AOL EMail Headers.... Need Help Please.

Ok.... The situation:

I am helping a friend try to determine the perpetrator of some fairly heavy duty harrassment of her family's company. The harrassment goes as far as emailing the payroll files of the company to every employee - that's why I call it "heavy duty".

The suspicion was that it was a terminated employee but I am beginning to have second thoughts about that. The perpetrator has used different "free" email addresses from Yahoo, Hotmail and Netscape so the impression I had was that they weren't entirely stupid.

I got my hands on a couple of email headers sent from the Netscape address which indicate that the AOL system was used, (Netscape = AOL). There is a header line that reads:-

X-AOL-IP: XXX.XXX.XXX.XXX

I have searched around and can find no definitive answer as to what this is. My guess is that it is the IP address that sent the mail originally but the questions I have are:-

1. Does this mean that the original account is an AOL account, (Dial in to AOL - go to Netscape and send the message), or is this just any address on the net that the email was received from regardless of who the ISP is.
2. Can this be forged easily or even with difficulty, (i don't mean use a proxy I mean forged)?

The reason I need to know this is because one of the two addresses is in California and the other is in Jordan..... Yet the suspicion is that the perpetrator _has_ to be in Pennsylvania since some of the files being emailed are unavailable online and a scan of the website indicates a fairly well protected server.

1. Does this mean that the original account is an AOL account, (Dial in to AOL - go to Netscape and send the message), or is this just any address on the net that the email was received from regardless of who the ISP is.

Most likely if the IP address is registered to AOL (ARIN REGISTRY) then the user is logged into AOL during the action. I think you should record the IP ADDRESS, DATES, and EXACT TIMES.. Forward these with your problem and copies of the headers to AOL under their TOS subject to boot the user off the ISP.

Also, keep records for processing criminal action. Record every single e-mail coming in and out regarding this subject.

2. Can this be forged easily or even with difficulty, (i don't mean use a proxy I mean forged)?

You can forge a name or an account, but you cannot forge all the data in the header file. That is why it is required in all complaints.

Info: Nope, they aren't registered to AOL..... They are registered to pacbell in the california instance and LINKdotNET, Amman, JOrdan on the other case......

Either way then, this is not your average pi$$ed of clerical worker managing the harrassment of this company, is it?...... At the minimum they are using open proxies.... Funnily enough the Jordan address hosts an unrelated company's web site.... I'm tempted to scan it for an open proxy right now.......

So, what your saying is. This individual is using host boxes as their method of distributing the information, in such a method as a Spammer would do so?

If I get this straight, you expect the individual to possibly be from PA, but you are confused because the distributed data is coming from different e-mail addresses and different countries ISP's. Could it be that, either the individual has access to these systems and he is using them as a method to cover his (ask me about it) or could he have other people sending out the data for him?

I mean, I can offer as much assistance and I can. I just need to get a clear idea of what is going on. I have a decent background in investigations and forensics.

OK..... 12/1/03 was a great example 'cos the harrasser screwed up and sent a wrong file noticed the problem and resent the message again.

Message 1 header:

Received: from imo-d01.mx.aol.com ([205.188.157.33]) by theirdomain.com with Microsoft SMTPSVC(5.0.2195.4905);
Mon, 1 Dec 2003 12:44:07 -0500
Received: from [email protected]
by imo-d01.mx.aol.com (mail_out_v36_r1.1.) id t.101.b82077d (16238);
Mon, 1 Dec 2003 12:44:02 -0500 (EST)
Received: from netscape.net (mow-m09.webmail.aol.com [64.12.184.137]) by air-in03.mx.aol.com (v97.8) with ESMTP id MAILININ32-3f6e3fcb7de133; Mon, 01 Dec 2003 12:44:01 -0500
Date: Mon, 01 Dec 2003 12:44:01 -0500
From: [email protected]
To: xxxxxxxxxxxxxxxxxx etc.
Subject: X's Manifesto
MIME-Version: 1.0
Message-ID: <[email protected]>
X-Mailer: Atlas Mailer 2.0
X-AOL-IP: XXX.XXX.XXX.XXX
Content-Type: multipart/mixed; boundary=-------2914683c22ffd6cd2914683c22ffd6cd
Content-Transfer-Encoding: 8bit
Return-Path: [email protected]
X-OriginalArrivalTime: 01 Dec 2003 17:44:07.0789 (UTC) FILETIME=[B86331D0:01C3B832]

The X-AOL-IP address is in California registered to PacBell.net.

Message 2 Header:

Received: from imo-d02.mx.aol.com ([205.188.157.34]) by Theirdomain.com with Microsoft SMTPSVC(5.0.2195.4905);
Mon, 1 Dec 2003 13:18:47 -0500
Received: from [email protected]
by imo-d02.mx.aol.com (mail_out_v36_r1.1.) id t.1b4.8cddc46 (16215);
Mon, 1 Dec 2003 13:18:34 -0500 (EST)
Received: from netscape.net (mow-m07.webmail.aol.com [64.12.184.135]) by air-in01.mx.aol.com (v97.8) with ESMTP id MAILININ13-3f573fcb85b83c9; Mon, 01 Dec 2003 13:17:28 -0500
Date: Mon, 01 Dec 2003 13:18:33 -0500
From: [email protected]
To: xxxxxxxxxxxxxxxxxx etc +1
Subject: X's Manifesto Oops i did it again
MIME-Version: 1.0
Message-ID: <[email protected]>
X-Mailer: Atlas Mailer 2.0
X-AOL-IP: XX.XX.XXX.XX
Content-Type: multipart/mixed; boundary=-------4fc97c3817aa8a994fc97c3817aa8a99
Content-Transfer-Encoding: 8bit
Return-Path: [email protected]
X-OriginalArrivalTime: 01 Dec 2003 18:18:47.0429 (UTC) FILETIME=[8FF31350:01C3B837]

The X-AOL-IP is in or near Imman, Jordan registered to a domain other than AOL.

Note that these two headers, while only being 30 minutes apart are identical for the most part.... Notable changes, (ignoring the fact that it may have been routed through AOL/Netscape differently), are the originating IP Address and the fact that on the second email he added one other person to the recipient list.

I believe the same person sent both emails but it seems to me like they are switching proxies or something so that the originating IP is not trackable. I NMapped both addresses and they both have numerous ports open including proxied http and socks proxy so it is highly likely that these machines are either open proxies, open relays or, frankly, owned boxes.

The knowledge and ability required to carry out this kind of deception means it is highly likely that no-one past or present in the company has the ability to carry this off alone.

The thing I really need other people's feeling on at this point is:

I'm dealing with someone who knows _exactly_ what they are doing aren't I? I'm not just misreading or misinterpreting something - this person knows how to hide. Am I right?

Message 1:

Received: from imo-d01.mx.aol.com ([205.188.157.33]) -AOL-
Mon, 1 Dec 2003 12:44:07 -0500
Received: from netscape.net (mow-m09.webmail.aol.com [64.12.184.137]) -AOL-

Message 2:

Received: from imo-d02.mx.aol.com ([205.188.157.34]) -AOL-
Mon, 1 Dec 2003 13:18:47 -0500
Received: from netscape.net (mow-m07.webmail.aol.com [64.12.184.135]) -AOL-

NetRange: 205.188.0.0 - 205.188.255.255
NetName: AOL-DTC

NetRange: 64.12.0.0 - 64.12.255.255
NetName: AOL-MTC

They are being sent and routed via AOL.

Info: Yeah, I got that. But you can log into AOLmail/Netscape/Compuserve etc, (they are all the same system as witnessed by the X-MAILER: Atlas Mailer 2.0 line which is AOL's backend mailer), from any IP address worldwide and send email, it will eventually go through AOL servers for final delivery.

They just received two more emails today. The headers indicate originating addresses in Tucson and back in California. The Tucson IP has an Aerospace company web page and all.... Along with port 3128 open - Squid Proxy. The other one appears dead to NMap but it appears on a lot of open proxy lists according to Google.

This confirms what I thought about the perpetrator, (or at least the person helping them). He/she is something of an anonymity "professional" and is taking great care, (3 different, untracable email addresses and at least five IP addresses, four of which have all the characteristics of proxies, (appropriate ports are open).

Quote:

---

Originally posted here by Info Tech Geek
You can forge a name or an account, but you cannot forge all the data in the header file. That is why it is required in all complaints.

---

I have tried forging E-Mails before on my own box, just to see if I was vulnerable (I have Microsoft IIS), and have been able to forge many things in the header, including but not limited to the Message-ID, Date, and Arrival Time. I have been able to produce an E-Mail that appears to be sent from M$ Outlook in every fashion, except for the fact that nearly all the header data has been forged. The Recieved... header is not so easily forged, though since every server the message goes through will attach one. So, you can never really be sure if a certain field has been forged, but you can usually tell which servers it travelled through. I'm not sure if this works for other mail servers, however, so I may be way of base. Please correct me if I am.

Republican: Thanks......

I'm pretty firmly set in my thought that I'm right..... This person is pretty good at hiding themselves. What pisses me off is that I'm going to lose this one..... He's a moving target that I don't see until after he's gone..... Thus there is no way I'm going to hit him.... :mad:

I guess I'll pop him an email complimenting him on his skill to see if I can elicit a response..... Probably not..... He knows better I think..... :(

Anyone else got any ideas on how to set a trap for a target that is never where he's supposed to be?

Your best bet, although it has a slim chance is probably to bait the person and try and strike up a friendship (compliments ,unimportant questions, build trust,stroke the ego...then very subtle questions). It could take some time and effort ,but anything is possible. If it is a bitter employee then play along that you are pissed at the people also. Misery loves company and everyone has an ego.

Can you set up a firewall rule to drop / reject any e-mail comming out of AOL? That may force him/her to take another route and maybe that route won't be as ugly to follow back. Just a thought.


Cheers:

DJM:

Thanks for the thought..... But there's the "rub".... The company in question is heavily into eCommerce at a consumer level..... Killing AOL mail would probably be doing the perpetrator's bidding......

My Bosses might baulk at me spending a chunk of work time of this but I'm learning a few very valuable lessons about the value of internal security and disgruntled employees..... Some things will be checked and rechecked at work in response to this "learning experience"..... I'm just glad it's a friend's problem not mine...... :D

Umm.. dumb question but what about asking AOL to help? I don't think they'd be thrilled to find out they are being used for Open Relay and for something that potentially could be illegal (depending on the state and such).

Along with what MsMittens said. It isn't AOL that has the open relay though, its the step before it gets into the AOL system. Like TS said, it appears that they are using online accounts (netscape/yahoo/etc) so instead of using a relay, they are using a proxy to connect to the email program. Then they don't have to worry about finding an open realay. About the only thing that I can see as being fesable (and you will have to talk to your management about this) is to contact the companies that have the open proxies. Explain to them your situation and that someone is using their computers to harass you. Your managers will have to agree as you will have to give your company name and such. Then, hopefully one or more of those other companies will either close the proxy, or better yet, watch the proxy to find out where the connection is comming from. The government won't get involved because you don't have enough damage to your system, but if one of those other companies finds out they have a lot of damage to a computer that they didn't know about, they may report it to the FBI/Secret service, and something may happen then.

Anyone else reminded of the Cuckoo's Egg by Clifford Stoll?

Ms. M:

Sorry if I've miscommunicated..... It's not AOL that is the relay.... It's someone using AOL and now Hotmail accounts, (available from any internet connected PC), using proxies to send harrassing mails to this company through AOL and Hotmail accounts.

Frankly I have no confidence in the complaint system of either AOL or Hotmail to even reply to the complaint other then the automated "We have received you complaint" message.....

Additionally, the way this person is "moving around" implies to me that a blocked account will be no problem and a new one will pop up from somewhere..... I need the little #$%^& to make a mistake.... Unfortunately, I'm not sure (s)he will...... <sigh>

[EDIT]

Soul: Yep.... You have it down pat.... That's the situation.... I'm trying my best bet right now which is to try to start a conversation with the "perp" to see if we can narrow down the possibilities. Probably won't get much from it but I'm running out of ideas....

[/EDIT]

I would still contact them. But not via email necessarily. I'd call and find someone to speak to. I don't think they are going to take to it too kindly that someone is using their servers this way. They may be able to watch for certain patterns and perhaps find the answer. At worse, you'll get no response. At best, they might help you.

Ms. M:

Yeah, it's a "weapon in the arsenal" but now we are dealing with AOL/Netscape and Hotmail..... They are getting a little desperate there, (it's not my company, it's a small eCommerce company that has some minor "skeletons" in their closet dating back to the dot.com era)..... Too much to explain but it is causing them some grief that is probably undeserved and it needs to be fixed quickly for the sanity of those involved..... That's why I was asked to help...... It peeves the crap out of me that, at this point.... I can't!!!! :mad: And by the time AOL/Netscape and Hotmail actually produce we'll all be dead and buried.... ;)

in the email your sending the perp use an html format and inbed a 1 pixel transparemt graphic located on your webserver. title the msg "how much do you want?" on the remote chance that it will actually be read. you can then grep your wwwlogs for the name of the gif or whatever and see what ip d/l'ed it. its a longshot but what the hay

Tedob1: Thats a great idea. I would send the email to every account that they have sent from thus far. (pixel included) If you get more emails from different accounts, then send to those accounts too. Since they are using web based clients, it they won't find the "bug" until its too late.

If they are going to slip up, it probably going to be them reading the email, rather than them sending the email. Hopefully, they will check the mail from their real ip, since it will be faster.

Also, if you can determine which proxies they like to use. Try to contact the admins of the proxies and see if you can get any info from their logs. Give them time and date and see if you can get snippets of the logs from around the same time the mail was sent.

It is also possible that they are proxy chaining... which will lead you to yet another proxy.

Same process. Contact admin and see if you can get logs.

Most admins will probably give you the info you want. It doesn't compromise any of their security... they don't have any in place... They'd probably also like to know that they goofed and have a compromised host or misconfigured proxy.

I'd try to contact those admins ASAP so they don't kill their logs before you get to them.
If they even have logging enabled or even check their logs...

Trying to strike up a "relationship" with this person is a good idea too. Just don't let on that you know too much... play dumb. But within reason. The dumber they think you are, the more likely they are to slip up.

AOL mail has a pop up that says, "Do you know who sent you this image?", but other email accounts might not. So if that warning comes up with whatever email accounts they use, maybe you would want to consider not sending it to that account, it would ruin the whole 1 pixel transparent thing idea, because they will know its there. Honestly, you all know better than I do, thats for sure. Sounds like a cool idea. Its like Batman.

Soda: Thanks for that little "gem"

I found out today that the owners called in the FBI - and they seem to be interested...... Guess they caught all the terrorists..... ;)

sounds awesome, this was an interesting thread

Tiger, my guess would be that this perp would be into assisting others mess around with the company.

You could stick a post out in a suitable newsgroup similar to this:

CompanyX has just pissed me off big-time - I wanna get revenge.

Anyone know how to send an email to everyone in the company - I can then send all manner of offensive crap.

Reply to disposable dot address at madeupdomain.com.

Assuming the perp is on a mission against the company they will be searching the net on a regular basis for further info to assist them - they may not be able to resist the message.

SE works both ways!

Steve

Oh, don't forget to let the original company know what you are doing.

Steve

Steve: I did try a little social engineering myself. I sent two, (semi-anonymous), messages to the perp. The first was an "accusation" of sorts that "anyone can take a spreadsheet and alter certain numbers" in the hope that I would get a reply pointing me to the properties of the file. That would have done two things, i) pretty much rule out the person who last saved it as the perp, and ii) begun a conversation with the perp. The second was a somewhat agreeable, (complimented them on their "skill", spoke a little disagreeably about persons involved as if I knew them - trying the "empathy route"....), but at the same time left no doubt that I was tracking them and I know and understand what it is they are doing and "warning" them not to mess up "since it will mess up my fun and yours"..... ;)

I kind of threw a double "phish" in the second one.... trying to elicit a response either on the "professional" side, (a "catch me if you can" response), or on the fact that they seem to hate the players so much that my apparent dislike and knowledge of some of their charateristics would get a "Yeah, they are a$$holes" or "She's way worse than that, she did X to me" response. I got neither..... :(

I'm pretty sure he/she is smart enough not to read any responses and the content of the messages sent out implies that causing trouble is the only goal. It is working - two people have upped and quit and another two are bitching so hard that they are being warned to "shape up or ship out". In a company of some 20 employees that's a big hit to take all at once.......

I had thought of the transparent pixel idea Tedob came up with but I was going to run a few messages first without it if I could get a conversation going because the source could quite easily be read without triggering the trap and I wanted to get them comfortable with the fact that I was "chatting" rather than "trapping". I figured that if I could get their comfort level up, (with or without an actual conversation), then they may drop their guard and trigger a trap placed later..... Unfortunately, that will not occur now.......

Since the Feds have been brought in I have made a "tactical" withdrawal. I don't want to cross cyber-paths with some spook and hear their gentle knocking on my door at 3:00am... ;) I told my friend this and told her to be up front with the Feds as to who I am, why I was "invited" to assist, what I had found and to feel free to have them contect me if they need more info..... I figure if they go digging it's better if they know I was there beforehand rather than suddenly discover my presence since I left tracks all over the proxy servers etc. while scanning and looking for open relays..... <s>

Well thats sucks that u dont get to chase him down but hey at least someone will catch the little punk.

As it was said before anyone reminded of cuckoos egg

too bad and good at the same time. the fbi can do a better job with the resources they have.

if i were the perp i wouldnt read the mail but i might check to see if i was getting their goat. if i saw a title "how much do you want"...it would tempt me. i figure its somebody getting paid to do it