14 DAY TRIAL // 40 different vulnerabilities related to opportunity-based encryption in email clients and servers that could allow an intruder to spoof mailbox contents and steal credentials have been identified and solved during the 30th USENIX Security Symposium.
The Hacker News reports that Sebastian Schinzel, Damian Poddebniak, Fabian Ising, and Hanno Boeck highlighted the issues that have since been resolved. Their study involved 320 000 e-mail servers, with most of them susceptible to command injection attacks. Some known vulnerable clients include Gmail, Mozilla Thunderbird, Samsung Email, Apple Mail, Claws Mail, Mutt, Evolution, Exim, Mail.ru, Yandex, and KMail.
STARTTLS refers to the version of opportunistic TLS that enables the upgrading from simple text to an encrypted connection of email communication protocols such as SMTP, POP3, and IMAP, without having to rely on separate encoded communication ports.
Hackers can circumvent security protocols
For the attacks to take place, the email client and provider connections need to be tampered with, and that attackers have their own credentials on the same server. Then again, they are not to be taken lightly. For instance, in a mailbox forgery case, for instance, the client can be tricked to process further fake commands from the server by simply adding extra content to the server message before the TLS handshake.
To continue the attack, the attacker takes advantage of the IMAP protocol, an Internet protocol used by email clients to retrieve email messages from a mail server. Furthermore, the attacker can bypass STARTTLS in IMAP by transmitting a PREAUTH greeting to block the connection establishment and force a client to use an unencrypted connection.
In order to keep their systems secure, researchers say that users utilize POP3, SMTP, and IMAP email clients in specific ports: 995, 465, and 993 with implicit TLS. In addition to this security precaution, the researchers recommend that email servers and mail clients be configured to automatically use implicit TLS by default.