AusCERT2023: Analysis of SMTP TLS Implementations

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
Analysis of SMTP TLS Implementations
AusCERT Conference
11 May 2023
Jamie Gillespie, Senior Internet Security Specialist...

Overview
• Importance of SMTP security
• Overview of SMTP security options
• Methodology
• Analysis of SMTP TLS security
•...

Importance of SMTP security
• Email is integral to our work and personal lives
• What’s in your Inbox and Sent Mail folder...

Importance of SMTP security
• Blog posts
– “How to send sensitive information via email”
• User perception
– “I’m connecte...

Importance of SMTP security
• SMTP server-to-server communication uses STARTTLS
• Communication starts unencrypted, and if...

Overview of SMTP security options
• DANE (DNS-Based Authentication of Named Entities)
– DANE associates a TLS certificate ...

Overview of SMTP security options
• MTA-STS (Mail Transfer Agent Strict Transport Security)
– MTA-STS enables mail service...

Overview of SMTP security options
• DKIM (DomainKeys Identified Mail)
– DKIM provides a method for detecting forged/spoofe...

Overview of SMTP security options
• SPF (Sender Policy Framework)
– SPF is a simple email validation system, designed to p...

Overview of SMTP security options
• DMARC (Domain-based Message Authentication,
Reporting & Conformance)
– DMARC is an ema...

Methodology
• Wrote some Python code to:
– Take a list of domains and query their MX records
– Query DNS for records relat...

Methodology
• Used testssl.sh (https://testssl.sh/) to check all MX servers
for TLS cipher suites and common vulnerabiliti...

Methodology
• Lists of companies were created, and extracted the domain
used for their email addresses (thank you Privacy ...

Analysis of SMTP TLS security
ASX100
• 95 domains, after some deduplicating
• Mostly using hosted mail services, such as:
...

Analysis of SMTP TLS security
ASX100
• 100% SPF, with policies split between fail and softfail
with 1 domain breaking RFCs...

Analysis of SMTP TLS security
ASX100
• MTA-STS policy exists for 1 domain,
and their policy is set to testing (good start)...

Analysis of SMTP TLS security
ASX listed under $2mil market cap
• 13 domains in this category
• Most are using hosted mail...

Analysis of SMTP TLS security
ASX listed under $2mil market cap
• Only 2 domains with a DMARC policy
– both set to quarant...

Analysis of SMTP TLS security
Australian Government (Federal and State/Territory)
• 65 domains, split between large federa...

Analysis of SMTP TLS security
Australian Government (Federal and State/Territory)
• SPF
– 7 domains have ?all in their mai...

Analysis of SMTP TLS security
Australian Charities
• 20 domains of large Australian charities were chosen
• Most are using...

Analysis of SMTP TLS security
Australian Charities
• DMARC
– 8 domains with no DMARC policy
– 8 domains with a DMARC polic...

Analysis of SMTP TLS security
Top Australian ISPs
• 20 domains chosen, trying to avoid a lot of parent/child ISPs
• Most a...

Analysis of SMTP TLS security
Top Australian ISPs
• DMARC
– 11 domains with no DMARC policy
– 5 domains with a DMARC polic...

Analysis of SMTP TLS security
Top International Email Providers
• 17 domains
– gmail.com – outlook.com – aol.com
– protonm...

Analysis of SMTP TLS security
Top International Email Providers
• DMARC
– 2 domains with no DMARC policy
– 7 domains with ...

Analysis of SMTP TLS security
• Using expired certificates
– partnerconsole.net and iseek.com.au
• Using anonymous cipher ...

Analysis of SMTP TLS security
• Using SSLv2 (deprecated in 2011)
– activ8.net.au
• Using SSLv3 (deprecated in 2015)
– mrl....

Analysis of SMTP TLS security
• TLSv1 is still enabled for many big providers
– fireeyecloud.com, google.com, messagelabs....

Recommendations
• Test your own servers, and your critical vendors/partners
– testssl.sh
– sslscan
– internet.nl
– aucheck...

Recommendations
• SPF, DKIM, and DMARC are great for stopping impersonation
but don’t forget about inbound mail security
•...

Questions & Discussion
32

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 545284 views
Storytelling For The Web: Integrate... by Chiara Aliotta 433420 views
Artificial Intelligence, Data and C... by OECD Directorate ... 308718 views
How to Leverage AI to Boost Employe... by SocialHRCamp 133046 views
2024 State of Marketing Report – by... by Marius Sescu 113176 views
Everything You Need To Know About C... by Expeed Software 149056 views

Top clipped slide

View on SlideShare

1 of 32 Ad

1 of 32 Ad