Recently, we began implementing some 3rd party email proxy services that allow control filters for in and out bound emails. This is for compliance reasons.
Anyway, this got me thinking. Could it be possible that hackers and others could setup a type of transparent proxy that intercepts and copies all email if they managed to gain control of email servers or in some cases office365 where you can secretly change where email is sent going outbound?
Yes.
This isn’t anything new though.
E-Mails may get forwarded several times between MTAs, whereas every MTA can (and must) see (at least) the headers of the message.
That is one of the reasons for deploying (and using) end to end encryption: end to end encrypted email bodies cannot be read in transit by forwarding MTAs.
The padlock that google shows only indicates that the transit between the last MTA outside of google and google has been encrypted; this does not mean however that the transit MTAs not read (and possibly even modify) the email.
You can witness this behavior with several free web mail providers who append an advertising signature to emails even if they are sent via a mail client. That is possible because the MTA has access to the whole of the message when processing it. A malicious MTA in this chain (you might call it a proxy from a functional point of view if it is the first hop of outbound and last hop of inbound mails) can easily copy all emails.
That being said, one would have to have control over an MTA within the delivery chain of all emails, but there are several ways how to do that.
Also: there is no way to tell wether an email has been copied in-transit while being processed by an MTA, other than the other answer is suggesting.
Not a direct answer, but: Gmail will tell you whether or not an email arrived via a secure link with a small lock icon. That tells you if there's end-to-end encryption, although it depends on the recipient to actually verify that.
Keep in mind that to set up a proxy like you describe, the attackers would likely need to change the DNS for the site (so when somebody sends to [email protected], the MX record for mycompany.com goes to the attacker). That'd be pretty obvious, most likely.
I don't know if Office365 has other mechanisms for installing a proxy, but I'd be interested in learning more if there are. :)
From this Q/A we can deduce that when e-mails are being looked at by a legitimate service there can be subtle differences that could theoretically be picked up on to find out if a tool is monitoring SMPT traffic, using this we could monitor the connection periodically with a tool like netcat and see if there is any difference in the responses.
However, this would only work if the attacker is using something they made to intercept the e-mails, which could be possible, but why do that when you can read them from the server and send them using your own rougue SMTP server, ssh, or tcp.
