eudora bug used to send spoofed mail

There is a bug found in Eudora version 6.2.1.2.The bug has been used for sending spoofed mails.Normally a client is used to send mails via the smtp server provided by his ISP or by the mail server used by yahoo,hotmail etc.In some cases where a user wants to send the mail via his own readymade smtp server such as postcast server he/she can use the Eudora email client to send the spoofed email.The problem even get worsed as the domain name from which the email pretends to be come from can also be spoofed.The "message ID" part in the header can also be spoofed to look the email as if it has come from the pre guessed or fake domain.The person willing to send the spoofed mail has to configure the Eudora installation in a way to send the fake mail.The address of the smtp server filled in the box can be pointed to the name of the postcast server(which may be the name of the computer).Suppose the name of someone's computer is 'xct123' and the person is willing to send the mail on behalf of domain whitehouse.gov.The user will as fill Eudora entry where it says the 'smtp server' with whitehouse.gov and will send the mail but as it is obvious the mail will fail and results in a undelivered error in Eudora.Now the bug in the Eudora lies in the fact that those messages which are undelivered are queued up for further delivery. This is the exploit used for sending the spoofed mail.In his next attempt the user will change the smtp server name to 'xct123' (which is also the name of the postcast server) and the same mail via Eudora again with postcast server running.?Now unfortunately bothe the message i.e the even the previous message which was initially targeted to whitehouse.gov will also be delivered to postcast server.Now the latter email can be deleted from the postcast server and when this message is sent then it will be delivred and if anyone will look into the headers of the message it will look like something this in the message ID :
Let us say that I want to send the mail to Myself(pushmohit@gmail.com) from Britney Spears(say britneyspears@hollywood.com).The header which I recieve at my gmail account is :

Header:
*************************************************************************
X-Gmail-Received: 1a5687cd502d5376ec2d97b439de07d55e691837
Delivered-To: pushmohit@gmail.com
Received: by 10.54.32.30 with SMTP id f30cs40971wrf;
Wed, 22 Jun 2005 18:35:44 -0700 (PDT)
Received: by 10.38.207.73 with SMTP id e73mr611151rng;
Wed, 22 Jun 2005 18:35:44 -0700 (PDT)
Return-Path: <britneyspears@hollywood.com>
Received: from 0.0.0.0 ([221.134.238.40])
by mx.gmail.com with SMTP id 79si898642rnc.2005.06.22.18.35.42;
Wed, 22 Jun 2005 18:35:44 -0700 (PDT)
Received-SPF: neutral (gmail.com: 221.134.238.40 is neither permitted nor denied by best guess record for domain of britneyspears@hollywood.com)
Message-Id: <6.2.1.2.2.20050623070417.01ddfcc0@hollywood.com>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.1.2
Date: Thu, 23 Jun 2005 07:04:53 +0530
To: pushmohit@gmail.com
From: britney <britneyspears@hollywood.com>
Subject: hi mohit britney here
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed

the first spoofed mail
**************************************************************************

yet the IP remians legit, and most blaklists consist of IP addresses. Some use domain names, but few since they are so easily spoofed. Doesnt changing the from field in out look do the same thing as this?

Thanks XCT46 for your reply.you are a senior member of antionline and your every post must be respected.
As you r suspicious about ip but as much as i know the ip can also be spoofed and that can further strengthen our email spoofing.The ip spoofing article has been published in the phrack magazine article:The article has been written by by daemon9 / route / infinity

Yes the same can be achieved by using the from field in outlook but how would u configure the domain name spoofing.The hollywood.com in the message id will not appear.(I think so)

You cant spoof your IP while maintaining an SMTP connection. As far as I knew the only way to spoof your IP was with connectionless protocals, or something like that. You cannot maintain a connection with a spoofed ip.

Lets say you send a spoofed packet to smtp.ev1.net, spoofing your IP as 207.212.22.45. That SMTP server is going to send the responce to that IP address. Do you see what im saying?

yes the IP can be spoofed, but it would be a hell of a lot more complicated then what you are doing. You are just changing the return path, wich would sort of be spoofing, but not a very effective way. Bu the point remains the same that you are completly missing the point of this site. Now why dont you post a reply on how to DEFEND aganist this type of deception. Yes, to protect against something its good to know how to do it, but this IS a security site, include the secuirty portions and you will be accepted into the community much better (and not get negged) and people will give what you say more credit.

So the mail has already been queued with whitehouse.gov as the domain name, but is then later sent to a different SMTP server if I understand correctly?

This has always been possible with mail servers. They ask for the domain name your are sending mail from but generally do not verify this. So the vulnerability has always existed in the SMTP protocol and numerous mailservers, but Eudora has provided a way to do it with a fancy GUI.

Defending against this would be no different than defending against any other spoofed mail. Either use Sender Policy Framework, which will check that the server sending the mail IS actually in the whitehouse.goc domain, or if in doubt, check the stamps each mailserver places on the email as it travels through them. If a mail claiming to be from whitehouse.gov has no mailserver stamp from that domain, it is likely the mail was spoofed.

This may make it easier for script kiddies to send spoofed mail, however, the underlying principles have been used by spammers and investigators for years. Sufficient defense mechanism should already be in place.

Striek,
Yes, I know that the defenses should be there. My point was his posts are absolutley useless unless he goes full circle with them and explains the security side of the event. I want him to stop posting the easy skript kiddie side of things (just like his last post) and get more in to why these things work, if he doesnt do that then he may as well not post. Even if it is old.

Since this:-

Quote:

---

221.134.238.40

---

is there in the header there are no significant security issues with this. You are traceable, period. Furthermore, I agree with XTC, stop wasting your bandwidth and ours with this stuff. The only real use you can put this to is playing pranks on your friends.

as XTC pointed out the same can be done with outlook or any mail client using your os's smtp server or an open relay as long as your not worried about being traced.

so whats wrong with someone posting something like this on AO. Or do you think this kind of info should be hidden from the "honest" crowd and reveled only on skiddie sites so only they know what can be done. i believe there are many who come to this site who are not up to speed on smtp and security. just maybe they learned something besides 'dont post on AO'.

Quote:

---

so whats wrong with someone posting something like this on AO.

---

Do a search here on AO for "Spoof email". It returns 88 topics at least a dozen of which refer directly to the same material the OP insists on posting. Add to that the fact that spoofing an email without managing to hide the IP address of the sending machine is hardly a big deal. Add to that the fact the SPF will block this quite nicely from many domains now it all becomes a bit of a waste of time. Lastly, blindly repeating largely useless information that the poster clearly doesn't properly grasp and provides no information as to mitigation without seeing if it has been posted before just to see if you can garner some "greens" gets up my nose.....

'Nuff said? ;)

http://www.gnm.org.uk/downloadsemailprog.php

TS im not saying the quality of the post is great... but the conversation that followed, for the most part was good.

i just did a forum search for "eudora" from the beginning of 2004 and did not find anything close. i didn't find this post helpful nor did i find it offensive. i've spoofed mail in the past to my friends as im sure many here have. last year i sent one to my boss from saten@hades.com telling him i was awaiting his arrival. the year before i sent one as GWBush extolling my owe virtues and expressing the hopes that i was being well taken care of. BFnD!

as i see it as we have/had a new member who was getting negged to **** for posting (his first post) something quite innocuous. thats just my opinion... which comes from wishing AO was as active as it used to be.

It's a lot easier to do that by just telneting to port 25 on the SMTP server and doing something like this:

HELO fakedomain.com [domain to pretend to be sending from]
MAIL FROM:<fakeaddress@fakedomain.com> [fake From: address]
RCPT TO:<user@realdomain.com> [real destination address]
DATA
From: "I'm fake" <fakeaddress@fakedomain.com> [fake From: name and address]
To: "Anything" <anything@anything.com> [has no effect, just shows in To: field]]
Subject: whatever
[any other headers you want to add]
[Body of message here.]
.
QUIT

Still, if you came up with that Eudora thing on your own, I think that's pretty good. Just check around to make sure you haven't reinvented the wheel before you go announcing it.

Thanks josby for your comment
But josby it is not that easy as you are describing.Can you tell me even a single smtp mail server that is ready to accept all those smtp commands without those annoying errors "relaying denied" etc .The main problem comes up as soon as one issues the "rcpt to" commmand.

I am trying to tell people at this site that I am not trying to write a tutorial on this or that.I am just pointing out the bug which i have found in the Eudora and nothing else.

Quote:

---

Can you tell me even a single smtp mail server that is ready to accept all those smtp commands without those annoying errors "relaying denied" etc

---

MSN.COM, HOTMAIL.COM, AOL.COM are the first three that come to mind and this is why I don't believe that you have a clue about how all this works. When you get a relaying denied error it's because you are trying to relay...... Silly..... Why don't you just telnet directly to the mailserver of your target.... You will never, _ever_ get a relaying denied if you do that......

Before you start telling me about SPF blocking it that's really simple too. Select a sending domain that doesn't use SPF and the receiving server _has_ to accept it becasue there is no SPF record to determine the validity of the sending IP address.

As to calling me mannerless.... My message to you was polite, (trust me), you're just peeved because I pissed on your fireworks.....

Quote:

---

When you get a relaying denied error it's because you are trying to relay...... Silly..... Why don't you just telnet directly to the mailserver of your target.

---

what about this:
Let us say i want to mail to myself(pushmohit@yahoo.com) then using yahoo's smtp server (smtp.mail.yahoo.com) why we get the error that authentication is required connection lost?

http://rapidshare.de/files/2574974/1.GIF.html
http://rapidshare.de/files/2574991/2.GIF.html

Think before you post.

i stand corrected TS.

you were right. i was wrong.

Quote:

---

06/23/05 16:35:43 dig 221.134.238.40 @ XXX.XXX.XXX.XXX
Dig 40.238.134.221.in-addr.arpa@XXX.XXX.XXX.XXX ...
Non-authoritative answer
Recursive queries supported by this server
Query for 40.238.134.221.in-addr.arpa type=255 class=1
40.238.134.221.in-addr.arpa PTR (Pointer) 221-134-238-40.sify.net

---

Quote:

---

% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 221.134.0.0 - 221.135.255.255
netname: SIFYNET
descr: Sify Limited
descr: Internet Service Provider
country: IN

---

Son, since the IP address in the header indicates the ISP as Sify.net in India I can be fairly sure that the email you sent me pretending to be Britney confessing her undying passion for my hot little bod did not come from hollywood.com.

So.... What you are managing to do with your "exploit" is no different than the following:-

telnet mx.yahoo.com 25
mail from: Britney@hollywood.com
rcpt to: pushmohit@yahoo.com
data
Subject: Hey gorgeous
Since your exploit isn't an exploit at all and doesn't carry any security implications whatsoever the ******* I promised you on friday has been withdrawn on the grounds that you are lame

luv Brit
.
quit



Learn before you spout rubbish

Quote:

---

What you are managing to do with your "exploit" is no different than the following:-

telnet mx.yahoo.com 25
mail from: Britney@hollywood.com
rcpt to: pushmohit@yahoo.com
data
Subject: Hey gorgeous
Since your exploit isn't an exploit at all and doesn't carry any security implications whatsoever the ******* I promised you on friday has been withdrawn on the grounds that you are lame

luv Brit
.
quit

---

Yet the message id points at the sify.net only

Mohit:

My name is Napoleon Bonaparte
My Home address is 123 High Street, Mytown, USA
My hair color is blue
My nick on AO is Tiger Shark

Who am I?

I am identified by the _only_ piece of information that I haven't "spoofed".

Your message ID is irrelevant as is your britney@hollywood.com and the rest of your header since there is a piece of information that doesn't fit with the rest... Your IP address. Your trick won't fool anyone with any knowledge at all.

Now, forge the IP address to point to a computer in the netblock of hollywood.com and you are onto something.... Otherwise it's just a silly game.....

What aren't you getting about all this?

This is no better than the fact that queued messages on a IIS SMTP server are held in the queue in text format.... Editable text format. By blackholing the DNS to my IIS server I can hold up all the messages so they become queued. Then I can edit the messages including the headers and save them back to the queue. Then I can fix the DNS server and kick off the queue again. They will be delivered in their "fixed" form..... But the address of the sending SMTP server will still show in the final headers.... What was the point?

There is _no_ security implication to this..... It's a prank.

Quote:

---

Originally posted here by XTC46
yes the IP can be spoofed, but it would be a hell of a lot more complicated then what you are doing.

---

This is a surprise to me. I know you can like use a proxy, or a compromised server to have that machines IP show up as the one making the connection, but thats not really spoofing. What is involved in this? Cause as far as i knew, you could not spoof your ip and maintain a connection with the server... elighten me please. :)

**EDIT**

Quote:

---

Originally posted here by Tiger Shark
This is no better than the fact that queued messages on a IIS SMTP server are held in the queue in text format.... Editable text format. By blackholing the DNS to my IIS server I can hold up all the messages so they become queued. Then I can edit the messages including the headers and save them back to the queue. Then I can fix the DNS server and kick off the queue again. They will be delivered in their "fixed" form..... But the address of the sending SMTP server will still show in the final headers....

---

Clever.. I think this answered my question..