Skip to main content

Email spoofing

Need​

Implementation of DMARC records to prevent email spoofing

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.mail for sending and receiving emails in Java
  • Usage of javax.mail.internet for handling email communication

Description​

Non compliant code​

import javax.mail.*;
import javax.mail.internet.*;

public class EmailSpoofing {

    public static void main(String[] args) {
        String to = "[email protected]";
        String from = "[email protected]";

        Properties properties = System.getProperties();
        properties.setProperty("mail.smtp.host", "localhost");

        Session session = Session.getDefaultInstance(properties);

        try {
            MimeMessage message = new MimeMessage(session);
            message.setFrom(new InternetAddress(from));
            message.addRecipient(Message.RecipientType.TO, new InternetAddress(to));
            message.setSubject("This is a test email");
            message.setText("This is a test email body");

            Transport.send(message);
            System.out.println("Email Sent successfully....");
        } catch (MessagingException mex) {
            mex.printStackTrace();
        }
    }
}

The above code is a simple example of how to send an email in Java using the javax.mail package. However, this code is vulnerable to email spoofing because it does not implement any form of email validation or protection such as DMARC (Domain-based Message Authentication, Reporting & Conformance).

Here, the from email address is manually set to [email protected], and there is no check to ensure that the email was actually sent from this address. An attacker could change this from address to any email they wish to impersonate, and the receiver would have no way of knowing that the email had been spoofed.

Furthermore, the SMTP server is set to localhost, which means that the email is sent from the local machine. In a real-world scenario, the SMTP server would be a remote server. If this server does not have DMARC configured, it would not be able to verify that the from email address is legitimate, further enabling email spoofing.

In conclusion, the absence of email validation and protection mechanisms such as DMARC in this code makes it vulnerable to email spoofing.

Steps​

  • Implement DMARC (Domain-based Message Authentication, Reporting, and Conformance) records for the email domain.
  • Configure the email server to enforce DMARC policies.
  • Enable SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to authenticate outgoing emails.
  • Implement email validation mechanisms to verify the sender's identity.
  • Educate users about email spoofing and phishing techniques to prevent falling victim to such attacks.

Compliant code​

import javax.mail.*;
import javax.mail.internet.*;

public class EmailSpoofing {

    public static void main(String[] args) {
        String to = "[email protected]";
        String from = "[email protected]";

        Properties properties = System.getProperties();
        properties.setProperty("mail.smtp.host", "localhost");
        properties.setProperty("mail.smtp.auth", "true");
        properties.setProperty("mail.smtp.starttls.enable", "true");

        Authenticator auth = new Authenticator() {
            protected PasswordAuthentication getPasswordAuthentication() {
                return new PasswordAuthentication("username", "password");
            }
        };

        Session session = Session.getInstance(properties, auth);

        try {
            MimeMessage message = new MimeMessage(session);
            message.setFrom(new InternetAddress(from));
            message.addRecipient(Message.RecipientType.TO, new InternetAddress(to));
            message.setSubject("This is a test email");
            message.setText("This is a test email body");

            Transport.send(message);
            System.out.println("Email Sent successfully....");
        } catch (MessagingException mex) {
            mex.printStackTrace();
        }
    }
}

The above code is a revised version of the original code that was vulnerable to email spoofing due to the absence of DMARC records. The changes made to the code are as follows:

  1. SMTP Authentication: The properties for SMTP authentication and starttls are set to true. This ensures that the email client will authenticate before sending emails.

  2. Authenticator: An Authenticator object is created which overrides the getPasswordAuthentication method to provide the username and password for authentication.

  3. Session: The Session.getInstance method is used instead of Session.getDefaultInstance. This ensures that a new session is created with the provided properties and authenticator.

Please note that this code only demonstrates the client-side changes that can be made to prevent email spoofing. To fully secure your email domain against spoofing, you should also:

  • Implement DMARC (Domain-based Message Authentication, Reporting, and Conformance) records for the email domain.
  • Configure the email server to enforce DMARC policies.
  • Enable SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to authenticate outgoing emails.
  • Implement email validation mechanisms to verify the sender's identity.
  • Educate users about email spoofing and phishing techniques to prevent falling victim to such attacks.

References​

Last updated on