Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Port 143 (IMAP): what it is, how it is attacked and how to secure it

In one sentence: Port 143 is the door that email programs use to read and manage mail that stays on the server, and its plain version sends the login unprotected.

What runs on this port

IMAP, the Internet Message Access Protocol, lets a mail program work with messages that stay on a server. RFC 9051, the current version (IMAP4rev2), describes it as allowing a client to access and manipulate messages on a server, with mailboxes that behave like local folders.

That is why phones, laptops and webmail can all show the same inbox.

RFC 9051 states that an IMAP4rev2 server listens on port 143 (the cleartext port) or port 993 (the Implicit TLS port). With Implicit TLS, encryption starts as soon as the connection opens. On port 143, a client can ask to upgrade with the STARTTLS command.

Why attackers look for it

An internet-facing mail login can be tried at any hour. A taken-over mailbox gives the attacker the whole mail history, the ability to send as the owner, and the password reset links for other services.

Older mail protocols are also a gap in your defences. Microsoft says Basic authentication makes it easier for attackers to capture credentials, particularly if they are not protected by TLS, and that enforcing MFA is not simple or in some cases possible while it remains enabled.

How it gets attacked

  • Password guessing and spraying against exposed logins.
  • Clear text on port 143. If a client does not upgrade the connection, the login travels unprotected. RFC 8314, titled Cleartext Considered Obsolete, recommends TLS for mail access.
  • MFA gap. Legacy protocols do not always support a second factor.
  • Server software flaws. CVE-2019-18928: the National Vulnerability Database (NVD) records that Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allowed privilege escalation because an HTTP request could be interpreted in the context of an earlier, unrelated request. It scored 9.8 on CVSS v3.1.
  • Application flaws that call IMAP. CVE-2018-19518: the NVD records that the University of Washington IMAP Toolkit, used in PHP’s imap_open(), could allow command execution if the server name came from untrusted input. The lesson is never to pass user input into a mail connection setting.

Who it affects and how badly

  • Sole trader to 10 staff: your inbox is your business. Worst case: a stolen mailbox is used to send fake invoices to your clients.
  • 10 to 50 staff: accountancy, legal and estate agency firms where mail holds identity documents and payment details.
  • 50 to 250 staff: recruitment, charity and school offices with shared mailboxes and many devices.
  • Regulated businesses: a compromised mailbox with personal data can become a reportable breach.

How to check whether yours is exposed

  • Read firewall rules for inbound TCP 143 and 993.
  • Ask your mail provider or MSP whether IMAP is enabled for each mailbox.
  • In Microsoft 365, remember that Basic authentication for IMAP has been removed in Exchange Online, and check which apps depend on IMAP.
  • Review sign-in logs for failed or unusual logins.
  • Run the free web vulnerability scan and review the results for your own addresses.

How to secure it

  1. Use only IMAP over TLS on port 993 (RFC 8314), and close port 143 to the internet.
  2. Use modern authentication with multi-factor authentication instead of passwords alone.
  3. Turn IMAP off for mailboxes and apps that do not need it.
  4. Use long, unique passwords, with throttling or lockout for repeated failures.
  5. Keep any self-hosted mail server updated, and apply fixes for known exploited flaws first.
  6. Never pass user-entered text into a mail server setting (the PHP issue above).
  7. Review sign-in and mailbox rule changes regularly.
  8. Move to a managed mail service if you cannot patch your own.

Related terms

Frequently asked questions

What ports does IMAP use?
RFC 9051 states a server listens on port 143 (cleartext) or port 993 (Implicit TLS).

What is the difference between IMAP and POP3?
RFC 9051 describes IMAP as working with messages on the server, so every device sees the same mailbox.

Does Microsoft 365 allow IMAP with a password?
Microsoft says it removed Basic authentication for IMAP in Exchange Online, so apps must use modern authentication.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.