EmailTCP 143, 993 Cleartext by default
Port 143, 993: IMAP
Internet Message Access Protocol
Accesses mail kept on the server. 143 is cleartext or STARTTLS; 993 is IMAP over TLS.
Secure alternative: IMAPS (993)
How attackers abuse it
- Credential capture on 143.
- Password spraying against mail accounts that bypass MFA via legacy protocols.
How to defend it
- Require 993.
- Disable legacy authentication so MFA cannot be bypassed.
Exam tip
Legacy mail protocols with basic authentication are a common MFA bypass.