Exploring Current E-mail Cyber Threats using Authenticated SMTP Honeypot

Lukáš Zobal, Dušan Kolář, Jakub Křoustek

2020

Abstract

Today, spam is a major attack vector hackers use to cause harm. Let it be through phishing or direct malicious attachments, e-mail can be used to steal credentials, distribute malware, or cause other illegal activities. Even nowadays, most users are unaware of such danger, and it is the responsibility of the cybersecurity community to protect them. To do that, we need tools to gain proper threat intelligence in the e-mail cyber landscape. In this work, we show how an e-mail honeypot requiring authentication can be used to monitor current e-mail threats. We study how such honeypot performs in place of an open relay server. The results show this kind of solution provides a powerful tool to collect fresh malicious samples spreading in the wild. We present a framework we built around this solution and show how its users are automatically notified about unknown threats. Further, we perform analysis of the data collected and present a view on the threats spreading in the recent months as captured by this authentication-requiring e-mail honeypot.

Paper Citation

in Harvard Style

Zobal L., Kolář D. and Křoustek J. (2020). Exploring Current E-mail Cyber Threats using Authenticated SMTP Honeypot.In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT, ISBN 978-989-758-446-6, pages 253-262. DOI: 10.5220/0009591002530262

in Bibtex Style

@conference{secrypt20,
author={Lukáš Zobal and Dušan Kolář and Jakub Křoustek},
title={Exploring Current E-mail Cyber Threats using Authenticated SMTP Honeypot},
booktitle={Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,},
year={2020},
pages={253-262},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0009591002530262},
isbn={978-989-758-446-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - Volume 3: SECRYPT,
TI - Exploring Current E-mail Cyber Threats using Authenticated SMTP Honeypot
SN - 978-989-758-446-6
AU - Zobal L.
AU - Kolář D.
AU - Křoustek J.
PY - 2020
SP - 253
EP - 262
DO - 10.5220/0009591002530262