internet equivalents of a US interstate that can carry data for hundreds of thousands or even millions of people. And unlike the typical BGP glitches that arise from time to time, the attacks observed by Renesys provide few outward signs to users that anything is amiss.

"The recipient, perhaps sitting at home in a pleasant Virginia suburb drinking his morning coffee, has no idea that someone in Minsk has the ability to watch him surf the Web," Cowie wrote. "Even if he ran his own traceroute to verify connectivity to the world, the paths he'd see would be the usual ones. The reverse path, carrying content back to him from all over the world, has been invisibly tampered with."

caveat:

Nobody being capable of re-routing parts of the internet is interested in what you write in an email. Most of the time they are interested in specific targets. So if you are to make a formula, it would depend on the complexity of setup and the estimated information value.

share|improve this answer
    
Thanks! Fascinating answer! –  Matias Nino Dec 4 '13 at 15:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.