Somebody has been reading my email!

I need tips on email security

[Timotheos]

I have a web site on a shared apache server. It's very apparent that somebody is successfully hacking into my partners emails to try and get damaging personal info (nothing illegal). We only know this because these email show up in unexpected places.

I've contacted my web host and they see no problems on the server side of things. Is there something I could look into at the server side?

We've been naive about this in the past and have not used any encryption or anything. I have no idea how these emails are being hacked but it's time to get smart :-)

So my question is where to start?

I'm checking into digital IDs and encryption. I'm still a bit vague on this stuff. Any good tutorials? What's the best to use?

Should I be concerned about trojans? We have virus detection but do we need some other way to check for hacker tools?

Any other suggestions would be great.

[Mardi_Gras]

Do you have any idea if the hacking is taking place on your mail server or on your local machine? Are these person to person mails or mails generated off of a web site?

[juniperwasting]

You might want to look into PGP [pgpi.org]. Personal Email encryption with some very good history.

[Mardi_Gras]

I think it is more important at this point to find out where the intrusion is taking place. If it is mails being sent to the partner that are being hacked, then encryption on the outgoing side won't make any difference. Not that using PGP is not a good idea...

[juniperwasting]

I think it is more important at this point to find out where the intrusion is taking place.

Agreed, but adding security right now could help with that investigation.

[Timotheos]

Hi there and thanks for the help.

These are person to person emails generated using Outlook Express. The email is POP3.

So the PGP plug-in looks cool. I'll look into it more.

I'd love to know were the intrusion is coming from but I just have no idea. I only have confirmation of emails sent to my partner as being hacked but I have recently become suspicious of my email being read as well.

[Mardi_Gras]

Unless the sender encrypts the message using PGP, encryption won't stop anyone from reading mail sent to you.

How big is your organization? The easiest way for this to happen is someone snooping on your machine when you're not around.

Also, have you changed all of your e-mail passwords in case a former employee or consultant (yours or your ISP's) has your passwords?

[Timotheos]

We're a small non-profit organization so all this is done from our homes. My partner at one time had access to the web site but since this started taking place (months ago now) I changed the password and didn't let him back on since he doesn't do any of the web development. So we've kept it to two people who have full access and the other developer is completely honest.

I'm not ruling out that my partners machine has been compromised. He's just half-way around the world so it's hard for me to check up on it. I'm going to be writing up a bunch of suggestions for him like making good passwords, using PGP, etc.

[BaseVinyl]

I don't understand how you can tell someone is hacking your email? You said the emails were turning up in strange places...where did you find them?

[Timotheos]

The hacker obtains some confidential email from my partners email. The hacker then passes that on to other interested parties using anonymous email. These other parties then question my partner. They know the source is questionable but by then the damage is done. Simple enough to figure out eh?

[BaseVinyl]

Indeed!

[Timotheos]

Question on PGP. Do you have to pay for a key service or is there some sort of free public database? I'm still vague on the concept of keys and how they work.

[bill]

You can distribute your PGP keys on a number of key servers, all free to my knowledge. Your keys will eventually propagate from server to server. The purpose of having your public key on a server is so that others can lookup your key and add it to their keyring. It would be just as easy to e-mail your key to others if you have a finite list of contacts you intend to share encrypted mail with...

You need to pay for the PGP software for corporate use. (There are free versions available for personal use). The new PGP 8.x software is very stable and integrates well into Outlook (not available for free versions).

[MonkeeSage]

There is a free, opensource version of PGP developed under the GNU license (GPG), which is supposed to be as good as PGP.

Jordan

[Mardi_Gras]

It would be just as easy to e-mail your key to others

Don't forget - his e-mail system has been hacked at some point ;)

[bill]

...but sharing a public PGP key is a non issue unless the 3rd party can get their hands on his private key. I guess if he was really paranoid he could put his key on a floppy and mail it ;)

Seriously though, a public key is useless to someone reading this guy's mail. Get the full PGP package, encrypt your mail and encrypt your disks and there will be few if any people on this planet who have the time and resources to delve into your communications again.

There's a great PGP FAQ maintained by Tom McCune [mccune.cc] if you want to read more.