1 1 00:00:00,990 --> 00:00:02,910 Email Server Security. 2 2 00:00:02,910 --> 00:00:04,710 In this lesson, we're going to start talking 3 3 00:00:04,710 --> 00:00:06,840 about some of the security measures that you can implement 4 4 00:00:06,840 --> 00:00:08,670 on your email servers. 5 5 00:00:08,670 --> 00:00:09,990 Now, the first thing you have to think about 6 6 00:00:09,990 --> 00:00:12,360 is that spoofing attacks can be mitigated 7 7 00:00:12,360 --> 00:00:16,050 by configuring authentication for your email server systems. 8 8 00:00:16,050 --> 00:00:17,490 And there's a couple of ways to do this 9 9 00:00:17,490 --> 00:00:19,530 and we're going to talk about those in this lesson. 10 10 00:00:19,530 --> 00:00:24,530 We have things like SPF, DKIM, DMARC, and Cousin Domains. 11 11 00:00:25,230 --> 00:00:27,600 Let's talk about each of these as we go through this lesson. 12 12 00:00:27,600 --> 00:00:31,140 First, SPF, or the Sender Policy Framework. 13 13 00:00:31,140 --> 00:00:33,270 This is a DNS record that identifies 14 14 00:00:33,270 --> 00:00:36,270 the host authorized to send mail for the domain, 15 15 00:00:36,270 --> 00:00:37,920 and there's only going to be one allowed 16 16 00:00:37,920 --> 00:00:39,750 for each and every domain. 17 17 00:00:39,750 --> 00:00:40,770 Now, as you look at them, 18 18 00:00:40,770 --> 00:00:42,420 you're going to have something that looks like this. 19 19 00:00:42,420 --> 00:00:45,180 And this is a DNS record called a TXT record. 20 20 00:00:45,180 --> 00:00:49,320 You'll notice it has the @, and then says v=spf1, 21 21 00:00:49,320 --> 00:00:51,570 which is Sender Policy Framework 1. 22 22 00:00:51,570 --> 00:00:52,950 It's the first one. 23 23 00:00:52,950 --> 00:00:55,800 It then has mx, which is the mail server record. 24 24 00:00:55,800 --> 00:00:59,490 And then it says, include:_spf.google.com, 25 25 00:00:59,490 --> 00:01:04,140 and include:email.freshdesk.com -all. 26 26 00:01:04,140 --> 00:01:05,670 Now, what is this telling you? 27 27 00:01:05,670 --> 00:01:09,360 Well, this is actually the SPF record for my email server. 28 28 00:01:09,360 --> 00:01:11,610 Now, why do we have google.com there? 29 29 00:01:11,610 --> 00:01:13,590 Well, it's because we use G Suite from Google 30 30 00:01:13,590 --> 00:01:15,570 and so Google is our email service provider. 31 31 00:01:15,570 --> 00:01:16,890 We don't run our own email server. 32 32 00:01:16,890 --> 00:01:18,300 Instead, we let them do it. 33 33 00:01:18,300 --> 00:01:20,070 And we've given them authorization to do that, 34 34 00:01:20,070 --> 00:01:22,410 that they are authorized to send email on our behalf 35 35 00:01:22,410 --> 00:01:24,480 by including that SPF statement. 36 36 00:01:24,480 --> 00:01:25,927 Now, the second one there, you might be wondering, 37 37 00:01:25,927 --> 00:01:26,940 "What's that for? 38 38 00:01:26,940 --> 00:01:28,410 I thought you could only have one?" 39 39 00:01:28,410 --> 00:01:30,930 Well, you can only have one SPF statement 40 40 00:01:30,930 --> 00:01:33,180 but this entire thing is one line 41 41 00:01:33,180 --> 00:01:34,530 when written in DNS. 42 42 00:01:34,530 --> 00:01:37,020 And this whole thing from TXT all the way to all 43 43 00:01:37,020 --> 00:01:40,050 is one single line, and that is one single SPF statement. 44 44 00:01:40,050 --> 00:01:42,900 I can authorize multiple servers to send on my behalf 45 45 00:01:42,900 --> 00:01:46,680 but I can only do it in one DNS line as you see here. 46 46 00:01:46,680 --> 00:01:49,170 And what Freshdesk is is our trouble ticket system. 47 47 00:01:49,170 --> 00:01:51,030 If you email support@diontraining, 48 48 00:01:51,030 --> 00:01:52,770 it's going to go to Freshdesk. 49 49 00:01:52,770 --> 00:01:55,980 But if you email my personal email @diontraining, 50 50 00:01:55,980 --> 00:01:57,270 it's going to go over to Google 51 51 00:01:57,270 --> 00:02:00,510 because that's who does our personal emails for our company. 52 52 00:02:00,510 --> 00:02:02,130 And so you have to include both of those 53 53 00:02:02,130 --> 00:02:03,720 and anything else that's going to be authorized 54 54 00:02:03,720 --> 00:02:06,660 to send on your behalf inside this statement. 55 55 00:02:06,660 --> 00:02:09,000 Now, what is this SPF statement really doing? 56 56 00:02:09,000 --> 00:02:10,980 Well, when you receive an email from me, 57 57 00:02:10,980 --> 00:02:14,100 your server is going to go and check the DNS record. 58 58 00:02:14,100 --> 00:02:16,260 And it's going to say, "Does the email address, 59 59 00:02:16,260 --> 00:02:18,990 the envelope return header that I have, that return path, 60 60 00:02:18,990 --> 00:02:21,570 when I look that up, does it match one of the servers 61 61 00:02:21,570 --> 00:02:23,460 inside of this mail record?" 62 62 00:02:23,460 --> 00:02:25,500 If it does, you're authorized to receive it 63 63 00:02:25,500 --> 00:02:27,210 and it's likely not spam. 64 64 00:02:27,210 --> 00:02:28,650 If it doesn't, that means somebody 65 65 00:02:28,650 --> 00:02:30,030 might be trying to spam my domain 66 66 00:02:30,030 --> 00:02:31,770 and pretend they're me sending it to you. 67 67 00:02:31,770 --> 00:02:33,480 And this is all done in the background 68 68 00:02:33,480 --> 00:02:36,990 by your email service provider before you get my emails. 69 69 00:02:36,990 --> 00:02:38,340 Now, the next thing we need to talk about 70 70 00:02:38,340 --> 00:02:40,860 is D-K-I-M, or DKIM. 71 71 00:02:40,860 --> 00:02:43,350 Now, this is DomainKeys Identified Mail. 72 72 00:02:43,350 --> 00:02:45,990 This provides a cryptographic authentication mechanism 73 73 00:02:45,990 --> 00:02:49,980 for mail using a public key published as a DNS record. 74 74 00:02:49,980 --> 00:02:52,290 Now, when you look up an SPF or DKIM, 75 75 00:02:52,290 --> 00:02:54,060 you're going to see something like this. 76 76 00:02:54,060 --> 00:02:57,240 Here's an example showing you the mail for adobe.com. 77 77 00:02:57,240 --> 00:02:58,650 You can see the DMARC at the top, 78 78 00:02:58,650 --> 00:02:59,850 which we'll talk about in a minute, 79 79 00:02:59,850 --> 00:03:02,130 you'll see the SPF, which we just talked about, 80 80 00:03:02,130 --> 00:03:03,030 and then you'll see DKIM, 81 81 00:03:03,030 --> 00:03:04,740 which is what we're talking about now. 82 82 00:03:04,740 --> 00:03:08,430 Notice DKIM looks like Base64 encoding, essentially. 83 83 00:03:08,430 --> 00:03:11,640 It's basically a very long cryptographic authentication key, 84 84 00:03:11,640 --> 00:03:13,710 and you can see it there on the screen. 85 85 00:03:13,710 --> 00:03:17,970 Now, DKIM can either replace or be used with SPF. 86 86 00:03:17,970 --> 00:03:19,680 Now, once you've configured DKIM, 87 87 00:03:19,680 --> 00:03:20,760 what ends up happening 88 88 00:03:20,760 --> 00:03:23,010 is that when you send an outgoing email, 89 89 00:03:23,010 --> 00:03:25,890 your domain MTA is actually going to calculate a hash value 90 90 00:03:25,890 --> 00:03:27,840 of the selected message headers. 91 91 00:03:27,840 --> 00:03:31,110 It's then going to sign that hash using its private key. 92 92 00:03:31,110 --> 00:03:34,170 Now, this key here is what's known as your public key. 93 93 00:03:34,170 --> 00:03:35,910 And so when you send this message over, 94 94 00:03:35,910 --> 00:03:38,040 it has that hash value that's been encrypted. 95 95 00:03:38,040 --> 00:03:40,380 When it gets it, it's going to decrypt that hash value, 96 96 00:03:40,380 --> 00:03:42,480 it's going to run your headers through the hash again, 97 97 00:03:42,480 --> 00:03:43,740 and compare the two. 98 98 00:03:43,740 --> 00:03:44,970 If they match, 99 99 00:03:44,970 --> 00:03:47,070 that means then nothing was modified in transit 100 100 00:03:47,070 --> 00:03:48,720 and they can trust that message. 101 101 00:03:48,720 --> 00:03:51,210 Essentially, it's like a digital signature for an email 102 102 00:03:51,210 --> 00:03:53,130 but this is done by the servers, 103 103 00:03:53,130 --> 00:03:54,810 not by the individual account. 104 104 00:03:54,810 --> 00:03:57,330 And so you're verifying that the server actually sent it, 105 105 00:03:57,330 --> 00:03:59,490 not that the person actually sent it. 106 106 00:03:59,490 --> 00:04:02,070 That's the idea here when you deal with a DKIM. 107 107 00:04:02,070 --> 00:04:03,960 The next one we're going to talk about is DMARC. 108 108 00:04:03,960 --> 00:04:06,960 And DMARC is the Domain-Based Message Authentication, 109 109 00:04:06,960 --> 00:04:08,760 Reporting, and Conformance. 110 110 00:04:08,760 --> 00:04:10,170 This is basically a framework. 111 111 00:04:10,170 --> 00:04:11,280 And this framework is used 112 112 00:04:11,280 --> 00:04:14,460 for ensuring proper application of SPF and DKIM, 113 113 00:04:14,460 --> 00:04:17,700 utilizing a policy that's published as a DNS record. 114 114 00:04:17,700 --> 00:04:19,110 And I showed you that very briefly 115 115 00:04:19,110 --> 00:04:20,910 in the last image on your screen 116 116 00:04:20,910 --> 00:04:23,490 when I showed you the DMARC as the top line of that image. 117 117 00:04:23,490 --> 00:04:24,990 If you want to go back and take a look at that, 118 118 00:04:24,990 --> 00:04:26,640 you can at this time. 119 119 00:04:26,640 --> 00:04:28,050 Now, when you're dealing with DMARC, 120 120 00:04:28,050 --> 00:04:30,030 you can use this either with SPF, 121 121 00:04:30,030 --> 00:04:32,220 with DKIM, or using both. 122 122 00:04:32,220 --> 00:04:33,053 Because remember, 123 123 00:04:33,053 --> 00:04:35,130 SPF and DKIM don't have to be used together, 124 124 00:04:35,130 --> 00:04:37,320 you can use one, or the other, or you can use both. 125 125 00:04:37,320 --> 00:04:40,680 And DMARC is going to be used with one, the other, or both. 126 126 00:04:40,680 --> 00:04:41,970 Now, when you're dealing with DMARC, 127 127 00:04:41,970 --> 00:04:43,350 this is what it looks like. 128 128 00:04:43,350 --> 00:04:45,600 So how does all of this work together? 129 129 00:04:45,600 --> 00:04:48,415 Well, first, you have to make sure that your SPF, 130 130 00:04:48,415 --> 00:04:52,020 your DKIM, and your DMARC are all on the DNS server. 131 131 00:04:52,020 --> 00:04:53,490 Once you have all those records there, 132 132 00:04:53,490 --> 00:04:55,560 that's what starts this whole process. 133 133 00:04:55,560 --> 00:04:57,210 Now, once you've done that once, 134 134 00:04:57,210 --> 00:04:58,620 everything else is going to follow up 135 135 00:04:58,620 --> 00:05:00,870 each and every time you want to send a message. 136 136 00:05:00,870 --> 00:05:03,570 In this example, we're going to have two messages being sent. 137 137 00:05:03,570 --> 00:05:05,040 One from the SMTP server, 138 138 00:05:05,040 --> 00:05:07,290 which is authorized and being shown as green, 139 139 00:05:07,290 --> 00:05:09,990 and one from an adversary who's trying to spoof your domain, 140 140 00:05:09,990 --> 00:05:11,580 which is going to be shown in red. 141 141 00:05:11,580 --> 00:05:13,620 Let's start with the one that's authorized. 142 142 00:05:13,620 --> 00:05:15,360 Here's listed as 2A. 143 143 00:05:15,360 --> 00:05:18,840 Your sender is going to send that message over to the MTA. 144 144 00:05:18,840 --> 00:05:21,930 It goes to the MTA, which is your message transfer agent, 145 145 00:05:21,930 --> 00:05:23,670 and it's going to end up taking that message 146 146 00:05:23,670 --> 00:05:26,430 with the SPF or DKIM header in it. 147 147 00:05:26,430 --> 00:05:28,110 Now, let's stick with this message for a minute 148 148 00:05:28,110 --> 00:05:29,940 and then we'll come back to the adversary. 149 149 00:05:29,940 --> 00:05:32,160 Once the MTA has that message, 150 150 00:05:32,160 --> 00:05:34,170 it's going to go ahead and look at that message 151 151 00:05:34,170 --> 00:05:35,700 and process that message. 152 152 00:05:35,700 --> 00:05:36,840 When it does that, 153 153 00:05:36,840 --> 00:05:39,840 part of that is going to be looking up the sender DMARC policy 154 154 00:05:39,840 --> 00:05:42,930 and the SPF and DKIM records via DNS, 155 155 00:05:42,930 --> 00:05:43,763 just like we talked about 156 156 00:05:43,763 --> 00:05:45,630 in the last three or four minutes here. 157 157 00:05:45,630 --> 00:05:48,900 Now, once the MTA does that, if it's legitimate, 158 158 00:05:48,900 --> 00:05:51,660 that message can be placed into the receiver's mailbox 159 159 00:05:51,660 --> 00:05:52,980 on the IMAP server 160 160 00:05:52,980 --> 00:05:54,900 and wait for the person to be able to read their message 161 161 00:05:54,900 --> 00:05:56,610 using their mail user agent. 162 162 00:05:56,610 --> 00:05:59,070 That's all good because they know this message was authentic 163 163 00:05:59,070 --> 00:06:03,060 because it compared those values against the SPF, the DKIM, 164 164 00:06:03,060 --> 00:06:05,670 or the DMARC based on the policy that was set up. 165 165 00:06:05,670 --> 00:06:07,350 Now, if we look at the adversary on the other hand, 166 166 00:06:07,350 --> 00:06:09,900 when they send the message, it still goes to the MTA 167 167 00:06:09,900 --> 00:06:12,780 because it has to get to the MTA to get to that end user. 168 168 00:06:12,780 --> 00:06:13,650 Once it gets there though, 169 169 00:06:13,650 --> 00:06:16,410 the MTA's going to check it versus that DMARC policy, 170 170 00:06:16,410 --> 00:06:18,900 looking at the SPF or DKIM records. 171 171 00:06:18,900 --> 00:06:21,000 Once it does that, if they don't match, 172 172 00:06:21,000 --> 00:06:23,117 it's going to reject that message, delete it, or quarantine it, 173 173 00:06:23,117 --> 00:06:26,310 and it throws it away, as you could see in 5B. 174 174 00:06:26,310 --> 00:06:28,260 Again, this is the way this stuff works. 175 175 00:06:28,260 --> 00:06:32,040 And by using this DKIM, DMARC, and SPF together, 176 176 00:06:32,040 --> 00:06:35,130 we can add some security into our organizations. 177 177 00:06:35,130 --> 00:06:37,950 Now using SPF, and DKIM, and DMARC 178 178 00:06:37,950 --> 00:06:41,250 does not solve the problem of cousin domains though. 179 179 00:06:41,250 --> 00:06:43,260 Now, what's a cousin domain you might ask? 180 180 00:06:43,260 --> 00:06:46,500 Well, a cousin domain is a Domain Name System domain 181 181 00:06:46,500 --> 00:06:48,210 that looks similar to another name 182 182 00:06:48,210 --> 00:06:50,490 when it's rendered by a mail user agent. 183 183 00:06:50,490 --> 00:06:51,540 Now, what I mean by that 184 184 00:06:51,540 --> 00:06:52,980 is if you get something that looks very similar 185 185 00:06:52,980 --> 00:06:54,120 to your real domain. 186 186 00:06:54,120 --> 00:06:57,000 For instance, here I have diontraining.com, 187 187 00:06:57,000 --> 00:06:58,500 which is my website. 188 188 00:06:58,500 --> 00:06:59,760 Now, a cousin domain to that 189 189 00:06:59,760 --> 00:07:02,880 might be something like diontrainimg.com. 190 190 00:07:02,880 --> 00:07:05,430 Notice the last N has now been changed to an M, 191 191 00:07:05,430 --> 00:07:07,440 making it diontranimg.com. 192 192 00:07:07,440 --> 00:07:09,180 If you were going through your email very quickly, 193 193 00:07:09,180 --> 00:07:10,380 you may not notice the difference 194 194 00:07:10,380 --> 00:07:11,880 'cause they look very similar. 195 195 00:07:11,880 --> 00:07:15,150 Or maybe you get something like this, diontraning.com. 196 196 00:07:15,150 --> 00:07:16,200 I dropped one of the I's. 197 197 00:07:16,200 --> 00:07:18,150 And again, it looks very similar. 198 198 00:07:18,150 --> 00:07:19,770 And so if you're not looking carefully, 199 199 00:07:19,770 --> 00:07:22,620 and I set up that domain to be a cousin domain, 200 200 00:07:22,620 --> 00:07:24,120 I buy that domain name, 201 201 00:07:24,120 --> 00:07:26,370 I actually set up DKIM records for it, 202 202 00:07:26,370 --> 00:07:28,740 and SPF records, and DMARC policy for it, 203 203 00:07:28,740 --> 00:07:31,470 your MTA is going to think that is a legitimate email. 204 204 00:07:31,470 --> 00:07:32,370 And it is. 205 205 00:07:32,370 --> 00:07:33,570 It's a legitimate email 206 206 00:07:33,570 --> 00:07:37,500 from diontraning.com, not diontraining.com, 207 207 00:07:37,500 --> 00:07:39,540 and so that would be one of the issues. 208 208 00:07:39,540 --> 00:07:41,250 Alternatively, you might get an email like this, 209 209 00:07:41,250 --> 00:07:43,230 looks like support@diontraining.com. 210 210 00:07:43,230 --> 00:07:44,063 Great. 211 211 00:07:44,063 --> 00:07:47,460 Or is it look like this, support@deiontranimg.com. 212 212 00:07:47,460 --> 00:07:49,500 Again, they both look very similar. 213 213 00:07:49,500 --> 00:07:51,150 And if you're not paying close attention, 214 214 00:07:51,150 --> 00:07:53,400 somebody can use that as a way into your organization 215 215 00:07:53,400 --> 00:07:55,980 because it will pass the MTA's verification 216 216 00:07:55,980 --> 00:07:59,040 against the DMARC policies, the SPF, and the DKIM 217 217 00:07:59,040 --> 00:08:00,890 if they sent those records correctly.