E-mail Address Spoofing?

Printable View

April 6th, 2004, 10:57 AM
apollovega

E-mail Address Spoofing?

Hello, Quickj Noob question. I was wondering if it were possible to spoof someones e-mail account to send out fake e-mails. The reason why I ask is because I keep getting these Virus e-mails from a person(s) using my domain name's e-mail addresses.. I know it's not an actual e-mail address (since I'm the only person who can authorize a new e-mail account), but it's starting to make me worry. Specially if someone spoof's my e-mail address to get someone else's information (password, etc).

Here's a copy and paste of the Entire Message Source..

Quote:

Return-path: <>
Envelope-to: [email protected]
Delivery-date: Tue, 06 Apr 2004 03:40:59 -0400
Received: from mailnull by server1.hostingplex.com with local (Exim 4.24)
id 1BAlCd-0004be-1E
for [email protected]; Tue, 06 Apr 2004 03:40:59 -0400
X-Failed-Recipients: [email protected]
Auto-Submitted: auto-generated
From: Mail Delivery System <[email protected]>
To: [email protected]
Subject: Mail delivery failed: returning message to sender
Message-Id: <[email protected]>
Date: Tue, 06 Apr 2004 03:40:59 -0400

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
This message has been rejected because it has
a potentially executable attachment "pub_document.pif"
This form of attachment has been used by
recent viruses or other malware.
If you meant to send this file then please
package it up as a zip file and resend it.

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from [213.146.32.134] (helo=lib05.com)
by server1.hostingplex.com with smtp (Exim 4.24)
id 1BAlCc-0004bL-OZ
for [email protected]; Tue, 06 Apr 2004 03:40:58 -0400
Date: Tue, 06 Apr 2004 16:44:13 +0100
To: [email protected]
Subject: Re: Thanks :)
From: [email protected]
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="--------jlrspmphjmfuedckcial"

----------jlrspmphjmfuedckcial
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<html><body>
Read the attach.<br><br>

<br>
</body></html>

----------jlrspmphjmfuedckcial
Content-Type: application/octet-stream; name="pub_document.pif"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pub_document.pif"

----------jlrspmphjmfuedckcial--

Anyways, I have no idea what to do.. If *anyone* can help me in any way I'd appreciate it so much.

Edit: Please note that I did NOT send any e-mails (nor any of my friends with their e-mail accounts) like this before. I never sent any message with the subject "Re: Thanks :)"
April 6th, 2004, 12:32 PM
mightysuraj

Appolo,

One can spoof email addresses, if he knows the mail server of the domain, and has and idea as to how it is configured.
There are methods of telneting and sending spoofed emails...

I think, in spoofed emails one cannot specify the "From : " NAME.
So if the incoming message contains "From : " and "only the email address",but no name, then there are chances that it is a spoofed email.

Hope that helps.
Cheers.
April 6th, 2004, 12:44 PM
MrLinus

Actually, in this case it's likely a virus that is mimicking return emails (some of them create "fake" email failure messages). IIRC, this particularly one -- based on attachment -- looks like a Beagle/Bagle variant. Viruses have gotten good at creating fake emails based on addresses found in address books of Outlook. One thing that helps is looking at the header info and seeing if your IP address is there.

Just delete is the best answer.
April 6th, 2004, 12:51 PM
SirDice

It's really, really, really easy to spoof an email. Everyone with half a braincell and a couple of instructions can do it. Why anyone would blindly "trust" an email is just beyond me. Without additional tools (pgp i.e.) you just cannot be 100% certain.
April 6th, 2004, 03:09 PM
kruptos

Hellos,

First off- yes it is really easy to spoof email addresses. You can generally do it in about 5 minutes with now experiance if you have a tutorial :-)

But on a different note, I noticed in the source information you posted the below statement:

"This message has been rejected because it has
a potentially executable attachment "pub_document.pif"
This form of attachment has been used by
recent viruses or other malware."

This seems to be a typical virus as MsMittens already mentioned, the good thing is that it was caught by the mail server and you should be ok.

At work here we get eamil all the time from clients addresses that look similar, I have even had several sales people call the sender and say...."Hello, you sent me a virus..." well duh!

Unfortunatly this is just a waste of resources and time for the typical end user, and a good cash cow for the anti-virus companies....

Hope this provides a littel insight.

Thanks!
April 7th, 2004, 01:45 AM
apollovega

I see, Thanks everyone :-D.
So basically someone (if they wanted) could spoof an e-mail from me with this attachment and have people (who think I actually sent it) open it up and get a virus? Assuming that they're not too bright with computers..
April 7th, 2004, 02:04 AM
MrLinus

Quote:

So basically someone (if they wanted) could spoof an e-mail from me with this attachment and have people (who think I actually sent it) open it up and get a virus? Assuming that they're not too bright with computers..

Yup. Or in some cases "[email protected]" ("here is the latest patch for your machine to protect you against Bagle. Double click to install"). It's a form of social engineering. But it's now an automated form as it's part of the virus' propagation technique.
April 8th, 2004, 02:47 AM
s33ka

If I remember correctly youcan spoof an e-mail using eudore or is it pegasus mail both are free download e-mail clients etc, as far as the telnet scen goes its just a case of

telnet
open somejunkaddy.com 25

read this if you really want to know

http://user.7host.com/phuka/philes/2-hack.txt

and take it from there I wont go into details but you can figure it out from that point just by typpinh help normally.

I regulary send e-mail's from

Code:

[email protected]

("No guessing where that came from") every Xmas to my boys and my friends children, I can get away with it because I use my own linux box to do it, but as you can see it is incredably simple to do.
April 8th, 2004, 06:49 AM
apollovega

I see.. So e-mail spoofing is possible.. Is there any way to track who sends it?
Thanks for your guys' help.
April 8th, 2004, 08:38 AM
SirDice

Quote:

Originally posted here by apollovega
I see.. So e-mail spoofing is possible.. Is there any way to track who sends it?

Yes, you can, well, almost.. If you trace the Received: headers you can find out the ip address that send the email. By using the IP you can find out which ISP (whois info).
April 8th, 2004, 12:43 PM
mightysuraj

Heyy,

What I feel is that Spoofin in Hotmail is easier... using telnet
In yahoo, I think we need 2 telnet .... 'n follow a different procedure...

What do u think ??

Thanx.
April 8th, 2004, 01:17 PM
SirDice

Mightysuraj: I'm not quite following you. Both hotmail and yahoo are HTTP based emailproviders. We're talking about SMTP here.
April 8th, 2004, 01:31 PM
PM8228

SirDice. Look up Eigth Wonder they have/had a spoofer using Hotmail. They used to have a server (mail.hotmail.com I think) you could telnet into and send mail from. Maybe it is still up but I have not tried to use it in a while. Yahoo! probably has or had the same type of thing. In the end headers can tell you most everything, although if they sent it from Yahoo! or what not you are going to have to have them check the logs which they probably won't do.

-Cheers-
April 8th, 2004, 02:22 PM
mightysuraj

Sir Dice,

I waz talkin' of telneting to mx servers of hotmai (mx1.hotmail.com) is possible ... but telnetting and spoofing yahoo(eg. mx2.mail.yahoo.com) isn't possible by the same method ... Maybe mx*.mail.yahoo.com is configured differently .. Why is it not possible ? ... Or is it in some other way ??

Thanx.
April 8th, 2004, 03:38 PM
SirDice

Pm & mighty: you're both talking about (open) relaying which is an entirely different ballgame.
April 8th, 2004, 05:27 PM
PM8228

Lol. I don't necessarily understand all of it, just that it's out there and people use that. Spammers use open relay as I understand as well.

-Cheers-
April 9th, 2004, 03:16 AM
Computernerd22

Quote:

Hello, Quickj Noob question. I was wondering if it were possible to spoof someones e-mail account to send out fake e-mails.

Yes. A simple telnet session:

* telnet to port 25 of any web server
* type: mail from: [email protected]
* type: rcpt to: [email protected]
* type: data
* type: your message here
* type: .

This is also easy to trace back to the orignal sender.

Quote:

The reason why I ask is because I keep getting these Virus e-mails from a person(s) using my domain name's e-mail addresses.. I know it's not an actual e-mail address (since I'm the only person who can authorize a new e-mail account), but it's starting to make me worry. Specially if someone spoof's my e-mail address to get someone else's information (password, etc).

Contact your ISP at [email protected] or close or [email protected] Hope this helps User.
April 9th, 2004, 04:52 AM
mightysuraj

Can anyone explain How do u trace back the original sender ??
April 9th, 2004, 05:20 AM
Computernerd22

You have to read the headers. There are also 3rd party software that will inspect all e-mail spam such as spam investigator you can find it at www.webattack.com or www.download.com btw, SMTP port 25 isnt secure at all very vulnerable about 92% of them allow anonymous connections. :p