Hacker News Reader

Comment by upofadown | Hacker News Reader

It would be interesting to know exactly how one could get owned by running just an email server. It's been forever since there has been any server that could be attacked with just SMTP. IMAP has a login, as does that buggy PHP webmail program.

There just isn't much of an attack surface there.

The real problems are spam and convincing other mail servers to accept your email.

View on HN

There have been remote code execution exploits in mail servers before, Exim most recently. There probably are more hiding somewhere in one of the many layers that are needed for modern email servers.

That isn't difficult to manage though, unless you consider running any server to be insecure. Use your distribution's MTA package and turn on automatic security updates. Done.

Unless they are too slow, then you get to pick up the pieces.

Since a server is a much juicier and visible target than any client, expect attacks.

> Since a server is a much juicier and visible target than any client, expect attacks.

Why do you think that?

Isn't a web browser that has access to your gmail inbox just as juicy as your self-hosted imap server?

I don't really see why a "server" would somehow be inherently a more interesting target. Google's servers, sure, they give you acess to billions of mailboxes, but your own private email server?

I would presume the moment an adversary gains control of the server, his first order of business is to disable things like that.

How is that different from any other type of server?

AFAIKT, "recently" in this case is 2012. There was something in 2014 but it was for a non-default experimental feature.

Reply on news.ycombinator.com