Secure Mailer Bolsters Aging E-Mail Infrastructure
The rapid permeation of e-mail into the fabric of society has immeasurably facilitated correspondence, both business and personal. Unfortunately, large volumes of these electronic messages threaten the integrity of security protocols designed prior to e-mail's phenomenal popularity.
IBM has not been idle in addressing the need for a sturdier e-mail infrastructure, introducing Secure Mailer late last year. Secure Mailer is open source software designed to improve the security, reliability and performance of e-mail delivery services.
"By offering Secure Mailer free without licensing restrictions, IBM is helping build a stronger base for secure e-business," says Jeff Jaffe, general manager for IBM's IT Security.
Available for download from IBM's alphaWorks Web site at www.ibm.com/alphaworks, Secure Mailer was designed using what IBM Research refers to as "defensive programming" techniques, to enable the program to avoid operations and assumptions that could make it vulnerable to intruders, system errors and malformed or suspicious e-mail.
Messaging systems are comprised of Mail User Agents (MUAs), which send and request mail from users to their designated mail server, and Mail Transfer Agents (MTAs), which deliver mail to and from the various servers on a network.
Secure Mailer is designed to be different from MTA, which is used to process the majority of e-mail today. MTA technology originated in the early ‘80s and "was not designed with today’s Internet traffic and security in mind," according to Wietse Venema, an IBM researcher who developed Secure Mailer. According to Venema, the majority of e-mail -- more than one billion messages sent daily worldwide -- is processed by MTA technology.
Send Mail is the main mail agent, or MTA, used today, according to David Safford, manager of IBM Research’s Global Security Analysis Lab (Hawthorne, N.Y.). "Send Mail is a server-side package, the plumbing of mail as it's routed across the Internet," he says. "About 70 percent of all mail across the Internet is routed currently by Send Mail."
Secure Mailer is designed to be a "drop in" replacement for Send Mail, which is a freeware package originally delivered as part of Unix, according to Safford. "It is a reengineering of that original concept," he says. "IBM is initially targeting Send Mail users, primarily on Unix, with Secure Mailer. As such, the introduction of Secure Mailer is expected to affect ISPs, medium-to-large companies and universities."
Send Mail’s architecture makes it "somewhat difficult to make it bulletproof, both in terms of malicious attacks or even simple overloading by e-mail traffic," Safford points out. "Rather than failing or allowing people to break in, Secure Mailer is much more robust."
Send Mail and Secure Mailer differ in design. Send Mail is one very large, complex program that has to perform tasks such as routing and delivering mail. Some of these operations involve a very high level of privilege on the machines, according to Safford. "For this reason, Secure Mailer is broken up into a series of smaller programs, each of which does a very limited thing," he says. "If there is a problem with it, you have a problem only with one small part, not with the whole system. We’re able to limit the privilege of each of these parts to a very, very small extent. Even if a hacker is able to exploit a bug in one of the parts, you can’t take over the whole system."
IBM’s Global Security Analysis Lab, also referred to as IBM ethical hackers, is charged with the task of finding and fixing security vulnerabilities in systems, applications or protocols. "We’re very good at breaking into systems," Safford says. "As a result we’ve learned techniques to help make systems harder to break in. The idea behind Secure Mailer is to bring these techniques to bear on the issue of Internet mail."
Over the years, there have been a number of security vulnerabilities found in Send Mail, an average of four per year, Safford says. "That causes customers a lot of problems in having to keep up to date, exposures to hackers and – as we move into the e-business area – we certainly want to provide our customers with the secure solutions for e-business."
IBM decided to release Secure Mailer as open source code, allowing the online community decide how to steer the technology, with regard to the types of platforms available out of the box. Secure Mailer can be run on a variety of platforms, with some modification.