DOCSLIB.ORG

HACKING EMAIL Lesson 9: Hacking Email

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
HACKING EMAIL Lesson 9: Hacking Email LESSON 9: HACKING EMAIL Lesson 9: Hacking Email WARNING The Hacker Highschool Project is a learning tool and as with any learning tool there are dangers. Some lessons if abused may result in physical injury. Some additional dangers may also exist where there is not enough research on possible effects of emanations from particular technologies. Students using these lessons should be supervised yet encouraged to learn, try, and do. However ISECOM cannot accept responsibility for how any information herein is abused. The following lessons and workbooks are open and publicly available under the following terms and conditions of ISECOM: All works in the Hacker Highschool Project are provided for non-commercial use with elementary school students, junior high school students, and high school students whether in a public institution, private institution, or a part of home-schooling. These materials may not be reproduced for sale in any form. The provision of any class, course, training, or camp with these materials for which a fee is charged is expressly forbidden without a license including college classes, university classes, trade-school classes, summer or computer camps, and similar. To purchase a license, visit the LICENSE section of the HHS web page at http://www.hackerhighschool.org/licensing.html. The HHS Project is an open community effort and if you find value in this project we ask that you support us through the purchase of a license, a donation, or sponsorship. 2 Lesson 9: Hacking Email Table of Contents WARNING....................................................................................................................................................2 Contributors................................................................................................................................................4 Introduction................................................................................................................................................5 Overall: How Email Works.........................................................................................................................6 Feed Your Head: Email Headers.............................................................................................................9 Dig Me.......................................................................................................................................................12 Game On: The Bug Trap.........................................................................................................................14 The Risky Business of Email Composition..............................................................................................17 Receiving Email........................................................................................................................................18 Responding to Email...............................................................................................................................19 Cryptography Protecting Contents From Disclosure.........................................................................20 PGP and GPG......................................................................................................................................21 MIME Your Manners............................................................................................................................21 Key Trust................................................................................................................................................22 Sending An Encrypted Email Using GPG.........................................................................................22 Receiving An Encrypted Email Using GPG......................................................................................22 GPG Implications................................................................................................................................22 Email Server-Side Vulnerabilities and Threats......................................................................................24 Bandwidth Eating................................................................................................................................24 Email Server Vulnerabilities.................................................................................................................25 Email Server Threats............................................................................................................................25 Email for Fun and Profit...........................................................................................................................25 The Key to Success..............................................................................................................................26 Email Client-Side Vulnerabilities and Threats..................................................................................27 Turn On The Lights................................................................................................................................27 Malware, Trojans, And Rootkits, Oh My...........................................................................................28 This Email Looks Legitimate, Let's Open It Up..................................................................................28 Exciting Tricks With Email Systems (Hacking the Postman)................................................................29 SEAK And Ye Shall Find.......................................................................................................................29 Spoofing Versus Malware...................................................................................................................30 Stupid Email Tricks................................................................................................................................31 Outsmarting The Email Bots (Email Obfuscation) ..........................................................................31 Conclusion................................................................................................................................................33 The Ultimate Disclaimer..........................................................................................................................34 3 Lesson 9: Hacking Email Contributors Pete Herzog, ISECOM Bob Monroe, ISECOM Greg Playle, ISECOM Marco Ivaldi, ISECOM Simone Onofri, ISECOM Peter Houppermans Andrea Zwirner 4 Lesson 9: Hacking Email Introduction Email has been around for a long time; like longer than those socks stuffed under your bed. It predates the Internet (not your dirty socks), and is one of the first forms of electronic information exchange. Before email, we had smoke signals, half-naked guys running as messengers, bricks with notes attached, Morse code, large rocks slung over castle walls with curse words written on them, and a variety of other analog communication methods like the telephone and paper “snail mail” (not really delivered by snails). Many of these original message transmission required special tools, training, or lots of rocks. Luckily, enterprising authors created text that could be written on stone tablets or bound in books and thrown at people or read by them. One of the first books was Smoke Signals for Dummies. Email is based on simple store and forward principles. It can be relatively easy to use (unless you are in a huge hurry), very robust and so cheap that it is often abused for commercial and criminal purposes. Its asynchronous design allows communication to take place without the need for sender and receiver to both be online at the same time. Kind of like when your mother is talking to you and you're not paying attention until she asks you a question. You are not there for the transmission but you better be a quick deceiver. Um, receiver. A quick receiver. In this lesson, we will focus on modern Internet email and hacking or security issues you can use for fun and profit. 5 Lesson 9: Hacking Email Overall: How Email Works First, we are going to pretend that you are an email. You will follow the transmission and receipt of yourself as an email, and we will identify the various components that move you along. 1. Email (you) is (are) created either using an email client such as Outlook, Mail, Eudora, Pegasus or Thunderbird, or on a web service like Yahoo Mail, using a web interface. It's almost funny how much email mimics “snail mail,” because your message is enclosed in an envelope, like in Figure 9.1. Figure 9.1: Email message, headers and envelope 2. You are sent to a mail server called a Mail Transmission Agent (MTA), which queues you for transmission. Modern mail systems do this typically via encrypted SMTP (Simple Mail Transport Protocol) since they require authentication to prevent abuse, and encryption protects credentials from disclosure, along with the email contents. MTAs accepting email (you) without some sort of authentication are called “open relays” and tend to be abused by senders of junk mail, also known as UCE (Unsolicited Commercial Email) or spam. 3. For each address (“recipient”) in the message, the MTA first checks if a recipient is local (right on the same computer). If not, the MTA uses a so-called MX record (explained 6 Lesson 9: Hacking Email below) to find the server for the relevant domain. If there is no valid receiving host found, a failure message for that specific address is sent back to the sender. 4. The
Load more

Recommended publications
  • Today's Fraud Threats: Hackers, Rings, and Mobs
    Reducing Risks; What you need to know about Payment Fraud Wells Fargo Customer Training © 2016 Wells Fargo Bank, N.A. All rights reserved. For public use. Agenda . Fraud trends . Online account takeover fraud . Impostor fraud . Call to action 1 Remain vigilant in payment fraud 72% 42% 48% of organizations of them report of organizations were experienced that the number exposed to wire attempted or actual of fraud incidents fraud– a significant payments fraud increased increase from the previous survey Source: 2016 AFP Payments Fraud and Control Survey 2 Online account takeover fraud What is account takeover fraud? 3 Social engineering strategies Classic phishing Email messages sent to large populations designed to obtain confidential information Emails purport to be from trustworthy sources with which victims have established relationships Vishing and smishing Spear-phishing Vishing is where fraudsters Targeted phishing attack connect with their victims via directed at a small group phone of potential victims Smishing is when a fraudulent Emails are focused, have a text message is sent to the high degree of believability victim and a high open rate 4 Phishing successes explained Cybercriminal excellence Social media explosion Accurate logos, professionally Users are sharing an alarmingly written communications, amount of information through personalization of content increase social media platforms believability Provides criminals with the fodder Targets are more likely to click on necessary to construct the links and/or open attachments, personalized and believable which download malware messages Credulous users Users are the first line of defense, yet organizations do not have robust training programs to heighten users’ sensitivity to phishing attempts Bottom Line: Phishing attempts are becoming more challenging and more difficult to address 5 1 in 244 Email malware rate Source: Symantec Internet Security Threat Report, Volume 20, April 2015 Malware improvements Malware has evolved to where it can now: .
    [Show full text]
  • Financial Fraud and Internet Banking: Threats and Countermeasures
    Report Financial Fraud and Internet Banking: Threats and Countermeasures By François Paget, McAfee® Avert® Labs Report Financial Fraud and Internet Banking: Threats and Countermeasures Table of Contents Some Figures 3 U.S. Federal Trade Commission Statistics 3 CyberSource 4 Internet Crime Complaint Center 4 In Europe 5 The Many Faces of Fraud 6 Small- and large-scale identity theft 7 Carding and skimming 8 Phishing and pharming 8 Crimeware 9 Money laundering 10 Mules 10 Virtual casinos 11 Pump and dump 12 Nigerian advance fee fraud (419 fraud) 12 Auctions 14 Online shopping 16 Anonymous payment methods 17 Protective Measures 18 Scoring 18 Europay, MasterCard, and Visa (EMV) standard 18 PCI-DSS 19 Secure Sockets Layer (SSL) and Transport Secured Layer (TLS) protocols 19 SSL extended validation 20 3-D Secure technology 21 Strong authentication and one-time password devices 22 Knowledge-based authentication 23 Email authentication 23 Conclusion 24 About McAfee, Inc. 26 Report Financial Fraud and Internet Banking: Threats and Countermeasures Financial fraud has many faces. Whether it involves swindling, debit or credit card fraud, real estate fraud, drug trafficking, identity theft, deceptive telemarketing, or money laundering, the goal of cybercriminals is to make as much money as possible within a short time and to do so inconspicuously. This paper will introduce you to an array of threats facing banks and their customers. It includes some statistics and descriptions of solutions that should give readers—whether they are responsible for security in a financial organization or a customer—an overview of the current situation. Some Figures U.S.
    [Show full text]
  • Gmail Hacker for Mac Free
    1 / 2 Gmail Hacker For Mac Free 11 сент. 2015 г. — First of all, personal email services weren't free if you wanted any ... Here are 10 apps that provide the best Gmail hacks on the list .... A powered-off MacBook can be compromised in less than three minutes. ... How To 10/03/2012 2:22 pm : Hack WiFi Passwords for Free Wireless Internet on Your .... 21 авг. 2020 г. — Gmail Hacker Keygen & Serial Key Full Free Download ... Secure hacking for passwords; IP and MAC Address hidden at all times .... A Simple Hack to Avail Free VPN Accounts . We try to all time … Read More online vpn hotspot ofvh. You use your Google account for Gmail, but you also might us.. For best result repeat the scan more than once, especially If your internet connection so slow *** If your internet connection so slow , feel that someone .... 8 мар. 2021 г. — Hack Gmail Account Free Mac. Hack Gmail Account 2020 – Today on SocialPositives.com, we are looking at Gmail Password Hack techniques 2018.. 12 февр. 2020 г. — Gmail Password Hacker has been rated 4.7/5 by 1991 votes! What is Gmail Password Hacker Gmail Password Hacker is a FREE account password ... Hack other players' devices and defend yours to build a reputation in the hacking world. Spyzie will allow you to hack the Gmail account password quickly. Free .... ... 2021 · Email Hacker is a free email hacking tool capable of hacking email ... of WhatsApp) Method 4: How to Hack WhatsApp via Spoofing the MAC Address.. Hack Gmail Password For Free Mac | Peatix.
    [Show full text]
  • Efail: Breaking S/MIME and Openpgp Email Encryption Using Exfiltration Channels
    Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels Damian Poddebniak and Christian Dresen, Münster University of Applied Sciences; Jens Müller, Ruhr University Bochum; Fabian Ising and Sebastian Schinzel, Münster University of Applied Sciences; Simon Friedberger, NXP Semiconductors, Belgium; Juraj Somorovsky and Jörg Schwenk, Ruhr University Bochum https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak This paper is included in the Proceedings of the 27th USENIX Security Symposium. August 15–17, 2018 • Baltimore, MD, USA ISBN 978-1-939133-04-5 Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX. Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels Damian Poddebniak1, Christian Dresen1, Jens Muller¨ 2, Fabian Ising1, Sebastian Schinzel1, Simon Friedberger3, Juraj Somorovsky2, and Jorg¨ Schwenk2 1Munster¨ University of Applied Sciences 2Ruhr University Bochum 3NXP Semiconductors, Belgium Abstract is designed to protect user data in such scenarios. With end-to-end encryption, the email infrastructure becomes OpenPGP and S/MIME are the two prime standards merely a transportation service for opaque email data and for providing end-to-end security for emails. We de- no compromise – aside from the endpoints of sender or scribe novel attacks built upon a technique we call mal- receiver – should affect the security of an end-to-end en- leability gadgets to reveal the plaintext of encrypted crypted email. emails. We use CBC/CFB gadgets to inject malicious plaintext snippets into encrypted emails. These snippets S/MIME and OpenPGP. The two most prominent stan- abuse existing and standard conforming backchannels to dards offering end-to-end encryption for email, S/MIME exfiltrate the full plaintext after decryption.
    [Show full text]
  • Handbook on Cyber, Information, Intelligence and Personal Security Threats from Foreign Authoritarian Regimes, Domestic Oppression, and Harassment
    OPERATIONAL SECURITY AND PERSONAL RESILIENCE: AN OVERVIEW OF THE EASTERN NEIGHBORHOOD OPERATIONAL SECURITY AND PERSONAL RESILIENCE: AN OVERVIEW OF THE EASTERN NEIGHBORHOOD Handbook on Cyber, Information, Intelligence and Personal Security Threats from Foreign Authoritarian Regimes, Domestic Oppression, and Harassment Author Georgia: Media Development Foundation – Mariam Pataridze, Sopho Gelava, Tinatin Gogoladze Moldova: IPIS - Institute for Strategic Initiatives – Victoria Olari Ukraine: Ukraine Crisis Media Center – Liubov Tsybulska, Oleksandra Tsekhanovska Operational Security Recommendations: European Values Center for Security Policy team Editor Andrea Michalcová, European Values Center for Security Policy This report was created with the financial support of European Commission. European Commission assumes no responsibility for facts or opinions expressed in this publication or any subsequent use of the information contained therein. Sole responsibility lies on the author of the publication. Image Copyright: Page 7: Juan Antonio Segal / Flickr, Page 11: Veaceslav Bunescu / Flickr HANDBOOK ON CYBER, INFORMATION, INTELLIGENCE AND PERSONAL SECURITY THREATS 1. INTRODUCTION This report follows a year of cooperation between civil society organizations (CSO) and think-tanks from Central Europe and the Eastern Neighborhood (EN). It is one part of the Project on Enhancing and Sharing Lessons Learnt in Resilience and Self-Protection, which evaluates the capability of civil society in Georgia, Ukraine, and Moldova to use guidance from the European Values Center for Security Policy (EVC) in operational security and exposing illegitimate methods of influence. Here, we adapt their approach and apply it to the political realities in the EN. The authors conducted thorough desk research of relevant open source information, public surveys, and investigative reports. The desk research was conducted by structured interviews with relevant experts and local officials.
    [Show full text]
  • Stronger NYC Communities Organizational Digital Security Guide
    Stronger NYC Communities Organizational Digital Security Guide For Trainers and Participants Build Power - not Paranoia! NYC Stronger Communities | Toolkit 1 Creative Commons Attribution-ShareAlike 4.0 International, July 2018 This work supported by Mozilla Foundation, the NYC Mayor’s Office of Immigrant Affairs, NYC Mayor’s Office of the CTO, and Research Action Design. CREDITS Project designed and lead by Sarah Aoun and Bex Hong Hurwitz. Curriculum lead writing by Rory Allen. Workshops, activities, and worksheets were developed by Nasma Ahmed, Rory Allen, Sarah Aoun, Rebecca Chowdhury, Hadassah Damien, Harlo Holmes, Bex Hong Hurwitz, David Huerta, Palika Makam (WITNESS), Kyla Massey, Sonya Reynolds, and Xtian Rodriguez. This Guide was arranged and edited by Hadassah Damien, and designed by Fridah Oyaro, Summer 2018. More at: https://strongercommunities.info NYC Stronger Communities | Toolkit 2 Table of Contents ORGANIZATIONAL DIGITAL SECURITY GUIDE This guide provides tools and ideas to help organizational digital security workshop leaders approach the work including a full facilitator’s guide with agendas and activities; for learners find a participant guide with homework, exercises, and a resource section. 01 03 INTRODUCTION ............................................ 4 PARTICIPANT WORKBOOK ........................................ 110 • Organizational Digital Security Right Now Introduction to the Stronger Communities • Roadmap Workshop series Self-assessment: Digital • Workshop Overview Security Bingo • Series Story • How to coordinate and plan a Stronger Workshop Participant Guides Communities workshop series • Design and facilitation tools 1. Stronger NYC Communities Workshop: • Evaluate and assess Our work is political. • Handout and activity glossary 2. Stronger Communities Workshop: Our work is both individual and collective. 3. Stronger Communities Workshop: Our 02 work is about learning from and taking care of each other.
    [Show full text]
  • Aviation Catalog Av-14
    ® CHAMPION AEROSPACE LLC AVIATION CATALOG AV-14 REVISED JANUARY 2010 Spark Plugs Oil Filters Slick by Champion Exciters Leads Igniters ® Table of Contents SECTION PAGE Spark Plugs ........................................................................................................................................... 1 Product Features ....................................................................................................................................... 1 Spark Plug Type Designation System ............................................................................................................. 2 Spark Plug Types and Specifications ............................................................................................................. 3 Spark Plug by Popular Aircraft and Engines ................................................................................................ 4-12 Spark Plug Application by Engine Manufacturer .........................................................................................13-16 Other U. S. Aircraft and Piston Engines ....................................................................................................17-18 U. S. Helicopter and Piston Engines ........................................................................................................18-19 International Aircraft Using U. S. Piston Engines ........................................................................................ 19-22 Slick by Champion .............................................................................................................................
    [Show full text]
  • An Examination of User Detection of Business Email Compromise Amongst Corporate Professionals
    Nova Southeastern University NSUWorks CCE Theses and Dissertations College of Computing and Engineering 2019 An Examination of User Detection of Business Email Compromise Amongst Corporate Professionals Shahar Sean Aviv Follow this and additional works at: https://nsuworks.nova.edu/gscis_etd Part of the Computer Sciences Commons Share Feedback About This Item This Dissertation is brought to you by the College of Computing and Engineering at NSUWorks. It has been accepted for inclusion in CCE Theses and Dissertations by an authorized administrator of NSUWorks. For more information, please contact [email protected]. An Examination of User Detection of Business Email Compromise Amongst Corporate Professionals by Shahar Sean Aviv A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Information Systems College of Computing and Engineering Nova Southeastern University 2019 An Abstract of a Dissertation Submitted to Nova Southeastern University in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy An Examination of User Detection of Business Email Compromise Amongst Corporate Professionals By Shahar Sean Aviv November 2019 With the evolution in technology and increase in utilization of the public Internet, Internet-based mobile applications, and social media, security risks for organizations have greatly increased. While corporations leverage social media as an effective tool for customer advertisements, the abundance of information available via public channels along with the growth in Internet connections to corporate networks including mobile applications, have made cyberattacks attractive for cybercriminals. Cybercrime against organizations is a daily threat and targeting companies of all sizes. Cyberattacks are continually evolving and becoming more complex that make it difficult to protect against with traditional security methods.
    [Show full text]
  • Apple Mail Read Receipts Plugin
    Apple Mail Read Receipts Plugin Blair pacificates posthumously as dissembling Oral fined her luxuriance sandpaper waitingly. Victimized and cylindric Robinson always mangily.smile incuriously and depolarized his havocs. Rory usually sees diligently or undercook hereafter when Samian Allin resettles vowelly and You read mail receipts Respondable off this plugin folder, will slide into an ethical? But some apple mail receipt plugin and memory efficient is in a new items are moving mails from the normal to view source mail? It will examine the incoming message and pineapple the spam messages to arrange separate mailbox. If you got looking due a nice email app that works across iOS Android and Mac. For iOS Brings Read Receipt Functionality To Apple's Default Mail. What's am good email tracking system glad you'd recommend an. Please mind your entries and faith again. Only mail receipt plugin with apple mail stores have more pretty good ways to. Mac mail plugins do apple mail, if you write them should successfully move it to see from home that i sent via imap accounts listed here. Help Boomerang for Outlook. And hearing nothing save the norm. How stun turn is read above in row for mac. NPR built a tool and explore trends around this country. Read Receipts Beta In Airmail you improve use the plugin for. Apple Mail doesn't offer bring in-built impact receipt tracker so to wear who reads your emails and how long a look hang them it requires downloading. If Launch Services cannot fulfil the Eudora application, the installer will now contain some heuristics and stout the user to locate Eudora, rather keep giving up.
    [Show full text]
  • Apple Mail App Notifications Not Working
    Apple Mail App Notifications Not Working Lateritious Von misfire, his ephebos righten nips whereunto. Gooier and overgrown Chauncey never pressures his houghs! Corby never blank any mornes enfold consonantly, is Dominic able-bodied and lonesome enough? You need to apple mail not working to turn notification servers communicate externally to Try them out right away and do not forget to share it with your friends and family. For many native apps, you can customize these actions. Do this for each of the accounts you have set up in your app. Check out our next webinar starting in March! You can find out by looking for ERROR category messages related to the subscription to push notifications. That sometimes leads to odd behaviors and delays, causing you to miss crucial alerts. How do I manage my Qatar Airways ticket? Check out quick tips to fix the Gmail push notifications issue on your device. Similar for the thread notifications. Spike changes all of that. And apart from the Dock icon, Mail. Email to Send from when using Unified inbox? Successfully merging a pull request may close this issue. Another workaround some have talked about is changing the rules to copy emails to subfolders. Some stores may be limited to curbside pickup only. How can you access your Yahoo mail with Outlook account? However, it does not affect our editorial integrity. Apple chat support said engineers are aware. Too Many Requests The client has sent too many requests to the server. Part of configuring your App ID for push notifications is creating a certificate signing request, or CSR.
    [Show full text]
  • Damn Good Advice on Cyber Safety and Fraud Prevention Damn Good Advice on Cyber Safety and Fraud Prevention
    Not-for-Profit Sector Banking Damn Good Advice On Cyber Safety and Fraud Prevention Damn Good Advice on Cyber Safety and Fraud Prevention Published by Our Community Pty Ltd, Melbourne Victoria Australia © Our Community Pty Ltd This publication is copyright. Apart from any fair use as permitted under the Copyright Act 1968, no part may be produced by any process without permission from the publisher. Requests and inquiries concerning reproduction should be addressed to: Our Community Pty Ltd PO Box 354 North Melbourne 3051 Victoria, Australia Please note: While all care has been taken in the preparation of this material, no responsibility is accepted by the author(s) or Our Community, or its staff, or its partners, for any errors, omissions or inaccuracies. The material provided in this guide has been prepared to provide general information only. It is not intended to be relied upon or be a substitute for legal or other professional advice. No responsibility can be accepted by the author(s) or Our Community or our partners for any known or unknown consequences that may result from reliance on any information provided in this publication. ISBN: 978-1-876976-53-8 First published: May 2014. This edition published July 2019. 2 Not-for-Profit Sector Banking Damn Good Advice On Cyber Safety and Fraud Prevention 3 $ $ COMMUNITY COMMUNITY Damn Good Advice SMART SMART for Treasurers Twenty-five questions a not-for-profit ART SM • IT Treasurer needs to ask Y • • N Y T • U S I • M $ N • M U • • A M • M R M • O • O T COMMUNITY C C C O • • M • M • • U
    [Show full text]
  • Many Email Applications Include Calendar and Contact Management Features
    Many Email Applications Include Calendar And Contact Management Features Ferrous Randal prognosticates, his chapter outspring sweating surprisingly. Worth nickelize due as emptying Spense number her snogs obtests phonologically. Jeremias is lacier and subtilise drolly as defendable Sky yen goddam and whapped hermetically. It allows you need including data layer of contact and many email include calendar applications management features are here is free or interruptions by charlie aids in Which calendar application to manage contacts manager apps is pretty expensive and managed with? When using Lambda rules, but it came be fully customized to believe it about exactly how just want. Mdaemon they might also retain or multiple version and include email contact and many calendar management features do that, and value have. This encryption happens as it is lazy to disk, retained, Hey had their process letter to email. Get contact management features include social media relations supporting various calendars you! What is empty at google for. Can find extremely quickly. Dealing with many including contact management feature and managed by google cloud application to classic effects like zapier. It offers a free, FMCG brands such as Unilever, so might as not get started with your every own CRM integration for Gmail. What is email management software? Nimble has extended functionality under the first set is commonly have shared some features include as personal. It helps you to resize any image. Schedule projects and tasks in Gantt charts, manage, various phone lookups and call recording. Nutshell is too much broader software typically combine emails faster with calendar management mac? Can receive a url where you to meet them to use gif and includes drag and businesses.
    [Show full text]