🚀 go-pugleaf

>I've always thought that the originating system clearly
>identified the sender. Can anyone explain how this can be forged?

That depends on what you mean by "originating system".  The
RFCs (Request For Information) on mail state that there
are certain fields that are required in all "legal" pieces
of Internet email.

        From:           - which user sent the mail
        To:             - which user should receive the mail
        Subject:        - the subject
        Message-ID:     - system-assigned identification
        Path:           - which nodes have received and transfered this
                          piece of email.

and optionally

        Sender:         - if the user that sent the mail is different
                          that what is being reported in "From:"
                          (for example, aliasing, etc.)

(I beleive there are more fields, but these are the most important).
Some other useful information is stored in "Received:" lines.

Now, if we wish to impersonate another user, or "spoof" mail, we have
to change these fields so that they look like they came from our
target.

This can be done by running a mail daemon that rewrites headers, or does
not conform to RFC standards.  Most people won't go to this trouble,
though, especially since the PATH will often prove this out.

Or, one could use an anonymous remailer, but this doesn't actually spoof
a user, but just obscures your id.

One of the better ways of spoofing mail, is to connect directly to an
email server (port 25), claim to be another user, and provide
the headers that you wish to appear.  This has the advantage of
legitimately coming from an otherwise working mail server, so only
curious parties can trace the mail back to a specific machine.
Many mail servers will log the real sender, but many won't.  Some
mail servers will not let you send mail if it can't verify your
"real" name (using identd or the equivallent), but some will.


Basically, it all comes down to this: email is just a convenient collection
of letters and characters that we agree to assign meaning to ("if it comes
to me in this fashion, and looks like this, then it is mail").  Like anything
else on computers, these characters can be changed for legitimate
(or otherwise) reasons.  Just because you can see it in black-and-white
on your computer screen, don't ever assume that it is correct.

Adrian.
--
Adrian Powell    (Adrian.Powell@NorwestLabs.com)
home:            http://ugweb.cs.ualberta.ca/~adrian
phone:           (403) 438-5522
fax:             (403) 434-8586