-1

To put the long story short: we discovered someone is able to access some of our "secret" links we do send to our clients over email. The links are highly secured with hashes, extremely difficult to guess them.

We do suspect someone is able to sniff our emails sent out from a postfix server. Is this possible? If so, what should we check on our Ubuntu 16.04 / 18.04 servers in order to find out more.

7
  • Depends on your configuration and whether or not the emails are sent in an encrypted way or not.
    – Tommiie
    Feb 15, 2019 at 10:55
  • 1
    The question itself is stupid. To put it simply: Noting is 100% secure on the internet and everything can be cracked, hijacked. I've wrote you some scenarios and an idea what to do but the most important thing, you should take some IT Security Lessons.
    – Bert
    Feb 15, 2019 at 11:06
  • If the links are hashes, MD5 , SHA etc. but the input to the hash function is not random data but for instance a customer number, transaction number etc. (without a random salt) or other predictable data; then the hashes values will be completely predictable too.
    – HBruijn
    Feb 15, 2019 at 11:06
  • 2
    @Bert, thanks. Usually, no question is stupid, there are only stupid answers :). This is what one of my professors was saying and I do support his opinion. The question was more on where to start digging. Feb 15, 2019 at 11:38
  • @HBruijn, thanks. As said, the links are almost impossible to guess. There are also completely custom links the attacker is able to find and access. Feb 15, 2019 at 11:39

2 Answers 2

1

Nothing is 100% secure on the internet, I've learned that working with the local NSA Cyber Defence team. :) To put it straight: OFC someone can.

Option 1: The email got caught In this scenario, simply one of the many gateways got interfered and told to send a copy of your email to the possible attacker.

Option 2; Your server is insecure This is simple. Your server got penetrated and somebody simply sendin all the email to himself as well. I would check maillog, secure log, messages log from the time when a possibly "hacked" email was sent. Also enhance your security. If you do not use SMTP, you only use sendmail, then hide every IP you have open and make special firewall rules. Also use fail2ban to kick off all the SSH attacker. Use SSH-Key pairs to access your server, etc.... ok, I'll stop here otherwise I'll have to send you the bill. :D

Option 3; The client mailbox is hacked This is, in my mind, the most obvious. The clients mailbox, who you send your sensitive data to, got hacked and simply somebody else can read all the messages. Change password, use 2 step verification, etc, and see if your information is still getting leaked out.

Bonus: Use encrypted emails You can always use encrypted emails, however I don't know how to use that with sendmail. For Thunderbird and a dozen of android apps there is a plugin that uses https://www.openpgp.org/ and you can encrypt your email and the receiver can only read it if he has the other pair of your encryption key. Otherwise, even if an attacked hijacks your email and reads it, all he could see is random bullsh*t and good luck decrypting that.

5
  • Thanks @Bert, The 3 options looks like potential fields I can dig more in: Option 1: For this option, I need to check the Postfix mail logs, count number of received emails by recipient and check if an unknown email address commes to the top. Checkd and all looks ok on this side; Option 2: This will require more time to investigate, will follow up with some findings; Option 3: Not possible: There is no single client, there are tens of thousand of clients, and while cheking, no connection was made between compromised URLs, the clients are totally different, the compromised URLs also. Feb 15, 2019 at 12:50
  • 2
    Option 4: Something like an antivirus/malware/spam scanner is automatically accessing the links as part of its normal functionality.
    – ceejayoz
    Feb 15, 2019 at 13:59
  • @ceejayoz, thanks. Your idea is that this might be running on server or client (recipient) side? Feb 15, 2019 at 15:01
  • Could be either. Depends on the nature of the clicks you're seeing. Log accesses to those URLs and take a look at the IPs and user agents.
    – ceejayoz
    Feb 15, 2019 at 16:10
  • No, we do not have this installed on the server side. When checking the IP, it looks like an already bad reputation IP registered in Canada. Feb 18, 2019 at 9:46
0

As already described, it is possible that e-mails may fall into the hands of an attacker during transmission.
The cases mentioned by Bert also seem plausible. However, I think it is more likely that the web server or an application that works with these links is misconfigured. For example, indexing is enabled or a vulnerability is exploited that allows these secret links to be found on the server. I can't say much more about this with the current information. It would be helpful to know how valuable these links could be for an attacker. Social engineering and co-employees are additional factors.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .