5

My father-in-law asked me for ideas to improve his email security. He read an article about how some hackers, having gained access to a Gmail account, were able to reset the account holder's passwords for other services, such as Amazon.

This is what I've come up with so far, but more brainpower would really help as I've never thought of this before, so all critique and suggestions will be warmly welcome.

Starting Point: He has a website hosted on a LAMP / cPanel system, and his current email goes through the website's domain. The email account is set up in cPanel. He retrieves his email via pop3, deleting it from the server. I'm thinking this might be a decent starting point? No need for iMap as he only has one computer (no iPhone) and he deletes it as he goes?

Next Steps:

  1. I am thinking to get him to set up several address forwarders on his cPanel: one for his bank, one for Amazon---basically one for each of the few accounts that are linked to a bank or a credit card. These forwarders would all forward to one central address, also set up in cPanel, which would be "private", in the sense that he would not use it to send emails. He would only use it to retrieve email via pop3.

  2. Also thinking of getting him to can store his email on his computer on an encrypted virtual drive using TrueCrypt.

With this set-up it seems to me the messages are vulnerable in a few places:

  • in transit from Amazon to his server, than from his server to his computer. Not much we can do about that as his bank or Amazon are not going to send him encrypted email.
  • while stored on his cPanel LAMP set-up. I wonder how safe (unsafe) that is. If it was a shared host I'd be very worried. Being a VPS it might be a little safer. But still... Someone could hack in... How likely is that?
  • on his computer, if someone gains access while he is logged in and the virtual drive is mounted.

Big thanks in advance, looking forward to your thoughts.

UPDATE: SUMMARY OF REPLIES SO FAR

How lucky, several thoughtful and detailed replies came in so far. Summarizing the replies so far.

Using the Web

  • His router should be hardened, for example disallowing the Internet remote management console. Be mindful of the fact that a hack could reveal his IP address and ISP login password.
  • Use long and complex passwords that are unique to each on-line account that he uses. Strong passwords (16 characters or more)
  • Creating different email accounts off one domain for different services: Pros: prevents the "Epic Wired hacking". Cons: increases the number of vulnerable nodes Use a secure browser. For Firefox, see Top 10 Best Firefox Security Add-ons, esp. noscript

Retrieving Messages (Thunderbird)

  • Use SSL
  • PGP encryption for sensitive correspondence (requires the counterpart to have a key)

Local Machine

  • Firewall
  • A good anti-virus suite is also a must.
  • Disable unused network services
  • Encryption => Applications leak an unbelievable amount of data throughout the whole system in caches and logs, rendering a solely encrypted local mailbox somewhat irrelevant. If you encrypt, Truecrypt the whole drive.

Hardening the Server

  • Uninstall every unessential service or product that may listen or access the Internet and more.
  • Grsecurity or a similar system to prevent buffer overflow attacks
  • He should login to his webserver using its IP address and not the domain-name which can redirect him elsewhere: If a DNS server is hacked, then when browsing he could find himself confronted with a login page to any website or even his own server that is an exact duplicate of the real page.

Fischer's Set-up

(Special category as Fischer's workflow is different system from the other replies)

  • If you don't know how secure your lamp server is, host it on outlook.com instead (free)
  • Forward all email accounts to GmailAC#1 and delete from server
  • After reading, PGP-encrypt messages and forward to GmailAC#2
  • Retrieve via Thunderbird
1
  • I'm not familiar with cPanel, but you should enable multi-factor authentication if they offer such feature. This will significantly reduce the chance of unauthorized access to his account. GMail has this feature, amongst other security features such as account activity logging.
    – happy_soil
    Sep 24, 2013 at 9:58

3 Answers 3

3
+50

This is a complex question, but putting together a simple system to protect your father-in-law's confidential information should not be that difficult.

Your first suggestion of using separate addresses for separate services probably won't make much of a difference. If someone (say, Mallory) is intercepting email in the network, then they can probably intercept any forwards you make; therefore all services are vulnerable to attack if you are using only one domain for all accounts. Mallory can simply search for any emails containing *@example.com in the To field and assume they're all being forwarded to the hidden address. Just knowing what the email address for a given account on a given service is gives Mallory an advantage, as that's what is authenticated to the service and that's what she will use to compromise it. Even creating email accounts off your domain simply increases the number of vulnerable nodes.

One way that you can considerably improve security is by enabling SSL for all protocols on the mail client used to fetch from the server. That way you eliminate at least one vulnerable hop where Mallory can intercept the plaintext of the emails. Also, contrary to what you've stated, it is very likely that sensitive services are using SSL to send you mail via SMTP, or that you can enable that somehow.

That's the most you can do on the network end. If the service refuses to use SSL-SMTP, it's probably not going to be very secure at all. There's a lot you can do to improve security on the local end, however. You should take standard precautions such as creating a firewall and disabling unused network services, as well as making sure that all your passwords are strong (16 characters or more). The LAMP server can be hardened with Grsecurity or a similar system to prevent buffer overflow attacks. Creating a virtual encrypted drive is of dubious utility, seeing as that unless you want your email to be undeliverable 90% of the time, the drive must be unlocked for you to receive it. Picture a physical mailbox with a padlock!

The local system presumably being used to retrieve email from the server using (SSL-)POP3 can be hardened as well if it's Linux. If you're serious about local security, the whole drive should be TrueCrypted (it's not actually on standby waiting for mail all the time) because applications leak an unbelievable amount of data throughout the whole system in caches and logs, rendering a solely encrypted local mailbox somewhat irrelevant.

So there's a little you can do for the network, a lot you can do for the server, and more you can do for the local system. Remember that the weakest part of your whole security system is the passwords.

1
  • Thank you for your thoughtful and detailed reply! I learned a lot from it. Summarized all suggestions so far at the bottom of the post. One question: I now understand the "cons" of multiple email addresses. On the "pros" side, if his Amazon email and password gets captured somehow, that helps with the "Epic Wired Hacking". Which wins, pros or cons?
    – zx81
    Sep 22, 2013 at 21:17
1

I'm not a security expert, nor a bounty hunter, but this question is open for 2 days and no answer, i'll see if i can help.

Lets starts with the basics, the first thing that comes to mind when securing an email account is using gpg. Before i start, I assume that your lamp server is secured and you have ssh and all, you just need an architecture to keep your mails safe. I strongly recommend using outlook free mail hosting if you don't know how secure your lamp server is.

So that's my idea:

  1. you create different email account for each service: [email protected], [email protected]

  2. you create a gmail account, lets call it [email protected], we will use it later (you really have to use gmail not another service).

  3. all the mails that he receives will be forwarded to the the gmail we created, and you set a cron job his other mail accounts ([email protected] and others) to delete mail. I believe you don't need a cron job, when adding [email protected] to gmail accounts in the settings, just uncheck "leave a copy on the server"

  4. what we have so far is amazon@example sends to gmail and the message isn't left on the server, it's stored in gmail only. This step is we go to gmail settings and we configure it to send as [email protected], so now it receive from that account and sends also. Do that for all the other accounts, we want to send and receive from gmail to all the other accounts.

  5. Step 5 is easy, create another gmail account, lets call it [email protected]

  6. step 6, configure gpg between [email protected] and [email protected], but don't connect them, like we did in step 4.

  7. link [email protected] with thunderbird or any email client that you like, link the other gmail too.

  8. Now all the mails arrive at [email protected], after reading the mails and replying, encrypt the message using gpg and send it to fischer, and delete it from gmail (this isn't an automated process, because you can't encrypt a message and send it to amazon).

  9. now all your messages are encrypted and stored in fischer's mailbox, download them using thunderbird or whatever and encrypt the hard drive.

Bonus steps

I insisted on using gmail, because you can secure it using sms

Change passwords regularly, if you can't remember them use lastpass + yubikey

1
  • Thank you for your detailed reply! You've put a lot of thought into a clever system. My father-in-law doesn't want to go anywhere near Google services as he doesn't trust them... But I've summarized all suggestions including yours at the bottom of the post.
    – zx81
    Sep 22, 2013 at 21:19
1

The security breaches your father has read about have used two vulnerabilities :

  1. Using the same password on gmail and on other less-secure on-line services, so once having breached the other service the hacker gained access also to gmail.
  2. A phishing or DNS attack succeeded in either convincing the target to hand over his password or install a virus/trojan on his computer.

In your father's case, he has four weak points :

  1. Himself
  2. His web server
  3. His ISP (or ISPs if his web server uses a different one)
  4. The DNS servers used by himself and his web server

The first point can be strengthened by using long and complex passwords that are unique to each on-line account that he uses, as well as changing them periodically (something like every few months). The subject of secure passwords has been extensively treated on the Internet. His router should also be hardened, for example disallowing the Internet remote management console.

Your father should also use a secure browser (which doesn't include Internet Explorer) and install in it several security extensions while being careful about Java. For Firefox, see Top 10 Best Firefox Security Add-ons of which I absolutely recommend NoScript (WOT is not as good as is described). A good anti-virus suite is also a must.

His server should also be hardened as regarding passwords, uninstalling every unessential service or product that may listen or access the Internet and more. Again, the subject of hardening a Linux server has been extensively treated on the Internet.

For his ISP, he should be mindful of the fact that a hack could reveal his IP address and login password, although the damage there will only be minimal since he doesn't use the email server of his ISP.

If a DNS server is hacked, then when browsing he could find himself confronted with a login page to any website or even his own server that is an exact duplicate of the real page. His password will then be recorded and control will pass seamlessly to the real page. He should login to his webserver using its IP address and not the domain-name which can redirect him elsewhere, and in general be alert to any glitches that may arrive.

Final word: The best protection for your father is in being unimportant enough, so as to not attract attention from the real hackers. This is because there are too many attack vectors and no way of protecting against them all. However, being careful he at least can protect himself against script-kiddos and the occasional random attack.

1
  • Thank you very much for your thoughtful and detailed reply! I learned a lot from it. Summarized all suggestions so far at the bottom of the post.
    – zx81
    Sep 22, 2013 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .