What do you send in your emails? Pictures from your last trip or recipes for your kids? Business reports for your supervisor? Or maybe something even more confidential like login details or social security numbers? We’re not here to judge. But whatever you include in your emails, you definitely don’t want anyone but the receiver to see. Luckily for all of us, nearly all email clients take care of encrypting our emails so you don’t have to worry about things like secure SMTP or SSL/TLS. But if you want to make a more mindful decision or you’re just setting up your own client, it’s good to know what really happens under the hood. Let’s see!
What’s SMTP? Is it secure?
Simple Mail Transfer Protocol is the technology used by the vast majority of email clients to move messages between servers, on the way to the end-users. In simple words – it’s what gets your emails to the recipient within seconds, even if they’re currently chilling in the 142 bus at Stampede Trail in Alaska (LTE coverage might be a factor, though).
Think of SMTP as a digital postman that first, picks up your package (email) and takes it from your email client to the server, aptly named SMTP server (as it’s used solely for sending out messages). Another postman then picks up the package and takes it all the way to the recipient’s server where it’s picked up and stored for milliseconds at the recipient’s POP3/IMAP server. When all the pleasantries are exchanged, the incoming mail is then delivered to the recipient, without the involvement of SMTP anymore but with separate IMAP/POP3 protocols.
As you can see, SMTP takes care of a significant portion of each outgoing transmission. Given the importance and omnipresence of this protocol, you would think it’s heavily encrypted and secured with top-notch technologies from the secret Google or Yahoo! labs. Well, none of that. The standard SMTP protocol comes with no security features, making it really vulnerable to hijacking and other forms of attacks. It’s like our postman boarded a public intercity bus, dropped a bag with mail on one of the seats and got off right away. Will it arrive intact to a receiver? Possibly. Will it be easy to check what’s being sent or, well, play with it a bit to your or recipient’s disadvantage? Likely too.
What are the threats to SMTP security?
There’s a number of things to be aware of when transmitting even a small amount of emails. Here are the most commonly occurring ones:
Unauthorized access to your emails and data leakage
Cybercriminals might try to get access to your SMTP server that all the outgoing mail goes through. This is done by breaking your authentication procedures with more or less sophisticated methods. When in, unwanted visitors can access your emails and use them to their advantage, by for example leaking your users’ data or stealing confidential information you were sending to coworkers.
Spam and Phishing
When fraudsters are able to access your SMTP server, they’re also likely to use it to send unauthorized messages to both your contacts and external accounts (this is known as using your server as an Open Relay). This is done to send spam which, when sent from your legitimate and (likely) well-known domain, might be quite successful. Or, even worse, your server can be used to send malicious emails, for example requesting your users share their login credentials or credit card numbers.
Malware
Attackers commonly use the vulnerabilities of SMTP to spread malicious software to the recipients of your email but also in your own infrastructure. These can be viruses, Trojan horses or any other types of worms that are then used to obstruct operations, gain access to servers, change privileges and access secure data. If not fought with sufficient force, malware might continue spreading, infecting more and more servers and users.
DoS attacks
If all of the above didn’t seem serious, cybercriminals can also use your SMTP server to perform a Denial-of-Service (DoS) attacks. This basically means flooding other servers with a huge amount of emails to affect their performance or even cause a crash. DoS can also be used to flood an inbox to hide any warning messages about security breaches to a server. Whatever a DoS attack’s purpose, it’s never good.
These are only some of the examples. But is there a way to secure our connection and avoid such a fate?
To dive deeper into the topic of SMTP vulnerability, check out the article on Mailtrap Blog, where we also cover different methods to enhance security.