Hacking: The Next Generation

Abusing SMTP

Simple Mail Transfer Protocol (SMTP) was first defined in RFC 821 (in August 1982). This protocol provides no encryption or authenticity on its own. This is the primary protocol used to send email, so it is quite obvious why the data transmitted over this protocol would be of interest to an attacker.

SMTP is a clear-text protocol. That means email messages are just as susceptible to being sniffed as Telnet and FTP packets. Since email tends to be sent unencrypted, SMTP provides attackers with a simple way to gather juicy information. Think about some of the data an attacker can capture just by capturing email traffic: passwords, personally identifiable information (PII), business-critical data, and confidential data that an organization may deem as intellectual property.

In addition to the clear-text nature of SMTP, emails inherently do not have any authentication mechanism. In other words, the protocol does not provide a secure way of authenticating whether a received email is indeed from the listed sender. Along with email not being encrypted, when a user constructs an email to a colleague and clicks Send, that message is sent across the network without any type of authenticity. There is no way to verify that the name on the email matches the actual person who sent it. In the following sections, we will discuss an example of how attackers may exploit this situation, as well as take a quick look at how easy it is to sniff SMTP data on a given network.

Snooping Emails ...