🚀 go-pugleaf

In article <19951221.181421.27607@jupiter.sun.csd.unb.ca>,
Adrian Powell  <CIPS-L@unb.ca> wrote:
>>I've always thought that the originating system clearly
>>identified the sender. Can anyone explain how this can be forged?

A good posting, but I thought I'd throw a few more cents in.

There is a small amount of confusion because you're intermangling
email and Usenet news specific details.

This is of marginal interest to rec.org.cips per-se, however,
given the industry relationship of this group, and some more global
perspectives and implications of forging, I thought it would be useful.

>That depends on what you mean by "originating system".  The
>RFCs (Request For Information) on mail state that there
>are certain fields that are required in all "legal" pieces
>of Internet email.



>        From:           - which user sent the mail
>        To:             - which user should receive the mail
>        Subject:        - the subject
>        Message-ID:     - system-assigned identification
>        Path:           - which nodes have received and transfered this
>                          piece of email.

Path: is a Usenet News specific header (specified by RFC1036).
From:, To:, Subject:, Message-Id:, Sender:, Reply-To: are both email
(RFC822) and Usenet (RFC1036).

>and optionally
>
>        Sender:         - if the user that sent the mail is different
>                          that what is being reported in "From:"
>                          (for example, aliasing, etc.)

>(I beleive there are more fields, but these are the most important).

There are dozens of headers.  RFC822 and RFC1036 can be obtained by
ftp from venera.isi.edu and elsewhere.

>Some other useful information is stored in "Received:" lines.

Received: is a email header.

Theoretically, then, email will have Received: lines (which describe
each machine that relayed the message), and news will
have a Path: line (which simply lists each machine that relayed the
message), and no messages will have both.

>Now, if we wish to impersonate another user, or "spoof" mail, we have
>to change these fields so that they look like they came from our
>target.

>This can be done by running a mail daemon that rewrites headers, or does
>not conform to RFC standards.  Most people won't go to this trouble,
>though, especially since the PATH will often prove this out.

I think you really meant to say "by running a mail program or Usenet
news program that allows you to change headers, and the transport
software doesn't check, or the recipient isn't smart enough to be able
to tell".

With news, most newsreaders allow you to specify anything you want
for a From: (which is what happened to John Groseclose).  Which isn't
that big a deal in itself - the other headers are _supposed_ to tell
you where it _really_ came from (Sender: particularly).  In John's
case, the forger changed the From: line and nothing else.  The Message-Id
(unique identifier for the message - usually identifying the originating
machine) and NNTP-Posting-Host (identifying which machine the originator's
newsreading software was running on) clearly indicated that the
message didn't come from John's machine, and that the From: was therefore
highly suspect.

From: is trivial to forge in news.  A bit harder in email.

But, all headers are forgeable if you know how.  It's not that difficult.
It's easy to generate untraceable forgeries.

The Groseclose forge was clumsy - From: only.  I note that the forger
has been identified...  John isn't going to be very nice at all.

I've had spams forged in my name too - with a bit more sophistication.

This is where we get into the useful bit ;-)

The Internet is _insecure_.  It is not private, because everything is
snoopable.  It is not authenticated, because forging and spoofing are
essentially trivial.  There are a few tools that can help things be
secure (such as PGP public key encryption), but these are not commonly
used.  The Internet is not trustable.  So, don't base important decisions
on it without additional certainties.  Do not be so quick to judge by
surface appearances.  Learn to protect yourself and your resources.
Use firewalls.  There are crackers everywhere.  Without precautions
eventually you'll be toast.