Email security and secure messaging Flashcards
What does MUA stand for?
Message User Agent
A mail client application that grants users access to a mail server in order to create, send, receive email messages
E.g.: Outlook, Gmail
What does MSA stand for?
Message Submission Agent
Software agens that receive email messages from a MUA and cooperates with a MTA for delivery of the mail
What does MTA stand for?
Mail Transfer Agent
Transfers email messages from one computer to another using the Simple Mail Transfer Protocol
What does SMTP stand for?
Simple Mail Transfer Protocol
Communication protocol used for sending and receiving emails over the internet
What does IMAP stand for?
Internet Message Access Protocol
Internet standard protocol used by email clients to retrieve email messages from a mail server over a TCP/IP connection
What does POP stand for?
Post Office Protocol
Together with IMAP, one of the most common protocols for email retrieval
Describe the Email architecture
MUA connects client to mail system
SMTP is used to send mail to MSA
Message handling system (MHS) transfer message from MSA to MS via one or more MTAs
POP or IMAP is used to retrieve mail from message store (MS)
What is webmail?
Browser interface to an online email client
SMTP ans POP/IMAP are still used to send and receive email
What security does/may email content require?
Confidentiality or Authentication
What are some security threats against email?
Availability of email service
Metadata in header information is a source of attacker information
Email content confidentiality/authentication
What is spam?
Unsolicited email
What is a common vector for phishing attacks?
Spam mail
What are some counter measure against spam/phishing?
Email filtering
What types of phishing attacks are harder to filter?
Spear phishing: Phishing with more accurate targeting
What type of security is provided between agents in a mail system?
Link-to-link basis: Using protocols such as STARTTLS and DKIM
What type of security is provided between clients in a mail system?
end-to-end basis: using protocols such as PGP and S/MIME
What is StartTLS?
Runs over TLS
Extensions to SMTP, POP and IMAP
Provides link-to-link security
Opportunistic use of TLS security (encryption) - use it if possible
What attack is StartTLS vulnerable to?
STRIPTLS attacks: attacker interrupts TLS negotiation and connection falls back to plaintext transmission
What is DKIM?
DomainKeys Identified Mail
Allows sending mail domain to sign outgoing mail using RSA signatures
Receiving domain can verify origin of mail
Public verification key of sending domain is retrieved using DNS
What does DKIM help reduce?
Email spoofing, and hence reduce spam and phishing
What is email spoofing?
A threat involving sending emails with a fake/forged sender address. Can be done by an attacker that changes the metadata of an email.
What does ‘d=’ and ‘s=’ do in the DKIM signature?
Specify domain and selector
Example:
d=easychair.org
s=default
Where is the relevant public key for a DKIM signature?
In the DNS record for the host defined by the name:
[selector]._domainkey.[domain]
’s=’ : Gives the selector
‘d=’ : Gives the domain
What does nslookup do?
Command to query internet domain name servers for information about hosts or domains.
