Email spoofing - Revision history

Ben at 20:08, 27 May 2014

2014-05-27T20:08:55Z

Ben at 20:07, 27 May 2014

2014-05-27T20:07:43Z

Ben at 20:07, 27 May 2014

2014-05-27T20:07:13Z

Ben: Created page with "Receiving a message from your friend joe.average@webmail.com is often evidence enough that it was Joe Average with an account at webmail.com who sent you the email. Unfortunat..."

2014-05-12T21:00:37Z

Created page with "Receiving a message from your friend joe.average@webmail.com is often evidence enough that it was Joe Average with an account at webmail.com who sent you the email. Unfortunat..."

New page

Receiving a message from your friend joe.average@webmail.com is often evidence enough that it was Joe Average with an account at webmail.com who sent you the email. Unfortunately this may be untrue as sender's credentials can easily be faked on the Internet.

<vid>

@@ Line 16: / Line 16: @@
 Delivered-To: dmitri@vitaliev.info<br>
-Received: by 10.220.151.69 with SMTP id b5csp114879vcw;
+Received: by 10.220.151.69 with SMTP id b5csp114879vcw;<br>
-Sun, 28 Oct 2012 20:05:50 -0700 (PDT)
+Sun, 28 Oct 2012 20:05:50 -0700 (PDT)<br>
-Received: by 10.14.216.193 with SMTP id g41mr47392166eep.37.1351479949985;
+Received: by 10.14.216.193 with SMTP id g41mr47392166eep.37.1351479949985;<br>
-Sun, 28 Oct 2012 20:05:49 -0700 (PDT)
+Sun, 28 Oct 2012 20:05:49 -0700 (PDT)<br>
-Return-Path: <joe.average@webmail.com>
+Return-Path: <joe.average@webmail.com><br>
-Received: from emkei.cz ([2a01:5e0:36:5001::20])
+Received: from emkei.cz ([2a01:5e0:36:5001::20])<br>
-by mx.google.com with ESMTP id z46si13229132eeo.136.2012.10.28.20.05.49;
+by mx.google.com with ESMTP id z46si13229132eeo.136.2012.10.28.20.05.49;<br>
-Sun, 28 Oct 2012 20:05:49 -0700 (PDT)
+Sun, 28 Oct 2012 20:05:49 -0700 (PDT)<br>
-Received-SPF: neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) client-ip=2a01:5e0:36:5001::20;
+Received-SPF: neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) client-ip=2a01:5e0:36:5001::20;<br>
-Authentication-Results: mx.google.com; spf=neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) smtp.mail=joe.average@webmail.com
+Authentication-Results: mx.google.com; spf=neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) smtp.mail=joe.average@webmail.com<br>
-Received: by emkei.cz (Postfix, from userid 33)
+Received: by emkei.cz (Postfix, from userid 33)<br>
-id 8423ED5A2D; Mon, 29 Oct 2012 04:05:48 +0100 (CET)
+id 8423ED5A2D; Mon, 29 Oct 2012 04:05:48 +0100 (CET)<br>
-To: dmitri@vitaliev.info
+To: dmitri@vitaliev.info<br>
-Subject: long time no see
+Subject: long time no see<br>
-From: "Joe Average" <joe.average@webmail.com>
+From: "Joe Average" <joe.average@webmail.com><br>
-X-Priority: 3 (Normal)
+X-Priority: 3 (Normal)<br>
-Importance: Normal
+Importance: Normal<br>
-Errors-To: joe.average@webmail.com
+Errors-To: joe.average@webmail.com<br>
-Reply-To: joe.average@webmail.com
+Reply-To: joe.average@webmail.com<br>
-Content-Type: text/plain; charset=utf-8
+Content-Type: text/plain; charset=utf-8<br>
-Message-Id: <20121029030548.8423ED5A2D@emkei.cz>
+Message-Id: <20121029030548.8423ED5A2D@emkei.cz><br>
-Date: Mon, 29 Oct 2012 04:05:48 +0100 (CET)
+Date: Mon, 29 Oct 2012 04:05:48 +0100 (CET)<br>
 Reading the message from the bottom up, look for telling signs of the real server where the message was sent from. You will see right away that this particular email is being sent from the @emkei.cz domain and not webmail.com

@@ Line 15: / Line 15: @@
-Delivered-To: dmitri@vitaliev.info
+Delivered-To: dmitri@vitaliev.info<br>
 Received: by 10.220.151.69 with SMTP id b5csp114879vcw;
 Sun, 28 Oct 2012 20:05:50 -0700 (PDT)

← Older revision		Revision as of 20:07, 27 May 2014
Line 1:		Line 1:
−	Receiving a message from your friend joe.average@webmail.com is often evidence enough that it was Joe Average with an account at webmail.com who sent you the email. Unfortunately this may be untrue as sender's credentials can easily be faked on the Internet.

−	<~~vid~~>	+	Receiving a message from your friend joe.average@webmail.com is often evidence enough that it was Joe Average with an account at webmail.com who sent you the email. Unfortunately this may be untrue as sender's credentials can easily be faked on the Internet.
		+
		+	{{#ev:youtube\|pYyIrvaqszA}}
		+
		+
		+	'''Exercise:''' send yourself a spoofed email from http://emkei.cz/
		+
		+	[[File:emailspoofing5.png\|email spoofing]]
		+
		+
		+	Sending a fake email is possible since the SMTP protocol (the technical standards that route email on the Internet) require a valid TO: address but do not really care about where the email is FROM. The sender's name and address can be easily faked.
		+	As explained in the video, the only way to find out who had really sent you the emaill address is to inspect the message's headers (in Gmail this is called 'Show Original' and is accessible under the 'More' drop-down menu to the top right-hand corner of the message).
		+
		+
		+
		+	Delivered-To: dmitri@vitaliev.info
		+	Received: by 10.220.151.69 with SMTP id b5csp114879vcw;
		+	Sun, 28 Oct 2012 20:05:50 -0700 (PDT)
		+	Received: by 10.14.216.193 with SMTP id g41mr47392166eep.37.1351479949985;
		+	Sun, 28 Oct 2012 20:05:49 -0700 (PDT)
		+	Return-Path: <joe.average@webmail.com>
		+	Received: from emkei.cz ([2a01:5e0:36:5001::20])
		+	by mx.google.com with ESMTP id z46si13229132eeo.136.2012.10.28.20.05.49;
		+	Sun, 28 Oct 2012 20:05:49 -0700 (PDT)
		+	Received-SPF: neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) client-ip=2a01:5e0:36:5001::20;
		+	Authentication-Results: mx.google.com; spf=neutral (google.com: 2a01:5e0:36:5001::20 is neither permitted nor denied by best guess record for domain of joe.average@webmail.com) smtp.mail=joe.average@webmail.com
		+	Received: by emkei.cz (Postfix, from userid 33)
		+	id 8423ED5A2D; Mon, 29 Oct 2012 04:05:48 +0100 (CET)
		+	To: dmitri@vitaliev.info
		+	Subject: long time no see
		+	From: "Joe Average" <joe.average@webmail.com>
		+	X-Priority: 3 (Normal)
		+	Importance: Normal
		+	Errors-To: joe.average@webmail.com
		+	Reply-To: joe.average@webmail.com
		+	Content-Type: text/plain; charset=utf-8
		+	Message-Id: <20121029030548.8423ED5A2D@emkei.cz>
		+	Date: Mon, 29 Oct 2012 04:05:48 +0100 (CET)
		+
		+	Reading the message from the bottom up, look for telling signs of the real server where the message was sent from. You will see right away that this particular email is being sent from the @emkei.cz domain and not webmail.com
		+
		+	There are more sophisticated ways to spoof an email message, whereby the fake domain will not be disclosed. However, the headers will always contain the IP address of the server used to send the message from.
		+
		+	You will need to use the online IP validation and tracing tools mentioned above to verify who owns those addresses and whether the email sender is likely to be using one of those addresses. For example, if you friend is located in the Czech Republic and the sender's IP address is registered in Australia – it could be a hoax, or your friend could be on vacation.