深入剖析电子邮件及其在电子商务应用中的若干安全问题 - 网络安全焦点.doc

深入剖析电子邮件及其在电子商务应用中的若干安全问题 作者：axis（ph4nt0m） 来源：幻影旅团（ HYPERLINK ） EMAIL： HYPERLINK mailto:axis@ axis@ 2003.6.12 本文着重介绍电子邮件在电子商务中的应用，至于电子支付等手段虽然也属于电子商务，但是由于内容上基本不涉及电子邮件，所以这里略去。 首先我们看一次sniff的过程，它将向我们展示在INTERNET中传输的电子邮件的确是不安全的。 测试环境： windows2000 advanced server foxmail4.2 IRIS 首先我们用foxmail来发一封邮件，其间用EEYE的安全产品IRIS来嗅探整个过程，监听端口：25 用IRIS抓下了整个过程，decode出如下结果 220 zzymail6 (IMail 7.11 14811-1) NT-ESMTP Server X1 EHLO darkdeamon 250-zzymail6 says hello 250-SIZE 0 250-8BITMIME 250-DSN 250-ETRN 250-AUTH LOGIN CRAM-MD5 250-AUTH=LOGIN 250 EXPN AUTH LOGIN 334 VXNlcm5hbWU6 YXhpc0BwaDRudDBtLm5ldA== 334 UGFzc3dvcmQ6 cWhxxxxxxxxx ----》这里是我的密码，所以我替换掉了！ 235 authenticated MAIL FROM: SIZE=2237 250 ok RCPT TO: 250 ok its for Data 354 ok, send it; end with . From: =?GB2312?Q?=B4=CC?= To: whq_jimmy@163.com Subject: test X-mailer: Foxmail 4.2 [cn] Mime-Version: 1.0 Content-Type: text/plain; charset=GB2312 Content-Transfer-Encoding: quoted-printable Date: Thu, 12 Jun 2003 15:59:9 +0800 whq_jimmy=A3=AC=C4=FA=BA=C3=A3=A1 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa= aaaaaaaaaaaaaaaaaaaaaaaaaa