22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Problems with these protocols<br />

As mentioned earlier, the simplicity of these protocols has meant that they create<br />

security issues for anyone sending and receiving mail across the Internet.<br />

SMTP<br />

The SMTP protocol does not use any authentication process when establishing<br />

communications with another SMTP host for relaying and delivering mail.<br />

The sending host basically sends a command to the receiving SMTP host saying<br />

who it is, and that it wants to communicate. The receiving host believes who it<br />

says it is, and awaits further commands. The sending host then sends another<br />

command saying who the mail is from, which again the receiving SMTP host<br />

accepts. The sending host sends another command saying who the intended<br />

recipient of this mail is, which the receiving SMTP host accepts. The sending<br />

host then sends a command, stating that what follows is the text message, with<br />

finally an end of message string advising the completion of the message.<br />

As can be seen, in this scenario anybody with a network sniffer could pick up this<br />

traffic over the network, since it is all sent in clear text. Even worse, it’s quite<br />

simple for anybody to spoof a message on any SMTP server. It is easy to initiate<br />

the communication with an SMTP host and pretend that the mail was sent by<br />

someone else.<br />

The following example demonstrates how simple it is. By connecting to the<br />

SMTP host using TELNET on port 25, and sending the commands that the<br />

receiving SMTP host expects, we can spoof an e-mail message:<br />

Telnet 25<br />

HELO foobar.com<br />

MAIL FROM: <br />

RCPT TO: <br />

DATA<br />

SEND FROM: <br />

POP<br />

The original POP3 specification does not specify any authentication methods.<br />

Similar to SMTP, the communication between a POP3 client and a POP3 server<br />

is sent in clear text. In fact, the commands USER and PASS are used for passing<br />

the user name and password for authorization to connect to a POP3 server for<br />

receiving mail. For more information on this, we recommend that you read RFC<br />

1725 - Post Office Protocol - Version 3.<br />

Chapter 6. Public key infrastructures 263

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!