0

My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails from my Android phone.

Bounced spam messages started flooding my mailbox few days after I had arrived there. Our company's email server implements SSL on IMAP and TLS on SMTP, and has a valid certificate issued by CA.

Can one theoretically steal credentials having full control over their network? Man in the middle attack with unlimited freedom - change DNS records, etc? My question is that even if he could change DNS entry for our mail server, and provide IP of his server - how could he then substitute the certificate which is valid for our server name? Can one find CA who can issued the certificate without proper checking if server is indeed owned by the customer? Or can he somehow replace the symbolic name of my server mail.example.com with his server mail.intruder.com and get certificate for mail.intruder.com?

I can hardly see how this can be done with DNS, otherwise all passwords in the world would be stolen. But maybe I'm missing something, like scenarios involving STARTTLS. My phone is configured to not accept non-trusted certificates.

Improve this question
2
  • 1
    Without going into the security aspects..... Bounced spam doesn't always mean anything was sent from your mail account
    – Drifter104
    Jul 18, 2018 at 13:50
  • Is your whole question based on the fact that you received "bounced spam messages" or is there more to it?
    – schroeder ♦
    Jul 18, 2018 at 15:25

2 Answers 2

Reset to default
1

First, the bounced spam messages you see can happen no matter if your credentials where stolen. Sender spoofing is actually very common when sending spam. It is similar to writing a different address than yours as sender on the envelope of a snail mail - everybody can do this easily.

As for the possibility of stealing your credentials: this depends on your specific configuration. If IMAP or SMTP are configured to not enforce TLS but to use TLS only when available (i.e. optional, not mandatory) the attacker could mount a man in the middle attack (ARP spoofing, DNS spoofing etc) and claim to be a mail server which does not support TLS. If your mail client only uses TLS optionally it will continue with the connection and login without TLS, thus presenting the credentials to the attacker.

If instead both IMAP and SMTP in your client are setup for mandatory TLS with full validation of the certificate and rejection if the certificate cannot be fully trusted, then a man in the middle attack is not possible without making changes to your system, provided that the attacker did not get access to the original certificate and key of the server or managed to get a valid certificate from a trusted CA (both unlikely).

Improve this answer
3
  • Yeah, it was my fault - for the reason I cannot remember I have configured the client to accept all certificates
    – DimaA6_ABC
    Jul 18, 2018 at 15:39
  • @DimaA6_ABC I still doubt that it was sent trough your account. Spammers don't care, because it's cheaper to send from their regular spam accounts and botnets. Doing a small scale operation like that simply doesn't fit with the extremely low cost required for spam to be profitable.
    – vidarlo
    Jul 18, 2018 at 15:54
  • Well, spam flood happened 2 gears ago, and today I received blackmail asking for quite some money otherwise they would send out an embarrasing video to my contacts they have alledgedly stolen. That's why I started remembering what has happened that time, and finally found accept all certificates option. Maybe those cyber criminals count not only on spam but on such blackmails as we, then it would justify the cost of this personalized attack. Again they might be using ready software which makes fake dns entry pointing to a single smtp server upon detecting email activity in controlled network.
    – DimaA6_ABC
    Jul 18, 2018 at 16:51
0

Ok, mystery is resolved. My old phone was configured to accept all certificates for ssl/tls. Maybe older androids in addition could switch to non-tls if server said it is not capable of it.

I'm pretty sure password was stolen, because our admin reviewed log of smtp server and confirmed different ips were authenticating with my credentials. But those guys have put quite an effort into that, not sure if that was worth it. Maybe they used some packaged hacker's software, I don't believe somebody would be hacking my creds on adhoc basis. Maybe it was widely known vulnerability.

Improve this answer
1
  • 1
    You should now check that this email doesn't open more access. Can you tell any other account "I lost my password" and have a reset form (or directly a password...) sent to this email address? etc.
    – A.B
    Jul 18, 2018 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .