Email Security

1. Email Security Jonathan Calazan December 12, 2005

2. Threats to Email • Message interception • Emails sent in clear text over the Internet. • Message modification • Anyone with system admin rights on the mail servers your message visits can not only read your message, but also delete or change the message before it reaches its destination (and the recipient won’t be able to tell if the message has been modified). • False messages • It is very easy to create an email with someone else’s name and address. SMTP servers don’t check for sender authenticity.

3. Threats to Email • Message Replay • Messages can be saved, modified, and re-sent later. • Repudiation • You can’t prove that someone sent you a message since email messages can be forged.

4. Solutions • First, let’s review the requirements for secure email. • Sender authenticity • Nonrepudiation • Message integrity • Message confidentiality

5. Solutions • What do we need to meet these requirements? • Digital Signatures • Solves integrity, authenticity, and nonrepudiation problems. • Encryption • Solves confidentiality problem.

6. Secure E-Mail Systems • Both of these systems provide encryption and digital signatures for security. • Secure Multipurpose Internet Mail Extensions (S/MIME) • Pretty Good Privacy (PGP)

7. S/MIME • Developed by RSA Data Security, Inc. • The Internet standard for secure e-mail attachments. • Integrated into many commercial email clients, such as Microsoft Outlook, Netscape Communicator, and Lotus Notes (making it likely to dominate the secure e-mail market). • Encourages users to obtain a Digital Certificate from a reliable Certification Authority (CA) (you can get a free one from here: http://www.thawte.com/).

8. S/MIME • S/MIME-aware email clients automatically detect the presence of the signature if the certificate was validated by a well-known CA.

9. PGP • Invented by Phil Zimmerman in 1991. • Originally free, became a commercial product after being bought by Network Associates in 1996 (freeware version is still available here: http://www.pgpi.org/); • Available as a plug-in for popular email clients. Can also be used as a stand-alone software. • There is no centralized authority.

10. PGP • Addresses the key distribution problem with a trust model called “web of trust.” • Users create their own self-signed certificates, which can be later signed by others. • Users interpret trust level for themselves.

11. Problems with Secure Email • Many people don’t use it because: • They don’t know how. • Difficulties of obtaining a Digital Certificate. • S/MIME and PGP schemes do not protect the sender against a recipient claiming not to have received the message. • It is still possible to create fake certificates (Class-1 and Class-2 certificates which can be obtained online) if you know enough information about a person. • Key availability and migration

12. Other Useful Links • Trace the source of the emails (using the email header). • http://www.theinquirer.net/email_tracker.htm • Check to see if the sender is a known spammer. • http://www.senderbase.org/

13. Sources • http://luxsci.com/extranet/articles/email-security.html • http://www.tim-richardson.net/misc/security.html • http://www.aamc.org/members/gir/audioconferenceseries/gregackerman110403.pdf • http://www.lasa.org.uk/knowledgebase/pages/Netadvicesecurity.shtml • http://www.antiphishing.org/smim-dig-sig.htm