A Study of SMTP [in]Security

Presented at ToorCamp 2014, July 10, 2014, 11:30 a.m. (20 minutes).

The Simple Mail Transfer Protocol (SMTP) and related Extended SMTP (ESMTP) are the primary means of delivering email messages between servers over the internet today. Internet traffic can easily be collected by third-parties, yet encryption of SMTP messages is not universal, and in fact cannot be required by a Mail Exchange (MX) server. This means that it is possible for an inter-domain email to be transferred and/or stored as plain-text at at least one point on its path across the internet. This paper provides an analysis of current email providers and their support for TLS encryption over SMTP. We show that while a majority of SMTP servers do provide support for TLS, almost half of all email users use a provider that does not support TLS encryption according to the standard ESMTP protocol. We further show that of those email providers that ostensibly support TLS, a number of them are configured such that their true security is suspect (e.g. invalid certificates, weak ciphers). Our aim is to raise awareness of the vulnerabilities present in the current SMTP environment on the internet.


Presenters:

  • Ian Foster / lanrat as Ian Foster
    Ian is currently pursuing a Masters in Computer Science and security researcher at the University of California, San Diego. He is currently working on identifying problems with online communications in an effort to fix them. Ian has also been helping with ToorCon/ToorCamp since 2010.
  • Jon Larson
    Jon recently graduated from University of California, San Diego with a degree in Computer Science. His primary interests include computer networking, network security, and distributed systems. He will soon begin working at Amazon on the AWS Network Infrastructure group.

Similar Presentations: