🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #371

Re: Fake headers on Internet mail

#371
From: Peter Eriksson
Date: Thu, 13 Aug 1992 23:06
29 lines
2106 bytes
nickel@cs.tu-berlin.de (Juergen Nickelsen) writes:

>In article <1992Aug13.164814.11389@aio.jsc.nasa.gov>
>Barrett_Jim@ial3.jsc.nasa.gov (Jim Barrett) writes:

>> I have observed that some mailer daemons are able to detect certain fraudulent
>> transcations, and while accepting the "From:" information in the incoming
>> message, will also include an "Apparently-From:" line in the message header. 
>> Most mailers that I have played with believe the "From:" information fed to
>> them without a murmur of doubt.  

If one applies the Sendmail patch in pub/ident/patches at ftp.lysator.liu.se
or pub/networking/ident/patches at ftp.uu.net, then all mail that are received
via the SMTP TCP/IP port will, if the sending host is running an IDENT server,
have a line "(rfc931-sender: realuserid@realhostid)" added to the "Received: "
line in the message header. (Where "realuserid" is the user name of the luser
at "realhostid" who initiated the connection to the SMTP port).

Servers that implement the IDENT (the successor to RFC931) protocol can also
be FTP'd from ftp.lysator.liu.se (in pub/ident/servers) or from ftp.uu.net
(in pub/networking/ident/servers). There are servers for various Unixes and
even a server for DEC TOPS-20. The latest version of the stuff is always
at ftp.lysator.liu.se.

/Peter
--
Peter Eriksson                                              pen@lysator.liu.se
Lysator Academic Computer Society                 ...!uunet!lysator.liu.se!pen
University of Linkoping, Sweden                           I'm bored. Flame me.
Technical Details
Message-ID: <1513@lysator.liu.se>
Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!sunic!liuida!isy!lysator.liu.se!pen
References: <1992Aug12.151404.1424@lub001.lamar.edu> <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de>

Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!mcsun!sunic!liuida!isy!lysator.liu.se!pen
From: pen@lysator.liu.se (Peter Eriksson)
Subject: Re: Fake headers on Internet mail
Message-ID: <1513@lysator.liu.se>
Sender: news@isy.liu.se (Lord of the News)
Organization: Lysator Academic Computer Club, Linkoping University, Sweden
References: <1992Aug12.151404.1424@lub001.lamar.edu>  <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de>
Date: Thu, 13 Aug 1992 23:06:28 GMT
Lines: 29