ngCERT warns businesses hackers can exploit email servers to spread malware

In a cybersecurity advisory seen by Technology Times, ngCERT said improperly configured Simple Mail Transfer Protocol (SMTP) servers could allow unauthorised users to relay emails to external recipients without compromising legitimate email accounts.

SMTP is the communication protocol used to transmit emails between mail clients and mail servers, commonly operating through TCP ports 25, 587 and 465, depending on the configuration.

According to ngCERT, an SMTP open mail relay occurs when a server allows unauthorised users to forward emails to arbitrary external recipients because of misconfigured relay settings, inadequate access controls or weak authentication mechanisms.

The cybersecurity agency warned that attackers could exploit such weaknesses to distribute malicious content through an organisation’s email infrastructure, exposing businesses to financial losses, operational disruption and reputational damage.

Potential consequences include spam and phishing campaigns, malware distribution, business email impersonation, fraudulent activities and the blacklisting of organisational internet protocol (IP) addresses and domain names.

Such blacklisting could prevent legitimate emails from reaching recipients, disrupting business communications and damaging relationships with customers, partners and other organisations.

ngCERT clarified that accepting external emails for authorised local recipients is a normal email server function and does not automatically indicate a security vulnerability. The risk arises when unauthorised users can relay messages to arbitrary external destinations.

To address the threat, ngCERT urged organisations to disable unauthorised email relaying and enforce authentication requirements and access controls on their SMTP servers.

It also recommended regular reviews of server configurations, secure email communications, email authentication mechanisms and anti-abuse controls to prevent malicious activities.

The agency further advised organisations to monitor SMTP traffic and server logs for unusual email activity, apply security patches and harden mail servers against potential exploitation.

Periodic security assessments were also recommended to identify configuration weaknesses before cybercriminals could exploit them.

ngCERT cautioned that Transport Layer Security (TLS) encryption alone does not prevent unauthorised email relaying, stressing that encryption must be complemented by appropriate authentication and relay restrictions.

While TLS protects communications by encrypting data transmitted between systems, it does not automatically establish whether a user has permission to relay messages through a mail server.

The advisory underscores the importance of securing organisational email infrastructure as businesses increasingly depend on digital communications for transactions, customer engagement and the exchange of sensitive information.

Organisations that fail to properly secure their mail servers risk providing cybercriminals with infrastructure for distributing malicious emails, potentially affecting their operations and the wider email ecosystem.

Tweet11Share3SendShare Oladapo Riliwan Technology Times Reporter [email protected]

Zenith Bank’s sixth Tech Fair will open on Thursday, November 5, with artificial intelligence (AI),…

Nigerian businesses and organisations have been warned about Gazavat, a multifunctional Windows malware capable of…

Lotus Bank has warned employees against entering confidential, personal or customer information into unapproved artificial…

The Lagos State Infrastructure Maintenance and Regulatory Agency (LASIMRA) has given ipNX, FibreOne, 21st Century,…

Nigeria is targeting nearly 20 million people in underserved communities with the deployment of 3,700…

Nigerian universities have been urged to translate artificial intelligence (AI) research and scientific discoveries into…

Nigeria’s cyber police has warned software developers and engineers about a cyber-espionage campaign in which…

Lagos State is investing $22 million to develop a unified 6,000-kilometre digital network, a major…

The Lagos State Lotteries and Gaming Authority has given mobile network operators, value-added service (VAS)…

The Securities and Exchange Commission (SEC) has warned Nigerians against investing through WayvePay, saying the…

Your email address will not be published. Required fields are marked *

Save my name, email, and website in this browser for the next time I comment.

Founded in 2004, Technology Times’ trusted technology news, market intelligence, views and business services reach readers and partners across Nigeria, Africa and beyond.

WhatsApp: +234 201 454 1818 WhatsApp: +234 815 700 0100 Email: [email protected] Web: www.technologytimes.ng

Please enter your username or email address to reset your password.