Email hacking

Email hacking is the unauthorized access to, or manipulation of, an email account or email correspondence.[1][2]

OPSEC warning military personnel not to use email accounts with weak security.

Overview

Email is now a very widely used communication method. If an email account is hacked it can allow the attacker access to the personal, sensitive, or confidential information in the mail storage; as well as allowing them to read new incoming and outgoing email - and to send and receive as the legitimate owner. On some email platforms it may also allow them to setup automated email processing rules. All of these could be very harmful for the legitimate user.

Attacks

There are a number of ways in which a hacker can illegally gain access to an email account.

Virus
Main article: Computer virus

A virus or other malware can be sent via email, and if executed may be able to capture the user's password and send it to an attacker.[3]

Phishing
Main article: Phishing

Phishing involves emails that appear to be from legitimate sender but are scams which ask for verification of personal information, such as an account number, a password, or a date of birth. If unsuspecting victims respond, the result may be stolen accounts, financial loss, or identity theft.[3]

Prevention measures

Email on the internet is sent by the Simple Mail Transfer Protocol (SMTP). While mail can be encrypted between mail servers, this is not typically enforced, but instead Opportunistic TLS is used - where mailservers negotiate for each email connection whether it will be encrypted, and to what standard. Where a mail flow between servers is not encrypted, it could be intercepted by an ISP or government agency and the contents can be read by passive monitoring.[4] For higher security, email administrators can configure servers to require encryption to specified servers or domains.

Email spoofing and similar issues which facilitate phishing[5] are addressed by the 'stack' of Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). Setting all these in place is technically challenging, and not visible to the end user, so implementation progress has been slow. A further layer, Authenticated Received Chain (ARC), allows mail flow through intermediate mail servers such as mailing lists or forwarding services to be better handled - a common objection to implementation.

Businesses typically have advanced firewalls, anti-virus software and intrusion detection systems (IDS) to prevent or detect improper network access. They may also have security specialists perform an audit on the company and hire a Certified Ethical Hacker to perform a simulated attack or "pen test" in order to find any gaps in security.[6]

Although companies may secure its internal networks, vulnerabilities can also occur through home networking.[6] Email may be protected by methods, such as, creating a strong password, encrypting its contents,[7] or using a digital signature.

If passwords are leaked or otherwise become known to an attacker, having two-factor authentication enabled may prevent improper access.

There are also specialist encrypted email services such as Protonmail or Mailfence.

Cases of email hacking

Notable cases of email hacks include:

References
  1. Joel Scambray; Stuart McClure; George Kurtz (2001), "Email Hacking", Hacking Exposed, McGraw-Hill, p. 626, ISBN 9780072127485
  2. R. Thilagaraj; G Deepak Raj Rao (2011), "Email hacking", Cyber Crime and Digital Disorder, Manonmaniam Sundaranar University, p. 3, ISBN 9789381402191
  3. Alex Kosachev; Hamid R. Nemati (2009). "Chronicle of a journey: an e-mail bounce back system". International Journal of Information Security and Privacy. 3 (2): 10.
  4. McCullagh, Declan (21 June 2013). "How Web mail providers leave door open for NSA surveillance". c|net. Retrieved 2 October 2018.
  5. Nitesh Dhanjani; Billy Rios; Brett Hardin (2009), "Abusing SMTP", Hacking, O'Reilly Media, pp. 77–79, ISBN 9780596154578
  6. "Online security: Hacking". New Media Age: 8–9. 24 March 2005.
  7. https://prism-break.org/en/all/#email-encryption
  8. Maxwell T. Boykoff (2011), "The UEA CRU email hacking scandal (a.k.a. 'Climategate')", Who Speaks for the Climate?, Cambridge University Press, pp. 34–40, ISBN 9780521133050
  9. James Cusick; Ian Burrell (20 January 2012), "We hacked emails too – News International", The Independent, London
  10. Tony Dyhouse (25 October 2011), Email hacking victim Rowenna Davis tells her story, BBC
  11. Charles P. Pfleeger; Shari Lawrence Pfleeger (2011), Analyzing Computer Security, Prentice Hall, pp. 39–43, ISBN 9780132789462
  12. Verhoeven, Beatrice (11 November 2015). "Greatest Hits of Leaked Sony Emails". TheWrap. Retrieved 3 October 2018.
  13. "Hacker exposes ex-US President George H W Bush emails". BBC News. 8 February 2013. Retrieved 10 February 2013.
  14. Franceschi-Bicchierai, Lorenzo (October 20, 2016). "How Hackers Broke Into John Podesta and Colin Powell's Gmail Accounts". Motherboard. Retrieved August 13, 2018.
  15. Stein, Jeff. "What 20,000 pages of hacked WikiLeaks emails teach us about Hillary Clinton". Vox. Retrieved October 21, 2016.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.