Lesson 16-E-mail

1. Lesson 16-E-mail

2. Background • E-mail is the most popular application on the Internet and the intranet. • Twelve million e-mails were sent each day in 2001, and a rough total of 4.38 billion e-mails were sent in the year. • In 2000, there were 569 million e-mail boxes in the world.

3. Objectives • Upon completion of this lesson, the learner will be able to: • List various security issues associated with e-mail. • Describe some of the security practices for e-mail. • List and describe software used to improve e-mail confidentiality.

4. Security of E-Mail Transmissions • Users should secure e-mails as they send and receive the messages. • Security administrators can provide users the tools to fight security problems. • Server-based and desktop-based virus protection help block malicious code, while spam filters help block unsolicitedcommercial e-mail.

5. Malicious Code • Viruses spread faster by e-mail. • Modern viruses evolved from the ones that were scripted to send themselves to other users. • This type of virus is known as a worm. • A worm uses its code to automate the infection process.

6. Malicious Code Transmission • The method of transmission requires users to execute the worm. • Mail worms use multiple methods of attack, which include: • Sending multiple infected e-mails. • Scanning hosts on the Internet, looking for a specific vulnerability. • Finding the vulnerability and infecting the target. • Viruses and worms endanger individual systems and network security since they introduce malicious traffic to other machines. • This causes a loss of data and potentially discloses private data.

7. Trojan Horse • A Trojan horse is a program that seems to be one thing while actually having a hidden purpose. • They may do what they claim, but they also install some other program that allows an attacker to control an infected machine remotely. • Once control is achieved, the attacker can use the machine to perform any number of tasks.

8. Trojan Horse • The distribution of malicious code in e-mail is tied to the files that are attached to the e-mail messages. • Earlier, users had to execute attached files. • However, the advent of HTTP has changed this.

9. Malicious Code – HTML • Hypertext Markup Language (HTML) allows plain text to represent complex page designs. • It was adopted by e-mail programs so users could use different fonts, colors, and pictures in their e-mails.

10. Malicious Code – HTML • Some e-mail programs have a preview pane that enables users to read e-mails without opening them in full screen. • This preview activates all the content in the e-mail message.

11. Malicious Code – HTML • Users need not run the program or open the e-mail to activate the worm—they just need to view the e-mail in the preview pane.

12. Malicious Code – HTML • Viruses are a security threat. • One of the most common transfer methods is through e-mail. • This threat can be reduced by educating the users and scanning for viruses.

13. Malicious Code – HTML • Most users are aware of viruses and the damage they cause. • They need to be briefed about specific activities when the virus comes through e-mail.

14. Malicious Code – Good Practice • Some good practices are: • Examine all e-mails for a known source and destination, especially if the e-mails have attachments. • Check strange files or unexpected attachments. • Know that viruses may be executed by opening the e-mail or viewing it in the preview pane. • Education and proper administration is also useful in configuring the e-mail software to be as virus-resistant as possible.

15. Malicious Code – Good Practice • Some good practices are (continued): • Have a well thought out virus-scanning procedure • Perform virus scanning on every e-mail as it enters the organization’s server. Some users attempt to retrieve e-mail from their normal off-site ISP account. This may bypass the server-based virus protection.

16. Malicious Code – Good Practice • Every system should be protected with host-based virus protection programs. • These programs scan all files on a regular basis and perform checks on files upon execution.

17. Hoax E-Mails • E-mail hoaxes are a nuisance. • They cost everyone not only in the time wasted by receiving and reading the e-mail, but also in the Internet bandwidth and the server processing time.

18. Hoax E-Mails • An e-mail hoax is a global urban legend traveling from one e-mail account to the next. • Most have a common theme of some story that must be told right away or some virus that everyone should beware.

19. Unsolicited Commercial E-Mail (Spam) • Spam is the common term for unsolicited commercial e-mail. • The term comes from a skit on Monty Python's Flying Circus where two people are in a restaurant that only serves spam. • The key to spam is the concept of repetition of unwanted things.

20. Unsolicited Commercial E-Mail (Spam) • The appeal of spam is the extremely low cost per advertising impression. • Senders can send their messages for less than a cent apiece. • This is less expensive than traditional direct mail or print advertisements. • The low cost ensures the continued growth of spam e-mail unless something is done.

21. Unsolicited Commercial E-Mail (Spam) • The amount of spam is large enough to trigger state and federal legislators to consider action. • No effective laws have been passed and this has forced most people to seek technical solutions to the spam problem. • One way to fight spam is to be cautious about where to post e-mail addresses. • Users cannot keep e-mail addresses secret just to avoid spam. • One of the steps many system administrators of Internet e-mail servers have taken to reduce spam is to shut down mail relaying.

22. Unsolicited Commercial E-Mail (Spam) • It is not possible to close all mail relays. • Spammers will mail from their own mail servers. • Software must be used at the recipient's end to combat spam.

23. Unsolicited Commercial E-Mail (Spam) • Spam can be filtered at the host level with pattern matching, focusing on the sender, the subject, or the text of the e-mail. • Spam can also be filtered at the server level by using pattern matching, but some mail software also use the Realtime Blackhole List. This list is maintained for blocking spam mail.

24. Unsolicited Commercial E-Mail (Spam) • Other methods • There are commercial packages that block spam at the server level using both the methods by maintaining their own blacklists and pattern-matching algorithms.

25. Mail Encryption • E-mail has always been a plaintext protocol. • E-mail is sent with the clear text of the message exposed to anyone who is sniffing the network. • Any attacker at a choke point in the network could read all e-mails passing through that network segment.

26. Mail Encryption • E-mails must be encrypted to solve problems associated when sending them. • They can be encrypted using: • S/MIME • PGP

27. S/MIME • S/MIME (Secure/Multipurpose Internet Mail Extensions) is a secure implementation of the MIME protocol specification. • S/MIME was developed by RSA Data Security. It uses the X.509 format for certificates. • The original e-mail RFC specified text e-mail, so any non-text data had to be handled by a new specification—MIME, which handles audio files, images, applications, and multipart e-mails. • This allows e-mails to handle multiple types of content, including file transfers.

28. S/MIME • The specification supports 40-bit RC2 and 3DES for symmetric encryption. • The protocol can encode the message in one of the two ways: • The host mail program can encode the message with S/MIME. • The server can act as the processing agent, encrypting all messages between hosts.

29. S/MIME • The host-based operation starts when the user clicks Send. The mail agent encodes the message using the generated symmetric key. • Then, the symmetric key is encoded with the remote user's public key or the local user's private key. This enables the remote user to decode the symmetric key and then decrypt the actual content of the message. • All this is handled by the user's mail program. • If the message is signed by the sender, it will be signed with the sender's public key, guaranteeing the source of the message.

30. S/MIME • Symmetric and asymmetric encryption are used in e-mails to increase the speed of encryption and decryption. • As encryption is based on difficult mathematical problems, it takes time to encrypt and decrypt. • To expedite this, asymmetric encryption is used to encrypt only a relatively small amount of data, the symmetric key. • The symmetric key is then used to encrypt the rest of the message.

31. S/MIME • The S/MIME process of encrypting e-mails provides integrity, privacy, and authentication if the message is signed. • Some of the problems with its implementation are: • S/MIME allows the user to select low strength (40-bit) encryption. The user can send a message that is thought to be secure but that can be more easily decoded than messages sent with 3DES encryption. • There may be flaws in software.

32. S/MIME in Outlook • Different settings can be used to encrypt messages and use X.509 digital certificates. • This allows interoperability with web certificates.

33. S/MIME in Outlook Express • In Outlook Express, the window is more simple. • The same functions of key management and secure e-mail operation are available.

34. PGP • Pretty Good Privacy (PGP) implements e-mail security in a similar way to S/MIME using different protocols.

35. PGP • The user sends the e-mail, and the mail agent applies encryption as specified in the mail program. • The content is encrypted with the generated symmetric key. That key is encrypted with the public key of the recipient of the e-mail, or with the private key of the sender. • Senders can also sign the mail with their private key, allowing the recipient to authenticate the sender.

36. PGP • PGP supports Public Key Infrastructure (PKI) provided by multiple vendors, including X.509 certificates and LDAP key sources such as Microsoft's Active Directory, and Novell's NDS. • PGP generates its own keys using Diffie-Hellman or RSA. It transmits the public keys to the PGP LDAP server.

37. PGP • For the encryption of the e-mail content, PGP supports IDEA, 3DES, and CAST for symmetric encryption. • PGP provides security against brute-force attacks by using: • A 3DES key length of 168 bits. • An IDEA key length of 128 bits. • A CAST key length of 128 bits.

38. Decoding PGP - Eudora • This shows the string of encrypted text that makes up the MIME attachment. • This text includes the encrypted content of the message and the encrypted symmetric key.

39. Decoding PGP - Eudora • The program does not decrypt the message upon receipt. It waits until instructed to do so. • PGP stores encrypted messages in the encrypted format, as S/MIME. • It provides end-to-end security for the message.

40. Mail Encryption • Like S/MIME, the PGP protocol is not problem-free. • There is a lot of discussion about the way PGP handles key recovery, or key escrow. • PGP uses Additional Decryption Key (ADK), which is an additional public key stacked upon the original public key.

41. Mail Encryption • This gives an organization a private key that would be used to retrieve secret messages. • In practice, the ADK is not controlled by a properly authorized organization. • The danger exists for someone to add an ADK and then distribute it to the world.