The Anti-virus Times

Thursday, December 1, 2016

People often store important information in their mailboxes—and therein lies a certain danger. Mail frequently becomes inaccessible due to hardware faults and failures, services getting shut down, or mail providers finding something suspicious…

How can we securely store information we’ve exchanged via email?

First, let's try to determine what puts our correspondence at risk.

We won’t examine what happens when users create their own mail servers. In terms of information security, such endeavors only work out well when the users involved are information security specialists. Unfortunately, most people aren’t. Let’s suppose that our mailbox is located on a remote server (most likely, on a mail service), and that it doesn’t matter what service we use—the risks are generally the same for all of them.

So, the risks are as follows:

1. Your computer could be infected. Here, it’s important to acknowledge the fact that the risk of any commercial secrets being leaked is low (so long as you weren’t singled out for an attack). Intruders are primarily interested in passwords to various services and gaining access to your films/videos and photos. Most intruders are only interested in what they can sell, the quicker the better. Information that may be of interest to just one or two buyers worldwide is of no value to them.

   Important! In this case, we’re talking exclusively about an accidental infection of an ordinary user’s computer. If we were talking about a company network, it’s quite possible that the attackers would collect totally different information, for example, data related to the network’s structure so they can spread malware in it.

   As criminals sift through our correspondence, what types of things might interest them?

   1. Credit card information. Sometimes multiple people use the same credit card, so it is quite possible to find the credit card number, the cardholder’s name, the card expiry date, and the CVV.
   2. Attackers can easily collect addresses from email or instant messenger databases to sell them to spammers. Email accounts don’t just facilitate access to a mail archive with all its secrets, including bank account passwords. Once in control of an account, an intruder can request many passwords on your behalf and on behalf of your friends, and quite possibly obtain them.
   3. Social network accounts. These are valuable to attackers because they can be used to distribute spam internally on social networks for various fraud schemes (for example, requests to transfer money); to increase traffic, “likes,” and other relevant advertising indicators; and to steal other accounts belonging to the same user (because the same passwords were used).
   4. Online game accounts. Once they’ve obtain access to such accounts, attackers can move valuable virtual objects out of virtual worlds and into the real world.
   5. Personal photos. These can be sold or used for blackmail.
   6. Saved films and distributions (if anybody still saves them). Reports of films being leaked before their release are not uncommon.
   7. Passport information.
2. Correspondence can be intercepted during transmission. In wired networks this is highly improbable (although this method is used for targeted attacks), but entirely possible for wireless networks.
3. Fraudulent schemes that go through a technical support service can be used to hack a mail service or steal a mailbox.