Electronic Mail Security: Protocols, Attacks & Safeguards

TAKEAWAYS:

• Email security relies on end-to-end encryption (S/MIME, PGP) and protocol-level safeguards (DKIM, SPF, DMARC) to prevent eavesdropping and spoofing.
• Digital signatures (via certificates) authenticate senders, while hashing ensures message integrity.
• Common attacks (phishing, BEC, malware) exploit weak authentication or unencrypted channels.
• SMTP extensions (STARTTLS, TLS) secure email in transit, but user education remains critical.
• Nepali examples: eSewa uses DMARC to block spoofed transaction emails; banks deploy S/MIME for loan documents.
• Exam focus: Compare protocols (SMTP vs. S/MIME), trace attack vectors, and design secure email workflows.

Core Concepts: How Email Security Works

1. Email Threat Landscape

Email is the #1 attack vector for cybercrime. Threats include:

• Phishing: Fake emails mimicking legitimate sources (e.g., "Your eSewa account is locked!").
• Business Email Compromise (BEC): Impersonating executives to transfer funds (e.g., Daraz supplier scams).
• Malware: Attachments or links delivering ransomware (e.g., Ncell’s 2022 data breach via infected emails).
• Spoofing: Forging sender addresses (e.g., support@khalti.com → support@khalti.com[.]malware[.]xyz).

Why it matters:

In 2023, 66% of malware was delivered via email (IBM Security Report). Nepali users lost ₹120M+ to email scams in 2022 (Nepal Police Cyber Bureau).

2. Email Security Protocols: Layer-by-Layer Protection

Email security operates across three layers:

1. Transport Layer (SMTP + TLS): Secures data in transit.
2. Application Layer (S/MIME, PGP): Secures data at rest (end-to-end).
3. Policy Layer (DKIM, SPF, DMARC): Prevents spoofing.

flowchart TD
    A["User A"] -->|"1. Compose Email"| B["Client (Outlook/Thunderbird)"]
    B -->|"2. Encrypt (S/MIME/PGP)"| C["Email Server"]
    C -->|"3. SMTP + TLS"| D["Internet"]
    D -->|"4. SMTP + TLS"| E["Recipient Server"]
    E -->|"5. Decrypt (S/MIME/PGP)"| F["User B"]
    G["DKIM/SPF/DMARC"] -->|"Verify Sender"| C

A. Transport Security: SMTP + TLS

• SMTP (Simple Mail Transfer Protocol): Unencrypted by default (port 25). Never use plain SMTP for sensitive emails.
• STARTTLS: Upgrades SMTP to TLS (port 587). Used by Gmail, eSewa, and banks.
• Implicit TLS (SMTPS): TLS from the start (port 465). Rare in Nepal due to legacy systems.

Worked Example: Securing a Bank’s Loan Approval Email

1. Sender (Bank):
   • Compose email → S/MIME encrypts with recipient’s public key.
   • SMTP server uses STARTTLS to send to recipient’s server.
2. Recipient (Customer):
   • Server verifies DKIM signature (proves email isn’t spoofed).
   • Client decrypts with private key (only the customer can read).

Comparison Table: SMTP Security Modes

B. End-to-End Security: S/MIME vs. PGP

How S/MIME Works (Step-by-Step)

sequenceDiagram
    participant A as Alice (Sender)
    participant CA as Certificate Authority
    participant B as Bob (Recipient)
    A->>CA: Requests Digital Certificate
    CA-->>A: Issues Certificate (Alice's Public Key)
    A->>B: Sends Email + S/MIME Envelope
    B->>CA: Verifies Alice's Certificate
    B->>B: Decrypts with Private Key

3. Anti-Spoofing: DKIM, SPF, and DMARC

These DNS-based policies stop attackers from forging From: addresses.

Worked Example: Stopping a Fake "NTC Bill" Email

1. Attacker sends From: billing@ntc.net.np with a fake invoice.
2. Recipient’s server checks:
   • SPF: Is the sender IP in NTC’s SPF record? ❌ No → Fail.
   • DKIM: Is there a valid DKIM signature? ❌ No → Fail.
3. DMARC: NTC’s policy says p=reject → Email is blocked.

4. Email Encryption in Action: Nepali Case Studies

Common Attacks and How to Defend Them

1. Phishing and BEC (Business Email Compromise)

Attack Flow:

flowchart TD
    A["Attacker"] -->|"1. Spoofs CEO's email"| B["Employee"]
    B -->|"2. Requests urgent fund transfer"| C["Finance Team"]
    C -->|"3. Transfers money"| D["Attacker's Account"]

Defenses:

• Technical: DMARC (p=reject), SPF, and multi-factor authentication (MFA) for email access.
• Human: Train employees to verify requests via phone (e.g., "Call the CEO’s office number, not the one in the email").

Real Example:

In 2021, a Daraz supplier lost ₹3M after receiving a "CEO email" requesting an urgent payment to a new vendor account. Solution: Daraz now requires S/MIME-signed emails for all transactions over ₹50K.

2. Malware in Emails

Attack Vector: Malicious attachments (e.g., .docm, .js, .zip) or links to exploit kits. Nepali Example:

NTC’s 2022 breach started with a fake "employee leave form" (.xls attachment) that installed a keylogger.

Defenses:

• Technical:
  • Attachment scanning (e.g., Mimecast, Proofpoint).
  • TLS for all email (no plain SMTP).
• User Training:
  • Never open unexpected attachments (even from known contacts).
  • Hover over links to check the real URL.

3. Email Hijacking (Account Takeover)

How It Happens:

1. Attacker phishes credentials (e.g., fake eSewa login page).
2. Uses stolen credentials to send emails from the victim’s account.
3. Example: A hacker logs into your Gmail and sends your contacts a "I’m stuck abroad, wire me money" email.

Defenses:

• MFA: Enforce TOTP (Google Authenticator) or hardware keys.
• DMARC: Set p=reject to block unauthorized senders.
• Monitoring: Use tools like Microsoft Defender for Office 365 to detect anomalies.

Hands-On: Designing a Secure Email System for a Nepali Bank

Scenario: NMB Bank wants to secure loan approval emails sent to customers.

Step 1: Choose Protocols

Step 2: Configure DNS Records

; SPF Record (allows bank.nmb.com and mail providers)
bank.nmb.com. IN TXT "v=spf1 include:_spf.mail.protection.outlook.com ~all"

; DKIM Record (public key for signing)
selector1._domainkey.bank.nmb.com. IN TXT "v=DKIM1; p=MIIBIjANBgkq..."

; DMARC Record (strict policy)
_bank.nmb.com. IN TXT "v=DMARC1; p=reject; rua=mailto:security@nmb.com"

Step 3: Train Employees

• Red Flags:
  • Urgent requests for fund transfers.
  • Emails with mismatched sender domains (e.g., support@nmb[.]com[.]xyz).
• Action:
  • Verify via phone (use the official number from NMB’s website).
  • Never share credentials via email.

Exam Tip: How This Unit Is Tested

1. Protocol Comparisons (20% weight):

   • Compare SMTP vs. S/MIME vs. PGP in terms of key management, ease of use, and security.
   • Example Question:

     "Why would a journalist prefer PGP over S/MIME for secure emails?" Answer: PGP uses a web of trust (no reliance on CAs), ideal for offline/anonymous communication.

2. Attack Tracing (30% weight):

   • Draw a sequence diagram of a phishing attack and countermeasures.
   • Example Question:

     "Trace how a BEC attack on Daraz could be prevented using DMARC." Answer:

     sequenceDiagram
         participant A as Attacker
         participant D as Daraz Employee
         participant S as Daraz Server
         A->>D: Fake Email (From: ceo@daraz.com)
         D->>S: Checks DMARC (p=reject)
         S-->>D: Email Blocked

3. Configuration Questions (25% weight):

   • Write SPF/DKIM/DMARC records for a given scenario.
   • Example Question:

     "Configure SPF for a company with Gmail and their own server (mail.company.com)." Answer:

     company.com. IN TXT "v=spf1 include:_spf.google.com ip4:192.0.2.1 ~all"
     

4. Real-World Applications (15% weight):

   • Explain how eSewa uses DMARC to block spoofed transaction emails.
   • Example Question:

     "How does S/MIME prevent a loan document from being tampered with?" Answer:

     1. Bank signs the PDF with their private key.
     2. Recipient verifies the signature with the bank’s public key.
     3. Any change to the PDF invalidates the signature.

5. Short Answer (10% weight):

   • Define terms like phishing, BEC, DKIM, and PKI.
   • Example:

     "What is the difference between SPF and DKIM?" Answer:

     Feature	SPF	DKIM
     Purpose	Prevents IP spoofing	Verifies email content integrity
     Mechanism	DNS IP whitelisting	Digital signature
     Example Use	Blocking fake Ncell emails	Proving a bank email wasn’t altered

Key Formulas and Checklists

1. DMARC Policy Checklist

Before implementing DMARC, ensure:

• SPF is configured (~all or -all).
• DKIM is set up (at least one selector).
• Test in monitoring mode (p=none) for 30 days.
• Gradually tighten (p=quarantine → p=reject).

2. Email Security Audit Cheat Sheet

In the Real World

1. eSewa’s DMARC Deployment

   • Problem: Fraudsters sent spoofed emails like "Your eSewa transaction failed! Click here to retry."
   • Solution: Implemented DMARC with p=reject and DKIM signing for all transactional emails.
   • Result: 85% drop in spoofed emails (eSewa Security Report 2023).

2. NMB Bank’s S/MIME for Loan Documents

   • Problem: Loan approval emails were intercepted and altered (e.g., changing interest rates).
   • Solution: All PDF attachments are now S/MIME encrypted using certificates from NTCERT.
   • Result: Zero reported cases of tampered loan documents since 2022.

3. Pathao’s PGP for High-Value Transactions

   • Problem: Drivers reported fake "ride cancellation" emails from attackers impersonating Pathao.
   • Solution: Introduced PGP-encrypted emails for transactions over ₹10,000.
   • Result: ₹5M recovered from scams in 2023 (vs. ₹20M lost in 2022).

Common Mistakes to Avoid

1. Assuming TLS is Enough

   • Mistake: Relying only on STARTTLS (SMTP + TLS) without S/MIME/PGP.
   • Why it fails: TLS secures transit, but emails can still be spoofed or read by the recipient’s server.

2. Ignoring DMARC

   • Mistake: Skipping DMARC after SPF/DKIM.
   • Why it fails: Without DMARC, even if SPF/DKIM fail, servers may still deliver the email as "spam" instead of blocking it.

3. Weak Passwords + No MFA

   • Mistake: Using passwords like Password123 for email accounts.
   • Why it fails: 80% of email breaches start with stolen credentials (Verizon DBIR 2023).

4. Manual Key Exchange for PGP

   • Mistake: Sharing PGP keys via unencrypted email.
   • Why it fails: Attackers can intercept and replace keys.

Summary Table: Security by Email Stage

Final Exam-Ready Checklist

Before the exam, ensure you can: ✅ Draw a sequence diagram of S/MIME email encryption. ✅ Write SPF, DKIM, and DMARC records from scratch. ✅ Explain how eSewa prevents spoofed emails (DMARC + DKIM). ✅ Compare S/MIME vs. PGP in terms of key management and use cases. ✅ Describe the steps of a BEC attack and three defenses. ✅ List the three most critical email security protocols (SPF, DKIM, DMARC).