How viable is MITM interception of email, really?

Question

In the press, I often read of the potential for state actors to intercept and record email via man-in-the-middle attacks. For example, the large data storage facility in Utah being built by the NSA right now is alleged to be stored "the complete contents of private emails" right in the wikipedia article (as linked).

However, I am wondering how true this really is. As I understand most email servers these days use SSL or TSL to send all their traffic encrypted, so if, say, Verizon or Comcast users are having their emails being transported routinely by SSL/TSL, how could the NSA be getting the clear text? It sounds kind of unbelievable or exaggerated to me. Sure, if somebody sends the email via telnet it can be recorded, but most emails are sent secured.

In fact, last year at SIGCOMM researchers presented a paper examining this exact question (see Durumeric, Adrian, et al, SIGCOMM 2015) and they report that in excess of 80% of email traffic is routinely sent via TSL or other secure protocol.

So, is the whole email surveillance thing exaggerated or is it for real?

Answer 1

Even if you have 100% use of TLS there are still enough opportunities to get the mail. Apart from infecting sender or recipient directly to get the plain mail on the ends of the delivery there are enough ways on the way of the email to sniff or even modify it:

• SMTP is a hop by hop protocol and even if every mail server involved uses TLS only the connection between the servers is encrypted but not the mail itself. This means that on every server involved in the delivery the mail is available as clear text. Thus compromising any of the servers in the path of delivery can provide access to these mails. And of course the provider of the server could have been ordered by law to provide access to the server.
• The next hop of delivery is determined by the MX settings in DNS. Thus DNS spoofing or compromise of the DNS server can change the path of the mail to pass a server controlled by the attacker.
• A man in the middle between two mail servers could simply do a TLS man in the middle attack. Most mail servers accept any certificate, i.e. don't require proper certificate validation. Even if the server requires a valid certificate the man in the middle could simply deny support of TLS by stripping the STARTTLS from the list of supported extensions asked with EHLO. This is for example done by some CISCO devices and even some ISP do it. This way the sending mail server will continue with a plain connection assuming that the receiving server does not support TLS.
• Finally the mail is stored at the receiving mail server so that the recipient can access it. The mail provider might be ordered to provide access to the mail by law and since the mail itself is not encrypted (only the transport) the access is possible. Same law-requested access could be done at the senders site.

This together means that you cannot trust the delivery. Instead end-to-end encryption should be used in the form of PGP or S/MIME. With this the servers in between get the meta data (i.e. which parties communicate) but cannot get to the content.

So, is the whole email surveillance thing exaggerated or is it for real?

In most cases it is impossible for sender and recipient to notice if a mail got sniffed or modified. Thus it is impossible to come up with a number of how high the risk is but enough opportunities for interception are definitely there.

Answer 2

There's a difference between confidentiality and authenticity. Opportunistic TLS provides confidentiality against a passive MITM attack, but the NSA will create fake certificates. So let's say there's a TLS connection from mail.verizon.com to mail.comcast.com. Unless there's a certificate that asserts mail.comcast.com is run by Comcast, and unless mail.verizon checks that certificate was issued by a certificate authority it trusts, then the NSA could create a certificate for mail.comcast, intercept the connection, and everything would look ok to the mail servers.

So the answer is, it's completely viable, and it's not exaggerated.

See How to detect the NSA MITM attack on SSL?

Answer 3

There are different ways that an email can be read by an unauthorized party. (I define "unauthorized party to mean both the sender and recipient did not give permission for their email to be read).

Here are some in their order of likelihood (IMHO):

1. The email is not encrypted and the traffic is sniffed somewhere along the path.
2. The email is encrypted/decrypted by the servers with false certificates provided by a MITM.
3. The email is encrypted/decrypted by the servers and at least one of the servers gives secret access to an unauthorized party.
4. The email is encrypted and someone sniffing the wire can decrypt it with brute force or some sort of backdoor mechanism.

The NSA could easily do #1, and could attempt to do #4 (and probably fail). I don't personally believe the NSA would do #2 or #3 because it's too easy to get caught.

If you are paranoid, you could generate your own key pairs and use client side encryption (meaning you and the person you are communicating with share your public keys with each other and encrypt end-to-end). I don't see how any third party could decrypt end-to-end encryption unless they use method #4, which is extremely unlikely given a sufficiently strong bit strength key.