2

My school supplies an email address for its students. To connect to their email server, no authentication is needed for the outgoing mail server. So no user name, or password is needed and no SSL/TLS is used (and it's port 25). However incoming email uses SSL and requires authentication.

I am not very knowledgeable about email security. What practice risks does this present to a user? I am guessing it makes it easy for anyone to forge an email address. But does it make it easy for a message to be intercepted and red by a third party? I know it can be used for spam relay, though I'm more concerned about how a legitimate user can be compromised.

If relevant I wouldn't be connecting to the email from the campus internet.

  • 1
    "However incoming email uses SSL and requires authentication." - do you really mean that somebody sending mail to you from outside has to authorize against the SMTP server (highly unlikely, because which credentials should be used for authentication?) or that you have to authorize against a POP or IMAP server in order to retrieve any mail somebody has sent to you (common practice)? – Steffen Ullrich Jan 29 '17 at 14:26
  • 1
    @SteffenUllrich I don't know, all I know is when I configure an email client for the outgoing mail server (SMTP) it needs to have the user name and password blank. Does that answer your question? – Celeritas Jan 29 '17 at 14:42
  • 1
    No, it does not since my question was not about outgoing mail but about your claim that "incoming email uses SSL and requires authentication". If you can explain how you come to this claim then maybe you have answered my question. – Steffen Ullrich Jan 29 '17 at 14:45
  • 1
    @SteffenUllrich when configuring the mail client, for the incoming server the username and password are specified (and an SSL connection is used). In outgoing server settings, no username or password is used and the connection is not encrypted. My question is, what practical affects does this have? – Celeritas Jan 29 '17 at 14:58
1

That is the way the SMTP protocol goes... The authentication required by some SMTP servers is only used to prevent unauthorized people to use those server resources to send mail. In any case neither the From: header, nor the Reply to: one use the authenticated used name, but are prepared by the client application. Only webmail servers use the name used for authentication to fill the From: header.

Said differently, once you have a validated account on a server accepting the SMTP protocol, you can configure your mailer (Thunderbird, WindowsMail, etc.) to use almost any forged From: address. Some carefully configured servers will require that you use a domain they own, but the part of the address before the @ is never controlled (*).

So you should never trust the From addressed unless the mail is digitally signed. And the configuration of your school is acceptable on a security point of view. Anyway, if someone uses the mail server to send a forged offensive mail, the server normally keeps in its log the IP address used to send the mail. On a LAN, it is normally enough to find who is responsible for it with the help on login logs...

In the opposite, reading mail always require authentication, because a mail belongs to its recipient.


(*) some corporate servers do use corporate directories to control that the From address is valid for the authenticated user, but that is an advanced security practice.

0

if your school owns a wireless lan or you can gain a machine with linux and root permissions within the lan, then it is possible to sniff network traffic or play man-in-the-middle.

The other question, belonging authentication, this attack is called email spoofing. As long as you don't have to login with any credentials to the network, everybody is anonymous. I have seen networks, which used the wlan-credentials for SMTP-authentication. If the attack is possible, you can even send mails as a teacher... DON'T TRY

0

Based on your comments you describe the following case:

  • the user can send mail without authentication and without TLS
  • the user needs to authenticate against a POP/IMAP server for reading mail. Note that your description of "However incoming email uses SSL and requires authentication." suggests that outside users need to authorize to send mail but based on your comments it is actually the reading of the mail in your mail client.

The setup you have here is actually not uncommon but the security impact depends on details of the implementation which you don't show:

  • It is normal that users need to authenticate to read the mail because otherwise the mail server would not know which user it is and could not provide the mail for the user. Using TLS when authentication is used is also normal in order to protect the password when authenticating.
  • It is also common in trusted setups like companies that most traffic inside the local network is not encrypted because this network is trusted. How much this trust is justified in your specific case is unknown. In the worst case somebody else might sniff or even modify the traffic to the SMTP server. But if this is the case you probably also have lots of other problems because the ability to sniff and modify is not restricted to SMTP only but affects all of the many protocols in the network which don't use encryption (i.e. plain HTTP, file transfer, network shares).
  • Since no authentication is done for sending email it is probably be possible to spoof the sender. This spoofing is typically restricted to different email addresses inside the same domain. And a network administrator can probably detect this spoofing because he has the IP address of the senders device and can associate this with a specific user account. Thus any attempts for malicious spoofing can usually easily be traced back to the malicious user.
  • I'm very unknowledgeable with email security, but I was curious about this as when I set up the account on my android phone, I got a big warning message about it being unsafe. – Celeritas Jan 30 '17 at 0:18
  • @Celeritas: Like I said: how unsafe this is depends on the security of the network you use. This security is unknown and so I can only make assumptions about the typical use case of such a setup. – Steffen Ullrich Jan 30 '17 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.