Printable View
This is an article from school discussing email forensics. It's not about IP tracing and the like, but rather testing and comparing content and using it to verify authorship.
It includes a few different models for accomplishing this goal, and is somewhat technical, but I found it interesting. Turns out there is a lot more to email forensics than just tracing it back to a specific computer.
Maybe someone else will be interested in it.
Cheers
Very interesting. I had no idea all that was involved. Thanks for the link man. Definitely a long read :)
Boogymantroy
Interested?
Yep, that would be me!
Thanks for the link!
Interesting,
I am also interested in e-mail attachments?
As an experiment, could someone create a Microsoft Word document:
"test, test test" or something like that, zip it and attach it to their post.
If what I suspect works, I would not disclose any data, just PM the collaborator so they could post confirmation (got to do that.........no-one here would trust a lying bastard like me ::hide-beh )
Cheers
By post, do you mean emailed to you, or attached to a post here? I'm assuming you mean emailed to you... but I haven't near enough caffeine in me for logical thought yet this morning.
Another great contribution and props on adding it as an attachment.
I hope it is well written. Unfortunately I can not print it out at the current moment because the Mac I'm on does not have a working plug-in for Acrobat... :-/ I'll just have to save it at home and print it off here.
-Cheers-
Hi,
Just a small Word file zipped and attached to a post here would do.
Cheers
I think i know what you're up to nihil :) . Send me a PM and we'll discuss it
Thanks Cybr1d,
I have already sent an explanatory PM
Cheers
EDIT: It needs to have some text in it .............a blank document is harmless
You need to type in something and save it :)
Count me in too!
Had this ready yesterday but didn't know where you wanted it posted....
OK mate....I know how you got that info...everything except the user account I was logged on as.....how the hell!
one word: metadata :D
I don't know...worked fine for me.....does the metadata id the actual name of the account or the sid
I dont think it goes that far. It will leak certain information which you would rather not share :D. Be careful when you email your resume to someone :D. If they really want to look, they might find something that they wont like.
Go here and check out how to get rid of metadata.
http://support.microsoft.com/default...b;EN-US;223396
I guess every Office file uses them
Thanks for the link, Cybr1d, but I couldn't bear to wait so I asked by best friend Google!
I had no idea that much info was stored in the metadata! Bet I'll be fixing that shortly...last thing I need is another damn security leak!
Thanks..It was fun nihil!
576869746568617
That is not so difficult because the default is to save into the folder "my documents" AFAIK a unique one of these is created for each user profile? When you look at the metadata, you see the access path, which includes the user account.
Yes Cyber1d, I think that all Office documents do............even powerpoint.
Cheers
what makes it even more interesting is that microsoft knows about its risks and they acknowledge the fact thats it is indeed a vulnerability. Metadata will show deleted text, and the names of whoever edited the text. They claim its an "option" for users to use. Personally i'd prefer that option being off by default.
Cheers,
Looked at it in Hex Workshop. Damn! I had no Idea!..
yes, nihil, each user's default document directory is auto-generated from the user name by the OS. You could get around this by using a file server directory with a generic path.....If you didn't mind someone knowing the NetBIOS name of your file server instead! (that is, of course, if you didn't fix the whole metadata problem.)
Hey Guys,
Thanks for the participation :)
Cyber1d cheated by sending a blank document......but I think he knew what I was up to?
Groovicus cheated by using his school laboratory computer :D but he knows me too well!
576869746568617 I am afraid you were the "fall guy" in this experiment?
I am about to test some software that is supposed to resolve this issue..........I will naturally keep you all informed.
once again, thanks............we had some fun?
cheers
It was fun indeed...We both got a good laugh, and I was once again reminded of why I don't like Microsoft's "We must think for the end user because they can't think for themselves" policy of writing "User Friendly" software.
Is it just me, or does MS software seem to fall more into the category of "hacker friendy"? (I am referring to straight out of the box, of course!)
I think Bill should rename the company to "Phisher Price!" for all the kiddies!
EDIT: Copyright Notice: The term Phisher Price is MINE! I reserve the right to use that term, since I made it up, for use as a future handle, and for general use to piss off script kiddies when they brag about their toys, such as sub7. Damn, I'm good! :D
Exceptions: Boogymantroy, Pooh Sun Tzu, Cybr1d, nihil, groovicius, thehorse13, Memory, and any AntiOnline Senior Member, Admin or Moderator may use this term at will. All others who use this term must pay me in positive antipoints for each use ;)
nihil,
Are you refering to a tool provided/made available by M$ ? or some other Doc Scrubber?
Cheers
Hi,
I think that most software falls into that category? There seems to be an underlying assumption that it will be bought by sensible people and used for the purposes for which it was intended? Unfortunately, the real world is not like that :(Quote:
Is it just me, or does MS software seem to fall more into the category of "hacker friendy"? (I am referring to straight out of the box, of course!)
I went to a charity shop one day and bought a couple of boxes of 5.25" floppies. Amongst them I found a copy of Norton antivirus that proudly boasted that it could detect all 726 viruses (that is NOT a typo!)
I guess that malware has moved on, but legitimate software has not?
"Phisher Price" :D
Und3ertak3r,
Hi there mate!, it was just something I came across in passing, it is third party stuff. I d/ld it onto another machine
I will install and test shortly and let everyone know. I think that the one thing I would dread is mentioning software on AO and finding out that it contained something "unexpected" (Phisher Price operating systems excluded!). I guess that would destroy my "street cred"?
I need to test it?
1. Does not contain malware
2. Systems requirements/performance issues
3. Compatibility/conflict issues
4. Does the job?
I will be using a "labrat" to start then work up from there. At work we all have "reference machines" that we use to test new software and upgrades on? I do not see any difference between good practice at home and in the workplace?
Good luck to all, and I hope to get back shortly :)
Cheers