<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
Nadav Har'El wrote:
<blockquote cite="mid:20100217125008.GA18775@fermat.math.technion.ac.il"
type="cite">
<pre wrap="">On Wed, Feb 17, 2010, Geoff Shang wrote about "Request for help with mail spoofing":
</pre>
<blockquote type="cite">
<pre wrap="">Given that I have this script which I am willing to send on, my questions
are:
1. What exactly is being done?
</pre>
</blockquote>
<pre wrap=""><!---->
You didn't attach the script, but basically "forging" mail on the Internet
is trivial.
</pre>
</blockquote>
Here it is. Open your mail agent (say, thunderbird), go to the account
configuration, change the "my name" and "my email" settings, send the
mail. No scripting necessary.<br>
<blockquote cite="mid:20100217125008.GA18775@fermat.math.technion.ac.il"
type="cite">
<pre wrap="">
The key point to understand is that SMTP, the "simple mail transfer protocol",
has absolutely no authentication mechanism for the "From" address. If I send
mail from <a class="moz-txt-link-abbreviated" href="mailto:nyh@math.technion.ac.il">nyh@math.technion.ac.il</a>, my host simply writes the line
MAIL FROM: <a class="moz-txt-link-rfc2396E" href="mailto:nyh@math.technion.ac.il"><nyh@math.technion.ac.il></a>
as part of the SMTP session with the receiving mail server. It could have
just as easily wrote <a class="moz-txt-link-abbreviated" href="mailto:president@whitehouse.gov">president@whitehouse.gov</a>.
</pre>
</blockquote>
Just to make things worse, what you just specified is the "envelop
sender" - what the mail servers will use in order to bounce the
message. Most servers will discard this information the moment the mail
gets successfully delivered.<br>
<br>
The sender's address and name, as appears in mail user agents, is
actually taken from the message's BODY - even easier to spoof than that.<br>
<br>
Shachar<br>
<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>