2

Do you have any links to stories from a reputable source about any malware that harvests plaintext passwords from emails?

I do tech support and every once in a while one of my clients will send me some password in plaintext via email. I want to write an educative response to use in such cases but I need it to be based on clear, easy to grasp evidence.

I thought that finding references about malware that harvests plaintext passwords from your emails would be easy, but 30 minutes later and I still haven't found even one example of a malware that does this.

  • Well, if you can't find examples of it happening, maybe malware stealing passwords from e-mail is not a common problem? Try explaining your customers that e-mail passes through various systems (ISP, government, etc) and all of those can read the contents of the e-mail. So they should never include any sensitive information in email. – Securist Oct 25 '18 at 12:33
  • @Securist there are lots of examples. Simple scripts (or the search bar) are used, so there is not going to be named, packaged toolsets to do it (except the one in my answer below) – schroeder Oct 25 '18 at 13:30
  • Requests for tools are off-topic, but the requests for examples of methods are on-topic. – schroeder Oct 26 '18 at 12:20
4

The problem for you finding an example is that it is not going to be malware. Malware will help gain access to emails, but once you gain access, you just need a simple script to look for keywords. Or, the search function of the email client.

So, you will end up with tools (not malware) like this:

https://github.com/dafthack/MailSniper

0

Providing passwords in plaintext is the foul itself.

This is why the only time you're supposed to be entering them in plaintext, they're almost always masked with '****' or '••••'. And then when they're stored, they're almost always stored as a hash or encrypted so that if someone gains access to the database, they simply can't read the plaintext values.

You could also explain that emails are inherently unencrypted so anyone intercepting the email will be able to see the password. There are ways to encrypt email (x509 certs, etc.) but this is more the exception rather than the rule.

Significant steps are taken by legitimate software to try and prevent the plaintext exposure of passwords. The point is, you don't need malware on a system for plaintext passwords sent via email to be a huge foul.

  • 2
    The OP wants to devise a clear, non-technical explanation of why it is a foul. Explaining server-side password storage is not "easy-to-grasp" (even for a lot of programmers). That fact that it is stored on every email server in the chain is a nice example, though. – schroeder Oct 25 '18 at 15:07
  • My point was that what he asked for was irrelevant to the problem. The fact that there are keyloggers, screen scrapers, or file parsers that specifically look for ascii strings that might be plaintext passwords is not the problem. Those tools simply represent the exploitation of the problem that people leave 'secrets' open and in non-secret form. If you need to explain in layman's terms, that might be an option. Providing a link to a program that purports to do something without understanding how it works is like buying snake-oil because the salesmen claims it cures all ailments. – thepip3r Oct 25 '18 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.