Would you like to inspect the original subtitles? These are the user uploaded subtitles that are being translated: 1 00:00:02,050 --> 00:00:04,179 Email, now, is one of the most important 2 00:00:04,180 --> 00:00:06,100 online services that we use. 3 00:00:06,330 --> 00:00:07,120 For most people 4 00:00:07,200 --> 00:00:09,859 it can be a single point of security failure, 5 00:00:09,860 --> 00:00:12,690 because many of our accounts are linked to it. 6 00:00:13,450 --> 00:00:15,930 If you have a email compromise, 7 00:00:16,370 --> 00:00:19,600 your associated accounts are also compromised. 8 00:00:20,090 --> 00:00:22,129 Private information will be compromised, 9 00:00:22,130 --> 00:00:26,009 including your name, address, contacts, 10 00:00:26,010 --> 00:00:27,919 friends and anything else 11 00:00:27,920 --> 00:00:31,360 that’s associated or stored within your email. 12 00:00:32,060 --> 00:00:33,739 It’s obvious to most people 13 00:00:33,740 --> 00:00:35,880 why email security is important, 14 00:00:36,200 --> 00:00:41,549 but email unfortunately is fundamentally broken, 15 00:00:41,550 --> 00:00:43,400 as far as security is concerned, 16 00:00:43,750 --> 00:00:45,550 and it cannot be fixed. 17 00:00:45,950 --> 00:00:49,939 All we can do is keep putting sticky plasters on it. 18 00:00:49,940 --> 00:00:53,880 Plasters which, unless everyone else adopts, 19 00:00:53,920 --> 00:00:55,400 which is pretty much the same as 20 00:00:55,560 --> 00:00:57,230 changing email completely, 21 00:00:57,500 --> 00:00:58,879 we’re just not going to fix 22 00:00:58,880 --> 00:01:01,530 these security problems that are inherent in email. 23 00:01:01,820 --> 00:01:05,550 Email is from a time when security wasn't thought of. 24 00:01:05,760 --> 00:01:08,510 But we continue to use email 25 00:01:08,560 --> 00:01:10,720 because it is ubiquitous, 26 00:01:10,780 --> 00:01:13,020 everybody has an email address now. 27 00:01:13,480 --> 00:01:14,999 If everyone suddenly switched 28 00:01:15,000 --> 00:01:18,240 to a secure messaging alternative tomorrow, 29 00:01:18,460 --> 00:01:19,740 the problem would be solved. 30 00:01:20,090 --> 00:01:22,110 But because that’s not going to happen, 31 00:01:22,300 --> 00:01:23,849 we are stuck with a broken 32 00:01:23,850 --> 00:01:26,010 messaging system called email. 33 00:01:26,670 --> 00:01:29,210 This means you will need to convince others 34 00:01:29,450 --> 00:01:31,340 to adopt encryption technology 35 00:01:31,680 --> 00:01:34,120 if you want to communicate with them privately. 36 00:01:34,430 --> 00:01:35,630 You can't do it on your own. 37 00:01:36,460 --> 00:01:37,400 Let's take it from the beginning. 38 00:01:37,401 --> 00:01:40,399 So there are two ways to access email. 39 00:01:40,400 --> 00:01:43,130 First, you’ve got your web browser 40 00:01:43,320 --> 00:01:47,290 using functionality like HTML5 and JavaScript. 41 00:01:47,470 --> 00:01:50,429 And probably most people now think of that as email, 42 00:01:50,430 --> 00:01:52,379 that is the most common way 43 00:01:52,380 --> 00:01:54,219 that people tend to access email, 44 00:01:54,220 --> 00:01:56,750 you know, via Gmail or Yahoo Mail. 45 00:01:57,690 --> 00:02:00,919 But the second way that is used is an email client, 46 00:02:00,920 --> 00:02:05,850 which is something like Thunderbird, or Claws, or Outlook, 47 00:02:05,900 --> 00:02:07,850 people might use commonly at work. 48 00:02:08,170 --> 00:02:10,030 You have Mac Mail, 49 00:02:10,490 --> 00:02:11,799 or you have the mail apps 50 00:02:11,800 --> 00:02:14,640 that you get on your cell and mobile phones. 51 00:02:14,870 --> 00:02:16,320 Those are all email clients. 52 00:02:16,920 --> 00:02:18,539 And most email providers will allow you 53 00:02:18,540 --> 00:02:21,700 to use both methods, the webmail access 54 00:02:21,980 --> 00:02:23,090 and the email client. 55 00:02:23,780 --> 00:02:28,960 With webmail, you access via HTTPS, port 443, 56 00:02:29,380 --> 00:02:32,290 which is running SSL and TLS encryption, 57 00:02:32,570 --> 00:02:33,810 or at least you should be, 58 00:02:34,210 --> 00:02:36,370 that is the standard solution for most people. 59 00:02:36,610 --> 00:02:38,599 If you’re not, then it’s extremely insecure, 60 00:02:38,600 --> 00:02:42,190 but really, almost all webmail will be encrypted 61 00:02:42,550 --> 00:02:46,870 using HTTPS, port 443, SSL/TLS. 62 00:02:47,330 --> 00:02:49,599 You authenticate that server, 63 00:02:49,600 --> 00:02:50,960 that the server is genuine 64 00:02:51,160 --> 00:02:54,840 via a certificate as is normal with HTTPS, 65 00:02:55,200 --> 00:02:58,620 and the client is authenticated usually with a password. 66 00:02:59,070 --> 00:02:59,820 And if you can, 67 00:02:59,821 --> 00:03:01,710 you should change your authentication method 68 00:03:02,030 --> 00:03:03,900 to be Two Factor Authentication, 69 00:03:04,220 --> 00:03:05,999 as this mitigates password attacks 70 00:03:06,000 --> 00:03:08,260 as we’ve discussed in the Password section. 71 00:03:08,940 --> 00:03:10,189 You should find an email provider 72 00:03:10,190 --> 00:03:12,330 that offers Two Factor Authentication. 73 00:03:13,540 --> 00:03:14,720 If you only use webmail, 74 00:03:15,170 --> 00:03:17,930 then emails are only stored on the server. 75 00:03:19,000 --> 00:03:20,990 And then we have the email client. 76 00:03:21,100 --> 00:03:24,640 With an email client, there are a number of protocols 77 00:03:25,130 --> 00:03:28,640 and port options for both sending and receiving email. 78 00:03:29,080 --> 00:03:31,770 So the options when it comes to receiving mail, 79 00:03:32,120 --> 00:03:36,210 is you have IMAP port 143, which is unencrypted, 80 00:03:36,550 --> 00:03:41,260 you have POP port 110, which is unencrypted; 81 00:03:41,620 --> 00:03:43,100 you don't want to use these. 82 00:03:43,440 --> 00:03:46,390 If you care anything about your email security, 83 00:03:46,920 --> 00:03:50,399 receiving emails, then you don't want to use these, 84 00:03:50,400 --> 00:03:53,499 and most providers now either don't provide them, 85 00:03:53,500 --> 00:03:55,690 or provide encrypted alternatives. 86 00:03:56,400 --> 00:03:59,720 And those alternatives are IMAP port 993, 87 00:04:00,080 --> 00:04:02,520 which is running SSL/TLS encryption 88 00:04:02,890 --> 00:04:07,120 with the certificate based server-side authentication, 89 00:04:07,610 --> 00:04:08,880 like with a website, 90 00:04:09,160 --> 00:04:12,750 and you have POP 3 on port 995, 91 00:04:13,370 --> 00:04:16,280 running the same SSL/TLS encryption 92 00:04:16,730 --> 00:04:20,300 with, again, certificate based server-side authentication. 93 00:04:20,940 --> 00:04:21,880 And those are the two that 94 00:04:21,881 --> 00:04:24,320 you want to go after for receiving email. 95 00:04:24,690 --> 00:04:29,560 IMAP port 993 and POP 3 port 995. 96 00:04:29,960 --> 00:04:31,619 Now, some email providers 97 00:04:31,620 --> 00:04:33,940 may put those on different ports, 98 00:04:34,020 --> 00:04:36,810 but those are the de facto port numbers. 99 00:04:37,300 --> 00:04:38,989 But what is important, is that 100 00:04:38,990 --> 00:04:42,220 they are both running SSL and TLS. 101 00:04:42,890 --> 00:04:43,710 Now, when it comes to the difference 102 00:04:43,711 --> 00:04:45,160 between IMAP and POP, 103 00:04:45,640 --> 00:04:49,050 of the two, IMAP is the popular option 104 00:04:49,290 --> 00:04:50,599 when you need to check your emails 105 00:04:50,600 --> 00:04:53,789 from multiple devices, such as a laptop, 106 00:04:53,790 --> 00:04:55,230 phone, tablet and so on, 107 00:04:55,680 --> 00:04:58,230 because the emails are synced using IMAP 108 00:04:58,650 --> 00:05:00,890 with the server and all devices. 109 00:05:01,590 --> 00:05:03,880 All devices retain copies 110 00:05:04,380 --> 00:05:06,400 with the server having the master copy. 111 00:05:06,790 --> 00:05:08,370 This is the most convenient 112 00:05:08,670 --> 00:05:11,280 and what most people will be used to using. 113 00:05:11,620 --> 00:05:15,219 POP3, alternatively, downloads emails 114 00:05:15,220 --> 00:05:18,210 from the server to a single email client, 115 00:05:18,500 --> 00:05:20,800 then deletes the emails from the server. 116 00:05:21,190 --> 00:05:22,699 Because your messages get downloaded 117 00:05:22,700 --> 00:05:24,149 to a single email client, 118 00:05:24,150 --> 00:05:25,630 and then deleted from the server, 119 00:05:25,970 --> 00:05:28,390 it can appear that the mail is missing, 120 00:05:28,730 --> 00:05:30,840 or disappeared from your inbox 121 00:05:31,030 --> 00:05:32,239 if you try to check your mail 122 00:05:32,240 --> 00:05:34,590 from a different email client or webmail. 123 00:05:35,120 --> 00:05:36,910 But you may want this for security though, 124 00:05:37,210 --> 00:05:39,610 to have no emails stored on the server. 125 00:05:40,310 --> 00:05:42,570 If you’re worried about people accessing the server, 126 00:05:42,940 --> 00:05:43,940 use POP3. 127 00:05:44,410 --> 00:05:46,490 If you’re worried about people accessing your laptop, 128 00:05:46,780 --> 00:05:48,800 store on the server and the client with IMAP. 129 00:05:49,830 --> 00:05:50,750 Then we have the protocols 130 00:05:50,751 --> 00:05:53,440 for sending emails with an email client. 131 00:05:53,950 --> 00:05:57,410 We have SMTP port 25, 132 00:05:57,870 --> 00:06:01,900 which is the original unencrypted port to use; 133 00:06:02,090 --> 00:06:04,649 you don't want to use this if you care about 134 00:06:04,650 --> 00:06:07,600 your emails and sending your emails and privacy. 135 00:06:08,480 --> 00:06:11,610 Then you have something called STARTTLS, 136 00:06:11,690 --> 00:06:14,560 which is usually on port 587. 137 00:06:14,910 --> 00:06:17,930 And that is for using SSL/TLS encryption. 138 00:06:18,490 --> 00:06:22,079 And then you have SMTP port 465, 139 00:06:22,080 --> 00:06:24,830 which again is SSL/TLS encrypted. 140 00:06:25,330 --> 00:06:27,470 You want to use, when it’s possible, 141 00:06:27,940 --> 00:06:32,450 SMPT port 465 with the SSL/TLS. 142 00:06:32,820 --> 00:06:37,290 STARTTLS on 587 is more susceptible 143 00:06:37,480 --> 00:06:39,180 to man-in-the middle attacks. 144 00:06:39,520 --> 00:06:45,140 So go with the SMTP port 465, SSL/TLS option. 145 00:06:46,160 --> 00:06:48,610 For both email clients and webmail, 146 00:06:48,960 --> 00:06:52,300 the SSL/TLS will use a cipher suite, obviously. 147 00:06:52,900 --> 00:06:54,170 You want this to be a good one. 148 00:06:54,570 --> 00:06:58,140 Ideally, using Elliptical Curve Diffie-Hellman, 149 00:06:58,360 --> 00:07:00,490 so the session keys are ephemeral, 150 00:07:00,780 --> 00:07:03,090 so that if the private key is compromised, 151 00:07:03,320 --> 00:07:05,970 only small amounts of data is compromised. 152 00:07:06,200 --> 00:07:08,140 The section on Encryption covers this. 153 00:07:08,360 --> 00:07:11,720 If you remember, back to when we looked at Cipher Suites, 154 00:07:11,850 --> 00:07:15,820 we used a tool called SSL Labs, which is here. 155 00:07:16,410 --> 00:07:20,869 This doesn't scan SMTP or IMAP SSL 156 00:07:20,870 --> 00:07:23,890 mail ports unfortunately, but you can use it 157 00:07:24,190 --> 00:07:26,830 for checking port 443 for webmail. 158 00:07:27,280 --> 00:07:30,500 So for example here, I could check “ghostmail”, 159 00:07:32,540 --> 00:07:35,620 and see how their SSL/TLS stacks up. 160 00:07:36,340 --> 00:07:37,890 And here we go, A+. 161 00:07:44,580 --> 00:07:48,279 Now see, elliptical curve, RSA_WITH_AES, 162 00:07:48,280 --> 00:07:50,561 so yeah, they seem to be doing all the right things there. 163 00:07:50,660 --> 00:07:55,010 And, if you want to examine the other ports like 465, 587, 164 00:07:55,360 --> 00:07:57,570 you’ve got a few options for how you can do that. 165 00:07:58,520 --> 00:08:02,160 One with Kali, is you have SSLscan, 166 00:08:03,450 --> 00:08:04,519 and if you press Return here, 167 00:08:04,520 --> 00:08:07,880 that's just going to simply do port 443. 168 00:08:08,370 --> 00:08:10,249 But if you want to do a special port, 169 00:08:10,250 --> 00:08:11,660 you would do 465, 170 00:08:12,260 --> 00:08:16,720 so then you could look at the SMTP over TLS/SSL. 171 00:08:17,240 --> 00:08:18,440 Just press return here. 172 00:08:18,620 --> 00:08:19,500 And look at there; 173 00:08:19,570 --> 00:08:22,540 because ghostmail only has a webmail interface, 174 00:08:22,780 --> 00:08:25,859 but if they did have port 465 open, 175 00:08:25,860 --> 00:08:26,860 you could check that out. 176 00:08:27,570 --> 00:08:28,919 So here we see what we saw 177 00:08:28,920 --> 00:08:31,880 with SSL Labs, the same Cipher Suites. 178 00:08:32,410 --> 00:08:33,929 Another way of checking out the mail servers 179 00:08:33,930 --> 00:08:38,560 which I like is these guys here. 180 00:08:38,770 --> 00:08:44,010 So if we put in an email address 181 00:08:44,080 --> 00:08:47,580 of someone that you know, and we click Try, 182 00:08:48,340 --> 00:08:50,219 or if you put in even a dummy email address, 183 00:08:50,220 --> 00:08:53,379 if you put test@ghostmail, or gmail, 184 00:08:53,380 --> 00:08:56,030 or what have you, click Try, 185 00:08:56,620 --> 00:08:59,370 it communicates with the mail servers. 186 00:09:00,720 --> 00:09:01,310 It finds out 187 00:09:01,311 --> 00:09:03,039 who the mail server is for that domain, 188 00:09:03,040 --> 00:09:06,769 because it isn't always ghostmail.com, or that domain. 189 00:09:06,770 --> 00:09:07,830 So we can see here, 190 00:09:08,450 --> 00:09:11,419 we have the mail server there, that is taken 191 00:09:11,420 --> 00:09:14,079 from what’s called the MX record for that domain, 192 00:09:14,080 --> 00:09:16,620 MX is the mail record, or mail exchange record. 193 00:09:17,560 --> 00:09:18,560 And what we can see here 194 00:09:18,880 --> 00:09:20,950 is the communication with the mail server, 195 00:09:21,250 --> 00:09:23,950 you can see there, this is using STARTTLS, 196 00:09:25,700 --> 00:09:28,420 and there we can see the Cipher Suite that it uses. 197 00:09:28,890 --> 00:09:31,960 And what you’re actually seeing here is text, 198 00:09:32,000 --> 00:09:34,350 ASCII communication with that port. 199 00:09:34,820 --> 00:09:37,010 So these commands are actually being put 200 00:09:37,210 --> 00:09:39,680 into the package stream for that port. 201 00:09:40,210 --> 00:09:42,120 But I can show you an example of that. 202 00:09:44,000 --> 00:09:46,605 So let's check out maybe Gmail. 203 00:09:47,028 --> 00:09:49,039 So first of all, we need to figure out 204 00:09:49,040 --> 00:09:51,249 what the mail server address is, 205 00:09:51,250 --> 00:09:53,142 so we need to use something called “NSLOOKUP”. 206 00:09:54,217 --> 00:09:56,125 Says is doing a DNS lookup 207 00:09:56,365 --> 00:09:58,662 to check the mail exchange record, 208 00:09:59,097 --> 00:09:59,897 which will give us 209 00:09:59,965 --> 00:10:04,182 the IP address of the mail server for gmail.com. 210 00:10:07,211 --> 00:10:08,299 And there we go, 211 00:10:08,300 --> 00:10:09,599 and we can see actually they’ve got 212 00:10:09,600 --> 00:10:11,817 quite a few which is no surprise. 213 00:10:12,057 --> 00:10:15,389 So to issue text-based SMTP commands, 214 00:10:15,390 --> 00:10:17,977 we need to use some sort of tool that allows us to do that, 215 00:10:17,978 --> 00:10:20,519 we can use Telnet, we can use Netcat. 216 00:10:20,520 --> 00:10:23,954 Netcat is a tool that enables you to read and write 217 00:10:24,171 --> 00:10:27,405 to network connections using TCP and UDP. 218 00:10:27,897 --> 00:10:28,897 So if I go – 219 00:10:40,100 --> 00:10:40,640 So as you can see, 220 00:10:40,641 --> 00:10:43,577 I can just issue standard text commands. 221 00:10:45,234 --> 00:10:46,502 But that is what this is doing, 222 00:10:46,503 --> 00:10:54,950 so I must try that command. 223 00:10:58,445 --> 00:11:04,428 25. Paste. There we go. 224 00:11:04,971 --> 00:11:06,571 So we see we get the same response. 225 00:11:06,689 --> 00:11:07,794 It’s given us some options, 226 00:11:07,795 --> 00:11:08,849 therefore what we want to do. 227 00:11:08,850 --> 00:11:12,260 So STARTTLS, etc. 228 00:11:13,930 --> 00:11:15,130 So, let’s escape out of there. 229 00:11:19,300 --> 00:11:19,930 But yeah, essentially 230 00:11:19,931 --> 00:11:21,660 if we issue the same commands here, 231 00:11:22,820 --> 00:11:24,670 we are going to get the same sort of response. 232 00:11:25,890 --> 00:11:27,819 Now, moving on to Authentication. 233 00:11:27,820 --> 00:11:29,550 For Authentication, as I’ve said, 234 00:11:29,730 --> 00:11:32,790 certificates are used to verify the server, 235 00:11:32,980 --> 00:11:34,290 “is who they claim to be?” 236 00:11:34,990 --> 00:11:38,570 The email client will use his own certificate repository 237 00:11:38,660 --> 00:11:40,230 or that of the operating system, 238 00:11:40,560 --> 00:11:42,009 just the same as a browser does 239 00:11:42,010 --> 00:11:44,869 to validate that the server is who the server is. 240 00:11:44,870 --> 00:11:46,790 So that’s the same as HTTPS, 241 00:11:47,270 --> 00:11:50,170 browsing, server authentication, you know, it’s the same thing. 242 00:11:50,320 --> 00:11:51,240 And we can, of course, 243 00:11:51,241 --> 00:11:53,450 look at the certificates that are on there, 244 00:11:54,040 --> 00:11:55,999 and this is a useful site to do that. 245 00:11:56,000 --> 00:11:58,540 So if we click on “More Detail” here, 246 00:12:00,190 --> 00:12:01,310 let's have a look down. 247 00:12:02,900 --> 00:12:03,370 And there we go, 248 00:12:03,371 --> 00:12:05,171 we can see the first certificate in the chain. 249 00:12:06,383 --> 00:12:07,408 There’s the public key. 250 00:12:11,633 --> 00:12:13,166 And the certificate itself, 251 00:12:14,000 --> 00:12:16,233 and then the second certificate in the chain, 252 00:12:16,666 --> 00:12:18,232 we can see all the way down as to 253 00:12:18,233 --> 00:12:20,290 where the root certificate is. 254 00:12:21,750 --> 00:12:23,679 Client-side authentication. 255 00:12:23,680 --> 00:12:26,490 So depending on the mail client, 256 00:12:26,810 --> 00:12:29,599 you will have different options for authentication, 257 00:12:29,600 --> 00:12:31,170 so those include things like 258 00:12:31,660 --> 00:12:33,429 transmitting the password unencrypted, 259 00:12:33,430 --> 00:12:35,270 which was what was originally done. 260 00:12:35,740 --> 00:12:37,809 And then you’ve got transmitting the password encrypted, 261 00:12:37,810 --> 00:12:39,920 because you’re using SSL or TLS. 262 00:12:40,490 --> 00:12:44,330 You can do things like Kerberos or GSSAPI, 263 00:12:44,760 --> 00:12:46,679 which is something generally used 264 00:12:46,680 --> 00:12:48,560 for enterprise solutions. 265 00:12:49,100 --> 00:12:50,420 You’ve got NTLM, 266 00:12:50,540 --> 00:12:52,529 which is a Microsoft solution 267 00:12:52,530 --> 00:12:55,137 if you’re connecting to exchange servers. 268 00:12:55,714 --> 00:12:58,102 You could use TLS/SSL 269 00:12:58,360 --> 00:13:00,257 or some type of certificate 270 00:13:00,368 --> 00:13:02,200 for your client authentication. 271 00:13:02,728 --> 00:13:04,552 There’s something called OAuth2 272 00:13:04,896 --> 00:13:07,048 that you can use; but generally, 273 00:13:07,368 --> 00:13:08,583 you want to try and use 274 00:13:08,584 --> 00:13:10,494 some form of strong authentication 275 00:13:10,850 --> 00:13:13,610 or two-factor authentication if you can, 276 00:13:13,780 --> 00:13:16,920 and we covered two-factor authentication in its own section. 22244