08 - Electronic Mail Security

Theory: Electronic mail security, Pretty Good Privacy, S/Mime, DNSSEC,
DKIM, DMARC, SPF

PGP installation and investigation

PGP can encrypt and sign e-mails and documents.

Mail client Thunderbird (https://www.mozilla.org/thunderbird/) has built-in support for PGP (OpenPGP – see https://support.mozilla.org/da/kb/introduction-to-e2e-encryption). Thunderbird works well for Windows and it also works for Linux and MAC.

If you do not want to install a new mail client (Thunderbird), a solution for Outlook on Windows is to get GnuPG from www.gpg4win.org. You might need to look in the GnuPG Howto at https://gnupg.org/documentation/howtos.html to understand the concepts.

9.1

9.1) Install newest Thunderbird or get GnuPG installed for your Outlook mail client.

9.2

9.2) Generate certificate as personal key pair (public and private keys).

9.3

9.3) Write an e-mail, encrypt, and sign it and send it to yourself.

9.4

9.4) Receive an encrypted and signed e-mail from yourself and decrypt and verify the signature.

9.5

9.5) Export and send your public key to another student by e-mail.

9.6

9.6) Send and receive e-mails to/from him/her (the other student in 9.5 above).

9.7

9.7) Try to sign the public keys from other PGP users you know

DNSSEC

9.8

9.8) Try out the DNSSEC analysing tool at https://viewdns.info/dnssec/.

Try to investigate a few domains. Many domains have not yet been signed with DNSSEC, but try hostmaster.dk or dr.dk. Which records have actually been signed?

9.9

9.9 Try to investigate the pcap file at https://github.com/the-tcpdump-group/tcpdump/blob/master/tests/dnssec.pcap by means of Wireshark and identify DNSSEC related resource records. Study what they contain.

DMARC, SPF & DKIM

9.10

9.10) Try to analyse dtu.dk, hostmaster.dk and dr.dk domains by means of tools at https://easydmarc.com/tools/. What do you see and what are your conclusions?

9.11

9.11) Try out the composite Phishing Score Card at https://www.phishingscorecard.com. Figure out how situation is in a few different countries.