Email - Attacks and weaknesses

Widespread use and weak security protocols make email a popular target for cyberattacks time and again. According to Statista, victims of digital attacks via mails lost approximately 580 million US dollars in 2019 alone (Statista 🔗). Here we present the most well-known cyber attack methods on emails and how you can protect yourself

Sniffing and eavesdropping

Sniffing is a method by which connections are intercepted and read. Data packets sent over an open network are routed through several intermediate systems, for example routers, switches or hubs, during transport from the sender to the recipient. During this transmission via intermediate systems, specific gaps are exploited to intercept and analyse messages with the aim of obtaining and collecting confidential information. Especially in public networks, it is particularly easy to eavesdrop because data can be sent in the so-called broadcast mode and thus received by all computers within range. Programs used for eavesdropping are called sniffers.

Attack points of this method are mainly based on the email protocols SMTP and POP3/IMAP. Today, protocol commands and contents are still sent in plain text, i.e. unencrypted. The attacker can then read both email content and login data and possibly gain full access to an email account.

Protecting yourself is very easy as many modern email providers support transport encryption (TLS/SSL) for their email connections. When retrieving and sending mails (especially in the web browser) HTTPS should be used. The “S” at the end stands for “Secure” connection via SSL encryption. Modern browsers, Firefox and Chrome, quickly display this in the address bar next to the URL. Email providers that allow HTTP access are not trustworthy. Another very effective protective measure is to configure encryption in the email programme itself so that all emails only leave the user client in encrypted form, making it very difficult to read them.

Email Spoofing

Spoofing is the sending of mails under faked sender addresses. In many cases, these mails are recognised as spam mails by the email server if they contain known malware patterns. Often, these spoofing mails contain malware that is used to send further spoofed mails, for example to contacts in the malware victim’s address book. The basic problem of this attack method is that the identity of the sender is not effectively checked on email servers and the mail recipient has no reliable way of checking the correctness of the sender’s address. The SMTP protocol allows a chosen display name to be specified for the sender. A malicious sender chooses a trusted name for the victim as the display name, while actually hiding the correct ‘angreifer@example.com’ sender address. Sending is often done via Open Relay servers that allow sending (actually forwarding) emails with any sender address without identity verification; this is usually caused by a faulty server configuration. Attackers also use similar domain names that are easy to confuse with a trusted domain, for example @uni-potsdarn.de instead of @uni-potsdam.de.

This is also the first starting point for recipients to protect themselves: sufficient verification of the sender or the sender’s address by the recipient himself or by the receiving mail server. Accepting emails from a domain exclusively from trustworthy mail servers, i.e. no open relay servers, or using alternative protocols to SMTP (e.g. SPF and DKIM) can ensure corresponding email accounts. The safest way is to use digital signatures, because only the legitimate sender can generate a suitable signature.

Phising

The original meaning of phising was “password fishing” and it describes the fraudulent obtaining of trust from the victim in order to elicit a desired response. Well-known pishing mails are, for example, “the Nigerian prince who has to move gold abroad” or “the bank executive who has to hide money”. The typical procedure is to send fraudulent mails with trustworthy sender addresses, such as banks, companies or authorities. The sender’s address is chosen to match the reaction that is to be tricked. As explained in “Spoofing”, sender addresses can easily be forged and faked. The victim’s trust is then used to elicit a desired reaction, such as the surrender of data (passwords, access data,…), the installation of malware and much more. Since “normal” pishing is often no longer very effective, many attackers switch to personalised “spear pishing”. In this case, the attacker collects detailed information about the victim, for example in social networks, which helps him to feign trustworthiness. The victim is supposed to think that an email comes from the fake sender because the message contains information that only the sender knows. The chances of success with this scam are very high.

With this attack vector, too, sufficient verification of the sender is the first step in recognising fraud and the safest way is to use a digital signature.