Skip to Main Content
Hacking: The Next Generation
book

Hacking: The Next Generation

by Nitesh Dhanjani, Billy Rios, Brett Hardin
August 2009
Beginner content levelBeginner
298 pages
9h 5m
English
O'Reilly Media, Inc.
Content preview from Hacking: The Next Generation

Abusing SMTP

Simple Mail Transfer Protocol (SMTP) was first defined in RFC 821 (in August 1982). This protocol provides no encryption or authenticity on its own. This is the primary protocol used to send email, so it is quite obvious why the data transmitted over this protocol would be of interest to an attacker.

SMTP is a clear-text protocol. That means email messages are just as susceptible to being sniffed as Telnet and FTP packets. Since email tends to be sent unencrypted, SMTP provides attackers with a simple way to gather juicy information. Think about some of the data an attacker can capture just by capturing email traffic: passwords, personally identifiable information (PII), business-critical data, and confidential data that an organization may deem as intellectual property.

In addition to the clear-text nature of SMTP, emails inherently do not have any authentication mechanism. In other words, the protocol does not provide a secure way of authenticating whether a received email is indeed from the listed sender. Along with email not being encrypted, when a user constructs an email to a colleague and clicks Send, that message is sent across the network without any type of authenticity. There is no way to verify that the name on the email matches the actual person who sent it. In the following sections, we will discuss an example of how attackers may exploit this situation, as well as take a quick look at how easy it is to sniff SMTP data on a given network.

Snooping Emails ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Building a Modern Security Program

Building a Modern Security Program

Zane Lackey, Rebecca Huehls
Network Security Hacks

Network Security Hacks

Andrew Lockhart
Ransomware

Ransomware

Allan Liska, Timothy Gallo

Publisher Resources

ISBN: 9780596806309Errata Page