My email password has been stolen most probably while I was on vacation in another country and was using hotel's (and maybe others, cannot remember) WiFi networks to read and optionally send emails from my Android phone.
Bounced spam messages started flooding my mailbox few days after I had arrived there. Our company's email server implements SSL on IMAP and TLS on SMTP, and has a valid certificate issued by CA.
Can one theoretically steal credentials having full control over their network? Man in the middle attack with unlimited freedom - change DNS records, etc? My question is that even if he could change DNS entry for our mail server, and provide IP of his server - how could he then substitute the certificate which is valid for our server name? Can one find CA who can issued the certificate without proper checking if server is indeed owned by the customer? Or can he somehow replace the symbolic name of my server
mail.example.com with his server
mail.intruder.com and get certificate for
I can hardly see how this can be done with DNS, otherwise all passwords in the world would be stolen. But maybe I'm missing something, like scenarios involving STARTTLS. My phone is configured to not accept non-trusted certificates.