🚀 go-pugleaf

In article <1992Aug12.151404.1424@lub001.lamar.edu> , sherer@lub001.lamar.edu
writes:
>My question is, is there a way to masquerade as someone else in e-mail?

Any user can connect to the SMTP daemon, and feed it any data he or she sees
fit.  No root permissions are necessary:  it's simply a matter of knowing how. 
Someone at your site with more knowledge than respect has obviously discovered
the 'how'.  

I have observed that some mailer daemons are able to detect certain fraudulent
transcations, and while accepting the "From:" information in the incoming
message, will also include an "Apparently-From:" line in the message header. 
Most mailers that I have played with believe the "From:" information fed to
them without a murmur of doubt.  

Alt.security had a discussion a couple of months ago regarding this very
problem, and a new protocol that could be implemented to assist in closing this
hole.  You might try  posting there, and asking someone to forward the results
of that discussion to you.  
--
Jim Barrett                Lockheed Engineering & Sciences Co., Houston, TX
Barrett_Jim@ial3.jsc.nasa.gov                                  713-333-6103