Mechanisms of processing e-mail on Linux mail servers: reducing security risks of using html code in e-mail T. Vrbanec, B.S. D. Radošević, Ph.D. Professor Ž. Hutinski, Ph.D. Teachers College in Čakovec Faculty of Organization and Informatics Faculty of Organization and Informatics Ante Starčevića 55, Čakovec, Croatia University of Zagreb University of Zagreb Phone: +385 (0)40 370 030 Pavlinska 2, Varaždin, Croatia Pavlinska 2, Varaždin, Croatia Fax: +385 (0)40 370 025 Phone: +385 (0)42 213 777 Phone: +385 (0)42 213 777 E-mail: [email protected] E-mail: [email protected] E-mail: [email protected] Abstract - The widespread and rapidly growing use of html According to the Yeenky Group web surwey [1], Microsoft format of e-mail is accompanied with the presence of the assesses it has an 85% market share of servers of the so- malicious code (viruses, worms, active scripts, trojans, redi- called small and medium business subjects, with projected rection to malicious web contents, and other similar things), 65% increase of sale of Windows servers in 2005. On the especially in the light of the widespread illegal advertising. other hand, according to the same source, rate of growth of Apart from the antivirus tools and the tools used to remove new Linux servers on the market is constantly increasing, spam, on Linux mail servers there are other tools like from 15% in 2001 to 40% of total number of new servers Procmail, Maildrop, CSMail and MIMEdefang, which can also in the world in 2004. Today, the number of new Linux and be used to filter e-mail. In this paper the authors have shown Windows servers is almost equal. Nevertheless, [2] Linux a method for the development of the programme solution is gaining advantage in multiprocessor servers and in or- which can be added to the above mentioned tools. By using ganizations with the need for cluster operations of the the suggested method the html contents is sorted out from the servers. messages by putting it into the compressed attachment and Based on the research made between December 2002 thus leaves the pure text in the message. The user has thus and April 2003 [3], we can make synthesis of tendencies of been secured from the above mentioned threats and can de- usage of individual operational systems for mail servers cide for himself whether he wants to open the attachment or (Figure 1). We should emphasize the fact that the sample not. of mail servers included in the research in December 2002 is not representative, although in the case of mail servers it is hard to say how extensive the sample would have to be I. INTRODUCTION to be called representative, i.e. what is the total number of mail servers in the world. Transference of electronic messages requires (mail) According to the study of Radicati Grupe [4], 651 mil- servers which complete their tasks through SMTP, POP3 lions of people in the world use e-mail regularly, and this and IMAP protocols. The majority of mail servers in use number will, according to the same source, increase to today can be placed under one of two categories: Linux or 850 millions by 2008 Windows. It is hard to asses their percentage of the market. Dec-02 Jan-03 Feb-03 Mar-03 Apr-03 60% 25000 Others: 52,39% 50% 20000 Linux: 43,51% Others: 41,47% 40% Linux: 38,74% 15000 30% MS Windows: 28,69% Share [%] Others: 27,80% Linux: 28,04% Sample Size 10000 20% MS Windows: 19,79% MS Windows: 19,57% 5000 10% 0% 0 Dec-02 Jan-03 Feb-03 Mar-03 Apr-03 Time SAMPLE SIZE: 2841 SAMPLE SIZE: 22046 SAMPLE SIZE: 21258 Figure 1 MAIL Servers Operating Systems According to [5], the traffic of digital data doubles every ers. It is possible [9, 10] that the future will bring some year, while according to Moore’s law, the power of proces- change, since Microsoft itself, as the world’s largest manu- sors doubles “only” every 18 months. This lag is being facturer of operational systems and office packages, seems compensated mostly by increase of the number of servers. to be aware of the dangers related to it, and proposes to its Unfortunately, the researches like [1] show that the per- users the change of settings which transforms html parts of centage of unwanted e-mail in total number of e-mails in e-mails into pure text. 2004 was, according to different sources, between 38% Many users do not have rights for change of the settings and 88% of all e-mails, while 7% of e-mails are infected. of applications they start. Some use clients for e-mail read- According to [6, 7], the so-called "phishing" of user’s ing and sending which cannot turn off sending of html accounts and financial data through e-mail during first half forms of e-mails [11]. of 2004 increased by monthly rate of 50%. Some 70% of There are many dangers for e-mail recipient: users received phishing e-mails, and some 5-15% was • Viruses successfully deceived, i.e. they disclosed their confidential • Worms user and/or financial data. According to the same source, company MessageLabs argues that the number of variants • Trojans of such e-mails increased in just six months from 279 to • Malicious code (active scripts, program accessories 215643. According to [8], the defense consists of powerful – parasite code) web and mail authentication and of digital signature of e- • Redirection to malicious Internet contents mails. We should also mention that FBI [8] considers • “Phishing" of confidential user data, mostly finan- phishing to be the most important new threat on the Inter- cial net (July 2003.). • Web bugs Mail servers can successfully function with installed OS • Programs which change user’s dial up settings. and Mail Transport Agent like Sendmail. Many of them have other useful functions, like filtering of unwanted All threats stemming from html form of e-mail can be emails or checking emails for some kind of infection. It divided into two groups of reasons: depends upon the number of users of that server, and upon 1. html code can be executed, i.e. html code is, in limitations of time, equipment, finances and educated sys- broader sense, executive code (it can contain code tem administrators. in java script, VBscript, etc.) Although the two main contestants in “market race” 2. html code can endanger the user’s privacy. have different characteristics of safety of operative systems There are no definite methods of user’s self-defense, ex- and applications, as well as different time of response to cept that he/she defines sending and reading of messages in omissions in their codes, in this paper we will not address form of pure text in e-mail settings [12]. this issue. Nevertheless, we have noticed the three main On various web sites with very different informative reasons the users increasingly rely on Linux mail servers. functions, it could happen that the data we received from In this, we consider the objectivity or subjectivity of these them are not the data which that web site should have sent. reasons perceived in the moment of decision about plat- Namely, if we follow the specially shaped link which form for mail server to be irrelevant: could also be present in html part of e-mail, this web site, • Perception of lower total costs i.e. server can send wrong data, unwanted images and • Confidence that the program support of open code programs, as well as the malicious scripts whose effect is is manufactured with fewer security omissions compromise of users' data [13]. • Shorter time needed for solving possible security Some of the ways in which the user can be exposed to omissions. the influence of malicious scripts are: • Following of the links to the web sites to which we do not have full confidence, e-mails or posts on II. E-MAIL THREATS news groups. • Usage of interactive forms on web sites which we do not trust completely. In the beginning of the development of the Internet, while the interchange of e-mail was in its early stages, the • Review of dynamically generated sites whose con- one and only form it used was pure text. Attachment and tent or author is unknown. html forms appeared later. Many users from this age, as In case of malicious script usage, the attacker may get well as their students, shrink from the use of html form of the users password or some other relevant information. e-mail. Some are so extreme in this that they do not use e- Besides, malicious script can be used for endangering the mail clients that support html form of e-mail. On the other local network, i.e. shared resources, or attacks on other hand, users who write e-mails exclusively in html form are computers or servers. mostly unaware of the fact that they received message in Some web browsers have vulnerable security system, the form of pure text. To be compatible with the whole which means that they decide which rights a script should Internet community in relation to e-mail means to write it have for it to be executed on the client computer. In such in form of pure text. Unfortunately, most of today’s clients way, the scripts can be used to load and install various for sending and receiving e-mail have related settings on program packages, even to read or modify data on other html, and it is possible to put malicious code within any web sites/servers.