Intro to Phishing and Emails

What is the primary route of compromise?

Phishing

Composition of an email address

Mailbox @ Domain

What are the email protocols?

SMTP (Simple Mail Transfer Protocol)

POP3 (Post Office Protocol 3)

IMAP (Internet Mail Access Protocol)

What port is SMTP on?

TCP 25

How does SMTP work?

Email sent to sender org’s SMTP server

SMTP server sends email to next server

Eventually reaches recipient org’s SMTP server

What is the new standard port moving to for SMTP and why?

TCP 587
25 is often attacked and has no authentication

What is POP3?

Applicaiton layer internet standard protocol

Used by email clients to retrieve email from a mail serverH

How does POP3 work?

Contacts email server and downloads all emails from it

Emails are deleted from server

Only the computer that downloaded the email can access them now

What is IMAP?

Allows you to access emails from anywhere on any device

Reads it from the email server

More common than POP

Entire email sending process

Email written in email client

Email sent to org’s outbound SMTP server

SMTP server asks DNS server the IP of the domain name

Email is sent through internet possibly passing through other SMTP servers

Email arrives at destination domain’s outbound SMTP server

Email is moved to a different server using POP3 or IMAP

Recipient can access email using a device

The org SMTP server refers to a server hosted by the domain e.g. gmail, yahoo, or company specific e.g. amazoncustomerservice, lloydsfinancedep

What is webmail?

Allows users to access emails with an internet conneciton and web browser

Difference between webmail and email clients

Email clients download and store emails locally allowing full offline access, webmail requires internet

What is an email header?

Lines containing info about the message’s transportation e.g. sender/recipient addresses and timestamps from each server the email is passed along to on its journey

What is an email message made up of?

Header fields - describing From, To, Date

Email body

What are other optional header fields?

Received - Intermediary servers and date processed

Reply-To - reply address

Subject

Message ID

message body

What are custom X headers

Personalised headers such as for spam detection boolean or for debugging