Tag Info

Hot answers tagged

224

IMPORTANT: this is based on data I got from your link, but the server might implement some protection. For example, once it has sent its "silver bullet" against a victim, it might answer with a faked "silver bullet" to the same request, so that anyone investigating is led astray. I have tried sending a fake parameter of cHVwcGFtZWxv to see whether it ...


37

An SMTP session between two mail servers may be encrypted, but only if both ends support it and if both ends choose to use it. So if you're sending mail from Gmail to example.net, then Google could only encrypt if example.net was ready and willing. For this reason, you cannot trust email to be even moderately secure at the transport layer. (The only safe ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


25

I think you're overestimating the risk of enabling STARTTLS. Sure, there have been some incidents with OpenSSL recently, but does it mean we should all stop using HTTPS? In your situation, here is the trade-off: Using STARTTLS may open up security holes on your machines Not using STARTTLS will allow anyone snooping (on the network, on underwater ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


11

The keylogger looks to be sending email using Gmail but the SMTP communication is encrypted with TLS (SSL). Simple Mail Transfer Protocol Command Line: STARTTLS\r\n Command: STAR Request parameter: TLS Simple Mail Transfer Protocol Response: 220 2.0.0 Ready to start TLS\r\n Response code: <domain> Service ready (220) ...


11

They block outbound connections because of home computers turned zombies, as part of spammer-controlled botnets. They don't actually block all outbound connections to port 25; they just block all connections which do not target Comcast's own SMTP server. This is a way to force all emails to go through their own SMTP server, in which they may apply spam ...


11

Depending on how your application creates the actual RAW email request, it may be possible to insert line feeds to modify the recipients, CC, BCC etc. Check out this example: In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see [ ...


10

Summary Select STARTTLS or SSL/TLS on connection. Unless told otherwise by your administrator use normal password on authentication. If your connection is secure, the password may be sent unencrypted through the encrypted connection. If the connection is not secure, using a secure authentication keeps your password protected. But it may allow an attacker ...


9

There are three points in the chain you need to consider: Transport between mail servers (e.g. between Google and example.org), transport between mail servers and clients, and the mail servers themselves. Traffic between mail servers may or may not be encrypted; you shouldn't rely on it, and AFAIK, there is no way to enforce it from the client. Traffic ...


8

There's two different questions here: Does the email system allow emails to be sent to it over an encrypted channel and send email along an encrypted channel when the recipient's mail server supports it. Does the email system encrypt the contents of a mailbox when displaying it to the owner. gownfawr addresses (1) well. Gmail does encrypt via default ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


8

Here is an example of a PHP mail-generating script that is vulnerable to a CRLF-injection attack. In essence, the problematic code was: $email=$_POST['email']; $headers="From: {$email}\r\nReply-To: {$email}"; //create headers mail('opps@example.com',$subject,$content,$headers); //mails it In that case, a poorly designed PHP API was difficult to use ...


7

You can't be sure that SSL will be used all the way, because there's no specification requiring that. When the email was designed, long time ago, no one bothered about encrypting the connection between the sender and the receiver, including any point that transmitted the email. So, to comply with email specifications, no one needs to encrypt it using SSL, ...


7

I'd say that looks like a brute force attack - they are likely trying to gain access to your mail server to send out spam, or using SMTP as a general avenue of attack on your server.


7

To answer your question: If you're using SSL/TLS to access your e-mails, regardless of whether it's POP or IMAP then it would be very difficult for anyone to decipher the text of the e-mails from analysing the traffic alone. That said some large companies e.g a law firm I used to work for have a server which sat between us and the internet, stripping out ...


6

The SMTP servers may (probably will) still transfer the email as plain text. Sometimes SSL is used, but you cannot count on this being the case unless you specifically know the configuration of the specific servers on both ends. This means that in your scenario, an adversary capable of monitoring Internet backbone traffic could intercept the email. ...


6

I've seen colleges do this as well. It is generally an attempt to stop botnet zombies from generating SPAM messages as a massive amount of spam comes from zombie computers on residential IPs. Also, many legit mail servers either provide a secondary port or a secure port that you can connect to depending on the mail provider. I don't really think the ...


5

Unless it is encrypted before going to the server, there isn't much point in encrypting it on the server. If the server is going to do bad things, it can just not encrypt it. Additionally, decryption on the other end would have to be done on the server, so the recipient server could also leak it. The connection in between servers can be secure if TLS ...


5

SNI is Server Name Indication; it is not part of any verification. A client uses SNI to inform the server about the name that the client is trying to reach; the name is sent in the early steps of the SSL handshake. This is meant to support multiple servers (that is, multiple names) sharing the same IP address: the SNI tells the server which certificate it ...


5

Suppose I'm retrieving messages - my client app passes my username and password to the POP server, which authenticates me, and sends back the messages. If I'm not using SSL/TLS, then the entire conversation, including the message and credentials, is in plaintext. Not necessarily. SMTP, POP, and IMAP all can support multiple authentication ...


5

Firstly, you're confusing SSL/TLS and its implementations. Your server might use OpenSSL, but that doesn't mean the clients that connect to it will. Potential vulnerabilities depend very much on the context. If you're worried about OpenSSL-specific zero-day vulnerabilities, you might be able to find a mail server that uses another stack. In addition, ...


5

Though OpenSSL has some quality issues, it would be quite optimistic to believe that the rest of the software that you expose to the Internet fares better. OpenSSL is one of the most attacked pieces of software because it is a high-value target: The same library is used in many servers of many types (HTTPS, SMTP, IMAP,...) so any vulnerability has a wide ...


4

The bad idea is not the use of NTLM, but the lack of use of SSL. Without SSL, data travels unprotected, and, in particular, active attackers may hijack the connection (for instance right after the authentication was performed). No amount of NTLM will fix that. To use SSL with STMP, there are two ways: Run the whole SMTP transaction in a SSL server. The ...


4

A simple thought-experiment can answer this for you. Imagine that I run my own mail server for my domain and I don't implement SSL on it. No matter what protocol you use to talk to your mail server, it will have to use plain SMTP to talk to mine. Since there exists a case where it is impossible for the next hop to use SSL, your suspicions are confirmed. ...


4

Yes, it can be read or altered if TLS is not used either between the sender and their mail server, or between the mail servers involved in handling the message, then anyone who is able to see the traffic between them can read or even alter the message in the clear. They would need to have control of a system along the routing of the traffic so it isn't ...


4

To me, that's the primary benefit of SPF, not a drawback. What's happening is that you've prevented CNN (and spammers) from spoofing your email servers. That's a terrible practice that they're engaged in, and I'm sure they're doing it primarily to harvest email addresses for their own uses, marketing or otherwise. If your users are complaining that ...


4

You've hit the nail on the head - at the very least, provide the full headers from one of the spam emails. However, I find it most useful when I get a sample of several of the spam emails (say, 3-10, if you have that many) because that allows me to see if the spammers are employing other methods, like changing the message content, subject, or format. It's ...


4

While there is absolutely no semblance of security built-in to SMTP, open relays are a known, and solved problem. To prevent relaying, you simply set up a list on the server of valid destination domains (typically only domains for which local delivery is an option). Then unless the sender is authenticated or otherwise allowed to relay mail, then the server ...


4

Laziness mostly. Ease of configuration, it's easier for administrators to setup a central SMTP server which doesn't require authentication to send email, than one that does. You will often see that this is also offered by ISPs to accomodate their clients more easily.



Only top voted, non community-wiki answers of a minimum length are eligible