Chapter 16 E-mail and Instant Messaging

Emails depend on 3 protocols

SMTP, POP3, IMAP

Simple Mail Transfer Protocol (SMTP)

Mail is sent to a server and from server to server. Defaults to TCP port 25

POP3

Client computer may connect to a server and download new messages.

IMAP

Uses TCP port 143 and similar to POP3

Works in greater synchronization. Allow client to retrieve information from server

STARTTLS

A command (not an acronym) used to upgrade an unencrypted connection to an encrypted connection on the same port.

Which Email ports must be open?

25, 110, 143

Mail User Agent (MUA)

A messaging component used as a stand-alone application by the user.

Mail Transfer Agent (MTA)

An e-mail server.

Mail Delivery Agent (MDA)

The service that downloads e-mail from a mail transfer agent.

Email Structure

Two elements: Header and Body

Entire message sent via plain ASCII text
Attachments use Base64 encoding

Multipurpose Internet Mail Extensions (MIME)

Specification for sending files as attachments to e-mail.

Email Hoax

An email message that is trying to tempt you to give out personal information or trying to scam you.

Blacklisting

Noting which domains/systems are known to send spam and reject messages from those addresses.

SPAM defense

Trusted Servers

White listing.

Trusted domains and systems

SPAM defense

Delay-based filtering

Insert a deliberate pause between the connection and the banner. Any system that sends data during pause is usually malicious (usually because spam is sent constantly).

SPAM defense

PTR and reverse DNS checks

Conducts reverse DNS check to determine origin address. Make sure it is a real one.

SPAM defense

Egress filtering

filter packets going from the network to the outside

Mail Relay

A device in which email is stored and forwarded from, and sends the email to its final destination

Open Relay

a mail server that will accept mail from anyone

Greylisting

Emails are bounced as temporary rejection because spam will not resend

Real-time Blackhole List (RBL)

system that uses DNS information to
detect and dump spam e-mails.

Sender Policy Framework (SPF)

An e-mail validation system designed to prevent e-mail spam by detecting e-mail spoofing, a common vulnerability, by verifying sender IP addresses.

Sender ID Framework (SIDF)

Attempts to authenticate messages by checking the sender's domain name against a list of IP addresses authorized to send email by the domain name listed

DomainKeys Identified Mail (DKIM)

Email validation system employed to detect email spoofing

S/MIME

Secure/Multipurpose Internet Mail Extensions

Developed by RSA and uses X.509 format

Why is both symmetric and asymmetric encryption used in email?

To increase speed of encryption and decryption

Pretty Good Privacy (PGP)

A method of encrypting and decrypting e-mail messages. It can also be used to encrypt a digital signature.