Once spammers have a list of e-mails addresses they have to send their message to these recipients. When undesired mail was not a big problem as it is now, they could use their own infraestructure to send it, that is, their own servers or even from their own e-mail account. But as more spammers used this server administrators began to implement techniques to avoid being used to send spam, as it was a big consumption of resources, so they had to switch to using other’s servers.

This is a big annoyance for the owners of the servers, as they will be probably black-listed and will not be able to send legitimate mail, causing a disruption of the service for legitimate users.

In a first instance, spammers used mail servers which were incorrectly configured and allowed anyone to send e-mail through it (technically, it is known as relaying mail). It’s very cheap to use this technique, as to send massive amounts from the server the spammer only needed to send it once. Fortunately, nowadays most administrators configure their servers correctly and only allow authorized users to send e-mail, so spammers needed to find another way to send their junk. If you administer an e-mail server and you don’t have secured it against relaying you should check how to disable it.

The most common used technique nowadays is relay mail through botnets. Botnets are groups of compromised computers controlled remotely by the attacker and spammers use them to send the e-mails to the world. Unfortunately, there are a lot of botnets in Internet and it’s quite cheap to find someone who controls one and sends the e-mails for us.

For this reason, it’s important to protect our computer so it doesn’t get used to spam all the world. Also, some ISPs implement filters so e-mail from their users can only be send through their server (technically, they close the outbound TCP port 25). This way, they can’t send spam from that account but this is also an annoyance for more advanced users, which sometimes need to use other e-mail servers as they might have different accounts in other places.

We have already seen a brief discussion of how e-mails works both when we send it and when we receive it, so now it’s time to know which kind of undesired mail we can receive.

Spam: the classic and oldest type of undesired mail. In fact, any kind of e-mail sent massively and without the consent of the receiver is considered to be spam, but to distinguish them we usually call it spam when it’s some kind of advertising trying to sell legal or illegal products.

Phishing: this is a technique used to collect sensitive information from users, such as passwords or bank account details. E-mail of this type tries to disguise as legitimate mail but points to fake webservers where you are asked to enter the information.

Viruses: in old times viruses spread through floppy disks but with the rising of the use of e-mail creators have changed the distribution method and worms (as these kinds of viruses are known) are nowadays one of the most common type of virus.

Chain letters: these usually come from people we know, so it’s easier to trust them, but almost always contain false information. We can distinguish them because they try to expand some kind of rumour, such as non-deletable viruses, methods of obtaining free presents from some companies or threats of something bad happening to us if they are not forwarded to a specified quantity of people.

Trojans: similar to viruses but usually not send massively, only to an intended recipient as a method of gaining control of his computer or information stored in it.

There are some more kinds of undesired mail but these are the most important ones. We are going to have a look at each of them and discover how they work and how to avoid them.

Once we know how an e-mail looks, the next step is see how it’s delivered from end to end. When the e-mail has written in the mail application (for example, Outlook of you are using Windows or simply Mail if you are using Mac OS X) it must be send to the destination, but this is usually a multistep process.

In first place, the mail application must use the SMTP (Simple Mail Transport Protocol) protocol to send the message to the server we are using. This server is assigned by our ISP and usually it’s name is smtp.ourisp.com or similar to this. We can see an example of the interchange of data in a tipical SMTP session (> represents data send by the server and < data send to the server):
Continue reading ‘E-mail security: how does e-mail work (II).’