2KKUU7ita

Figure 13-4:
smtpscan
gathers
version info
even when
the SMTP
banner is
disguised.
Chapter 13: Communication and Messaging Systems
You can gather information on POP3 and IMAP e-mail services by telnetting to
port 110 (POP3) or port 143 (IMAP).
If you change your default SMTP banner, don’t think that no one can figure out
the version. General vulnerability scanners can often detect the version of your
e-mail server. One Linux-based tool called smtpscan (www.freshports.org/
security/smtpscan/) determines e-mail server version information based
on how the server responds to malformed SMTP requests. Figure 13-4 shows
the results from smtpscan against the same server shown in Figure 13-3. The
smtpscan tool detected the product and version number of the e-mail server.
Countermeasures against banner attacks
There isn’t a 100 percent secure way of disguising banner information. I suggest
these banner security tips for your SMTP, POP3, and IMAP servers:
✓ Change your default banners to cover up the information.
✓ Make sure that you’re always running the latest software patches.
✓ Harden your server as much as possible by using well-known best
practices from such resources as the Center for Internet Security (www.
cisecurity.org), NIST (http://csrc.nist.gov), and Network
Security For Dummies by Chey Cobb.
SMTP attacks
Some attacks exploit weaknesses in the Simple Mail Transfer Protocol (SMTP).
This e-mail communication protocol — which is over three decades old — was
designed for functionality, not security.
257