Email, now, is one of the most important 2
online services that we use. 3
For most people 4
it can be a single point of security failure, 5
because many of our accounts are linked to it. 6
If you have a email compromise, 7
your associated accounts are also compromised. 8
Private information will be compromised, 9
including your name, address, contacts, 10
friends and anything else 11
that’s associated or stored within your email. 12
It’s obvious to most people 13
why email security is important, 14
but email unfortunately is fundamentally broken, 15
as far as security is concerned, 16
and it cannot be fixed. 17
All we can do is keep putting sticky plasters on it. 18
Plasters which, unless everyone else adopts, 19
which is pretty much the same as 20
changing email completely, 21
we’re just not going to fix 22
these security problems that are inherent in email. 23
Email is from a time when security wasn't thought of. 24
But we continue to use email 25
because it is ubiquitous, 26
everybody has an email address now. 27
If everyone suddenly switched 28
to a secure messaging alternative tomorrow, 29
the problem would be solved. 30
But because that’s not going to happen, 31
we are stuck with a broken 32
messaging system called email. 33
This means you will need to convince others 34
to adopt encryption technology 35
if you want to communicate with them privately. 36
You can't do it on your own. 37
Let's take it from the beginning. 38
So there are two ways to access email. 39
First, you’ve got your web browser 40
using functionality like HTML5 and JavaScript. 41
And probably most people now think of that as email, 42
that is the most common way 43
that people tend to access email, 44
you know, via Gmail or Yahoo Mail. 45
But the second way that is used is an email client, 46
which is something like Thunderbird, or Claws, or Outlook, 47
people might use commonly at work. 48
You have Mac Mail, 49
or you have the mail apps 50
that you get on your cell and mobile phones. 51
Those are all email clients. 52
And most email providers will allow you 53
to use both methods, the webmail access 54
and the email client. 55
With webmail, you access via HTTPS, port 443, 56
which is running SSL and TLS encryption, 57
or at least you should be, 58
that is the standard solution for most people. 59
If you’re not, then it’s extremely insecure, 60
but really, almost all webmail will be encrypted 61
using HTTPS, port 443, SSL/TLS. 62
You authenticate that server, 63
that the server is genuine 64
via a certificate as is normal with HTTPS, 65
and the client is authenticated usually with a password. 66
And if you can, 67
you should change your authentication method 68
to be Two Factor Authentication, 69
as this mitigates password attacks 70
as we’ve discussed in the Password section. 71
You should find an email provider 72
that offers Two Factor Authentication. 73
If you only use webmail, 74
then emails are only stored on the server. 75
And then we have the email client. 76
With an email client, there are a number of protocols 77
and port options for both sending and receiving email. 78
So the options when it comes to receiving mail, 79
is you have IMAP port 143, which is unencrypted, 80
you have POP port 110, which is unencrypted; 81
you don't want to use these. 82
If you care anything about your email security, 83
receiving emails, then you don't want to use these, 84
and most providers now either don't provide them, 85
or provide encrypted alternatives. 86
And those alternatives are IMAP port 993, 87
which is running SSL/TLS encryption 88
with the certificate based server-side authentication, 89
like with a website, 90
and you have POP 3 on port 995, 91
running the same SSL/TLS encryption 92
with, again, certificate based server-side authentication. 93
And those are the two that 94
you want to go after for receiving email. 95
IMAP port 993 and POP 3 port 995. 96
Now, some email providers 97
may put those on different ports, 98
but those are the de facto port numbers. 99
But what is important, is that 100
they are both running SSL and TLS. 101
Now, when it comes to the difference 102
between IMAP and POP, 103
of the two, IMAP is the popular option 104
when you need to check your emails 105
from multiple devices, such as a laptop, 106
phone, tablet and so on, 107
because the emails are synced using IMAP 108
with the server and all devices. 109
All devices retain copies 110
with the server having the master copy. 111
This is the most convenient 112
and what most people will be used to using. 113
POP3, alternatively, downloads emails 114
from the server to a single email client, 115
then deletes the emails from the server. 116
Because your messages get downloaded 117
to a single email client, 118
and then deleted from the server, 119
it can appear that the mail is missing, 120
or disappeared from your inbox 121
if you try to check your mail 122
from a different email client or webmail. 123
But you may want this for security though, 124
to have no emails stored on the server. 125
If you’re worried about people accessing the server, 126
use POP3. 127
If you’re worried about people accessing your laptop, 128
store on the server and the client with IMAP. 129
Then we have the protocols 130
for sending emails with an email client. 131
We have SMTP port 25, 132
which is the original unencrypted port to use; 133
you don't want to use this if you care about 134
your emails and sending your emails and privacy. 135
Then you have something called STARTTLS, 136
which is usually on port 587. 137
And that is for using SSL/TLS encryption. 138
And then you have SMTP port 465, 139
which again is SSL/TLS encrypted. 140
You want to use, when it’s possible, 141
SMPT port 465 with the SSL/TLS. 142
STARTTLS on 587 is more susceptible 143
to man-in-the middle attacks. 144
So go with the SMTP port 465, SSL/TLS option. 145
For both email clients and webmail, 146
the SSL/TLS will use a cipher suite, obviously. 147
You want this to be a good one. 148
Ideally, using Elliptical Curve Diffie-Hellman, 149
so the session keys are ephemeral, 150
so that if the private key is compromised, 151
only small amounts of data is compromised. 152
The section on Encryption covers this. 153
If you remember, back to when we looked at Cipher Suites, 154
we used a tool called SSL Labs, which is here. 155
This doesn't scan SMTP or IMAP SSL 156
mail ports unfortunately, but you can use it 157
for checking port 443 for webmail. 158
So for example here, I could check “ghostmail”, 159
and see how their SSL/TLS stacks up. 160
And here we go, A+. 161
Now see, elliptical curve, RSA_WITH_AES, 162
so yeah, they seem to be doing all the right things there. 163
And, if you want to examine the other ports like 465, 587, 164
you’ve got a few options for how you can do that. 165
One with Kali, is you have SSLscan, 166
and if you press Return here, 167
that's just going to simply do port 443. 168
But if you want to do a special port, 169
you would do 465, 170
so then you could look at the SMTP over TLS/SSL. 171
Just press return here. 172
And look at there; 173
because ghostmail only has a webmail interface, 174
but if they did have port 465 open, 175
you could check that out. 176
So here we see what we saw 177
with SSL Labs, the same Cipher Suites. 178
Another way of checking out the mail servers 179
which I like is these guys here. 180
So if we put in an email address 181
of someone that you know, and we click Try, 182
or if you put in even a dummy email address, 183
if you put test@ghostmail, or gmail, 184
or what have you, click Try, 185
it communicates with the mail servers. 186
It finds out 187
who the mail server is for that domain, 188
because it isn't always ghostmail.com, or that domain. 189
So we can see here, 190
we have the mail server there, that is taken 191
from what’s called the MX record for that domain, 192
MX is the mail record, or mail exchange record. 193
And what we can see here 194
is the communication with the mail server, 195
you can see there, this is using STARTTLS, 196
and there we can see the Cipher Suite that it uses. 197
And what you’re actually seeing here is text, 198
ASCII communication with that port. 199
So these commands are actually being put 200
into the package stream for that port. 201
But I can show you an example of that. 202
So let's check out maybe Gmail. 203
So first of all, we need to figure out 204
what the mail server address is, 205
so we need to use something called “NSLOOKUP”. 206
Says is doing a DNS lookup 207
to check the mail exchange record, 208
which will give us 209
the IP address of the mail server for gmail.com. 210
And there we go, 211
and we can see actually they’ve got 212
quite a few which is no surprise. 213
So to issue text-based SMTP commands, 214
we need to use some sort of tool that allows us to do that, 215
we can use Telnet, we can use Netcat. 216
Netcat is a tool that enables you to read and write 217
to network connections using TCP and UDP. 218
So if I go – 219
So as you can see, 220
I can just issue standard text commands. 221
But that is what this is doing, 222
so I must try that command. 223
25. Paste. There we go. 224
So we see we get the same response. 225
It’s given us some options, 226
therefore what we want to do. 227
So STARTTLS, etc. 228
So, let’s escape out of there. 229
But yeah, essentially 230
if we issue the same commands here, 231
we are going to get the same sort of response. 232
Now, moving on to Authentication. 233
For Authentication, as I’ve said, 234
certificates are used to verify the server, 235
“is who they claim to be?” 236
The email client will use his own certificate repository 237
or that of the operating system, 238
just the same as a browser does 239
to validate that the server is who the server is. 240
So that’s the same as HTTPS, 241
browsing, server authentication, you know, it’s the same thing. 242
And we can, of course, 243
look at the certificates that are on there, 244
and this is a useful site to do that. 245
So if we click on “More Detail” here, 246
let's have a look down. 247
And there we go, 248
we can see the first certificate in the chain. 249
There’s the public key. 250
And the certificate itself, 251
and then the second certificate in the chain, 252
we can see all the way down as to 253
where the root certificate is. 254
Client-side authentication. 255
So depending on the mail client, 256
you will have different options for authentication, 257
so those include things like 258
transmitting the password unencrypted, 259
which was what was originally done. 260
And then you’ve got transmitting the password encrypted, 261
because you’re using SSL or TLS. 262
You can do things like Kerberos or GSSAPI, 263
which is something generally used 264
for enterprise solutions. 265
You’ve got NTLM, 266
which is a Microsoft solution 267
if you’re connecting to exchange servers. 268
You could use TLS/SSL 269
or some type of certificate 270
for your client authentication. 271
There’s something called OAuth2 272
that you can use; but generally, 273
you want to try and use 274
some form of strong authentication 275
or two-factor authentication if you can, 276
and we covered two-factor authentication in its own section.