IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
T 5.77 Unauthorised monitoring of E mails
Electronic mail (E Mail) is usually transmitted as plain text. Data which has
not been protected by cryptographic means can be monitored and modified on
any IT system via which it is being transmitted. In the case of E Mail sent over
the Internet, a large number of IT systems could be involved without the
precise routing being known beforehand. The transmission route depends on
the utilisation and availability of gateways and network segments. In some
cases, E Mail intended simply for transmission between two neighbouring
municipal districts can be routed abroad at some point.
Access to incoming E Mail can also be gained via the recipient's mailbox
maintained on the mail server. This mailbox contains all received E Mails, not
only those which have not yet been read, but depending on the configuration,
it may also contain an archive of all E Mails received in recent months. As a
very minimum, the system administrator in charge of the mail server will have
access to the mailbox. In some cases, copies of outgoing E Mails are also
stored on the mail server. Usually, however, the user's mail software stores
them on the sender's computer.
Examples
- A number of Microsoft internal E Mails have been used by the other side in
the anti-trust proceedings against Microsoft to undermine the company's
position. Some of these E Mails contained defamatory remarks about
Microsoft's competitors.
- A supplier makes services available over the Internet. To use these
services, it is necessary to log on to the service provider's server. The
authentication information needed for this purpose is sent to the customer
by E Mail. If this E Mail is intercepted, an adversary can then log on to the
service provider's server without authorisation and avail himself of its
services at the expense of the registered customer.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Transmission in plain
text
Storage on the mail
server