Re: Fake headers on Internet mail

Article View: comp.security.misc

Article #374

Back to comp.security.misc Previous Next

#374

From: Neil Rickert
Date: Fri, 14 Aug 1992 15:02

15 lines
1233 bytes

In article <1513@lysator.liu.se> pen@lysator.liu.se (Peter Eriksson) writes:
>
>If one applies the Sendmail patch in pub/ident/patches at ftp.lysator.liu.se
>or pub/networking/ident/patches at ftp.uu.net, then all mail that are received
>via the SMTP TCP/IP port will, if the sending host is running an IDENT server,
>have a line "(rfc931-sender: realuserid@realhostid)" added to the "Received: "
>line in the message header. (Where "realuserid" is the user name of the luser
>at "realhostid" who initiated the connection to the SMTP port).

  If the mail forger is halfway competent, he will ensure that this
authentication stamp reads:

	(rfc931-sender: root@realhostid)

  It is not at all clear to me why this buys you anything.

Technical Details

Message-ID: <1992Aug14.150204.5296@mp.cs.niu.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!pacific.mps.ohio-state.edu!linac!mp.cs.niu.edu!rickert

References: <1992Aug13.164814.11389@aio.jsc.nasa.gov>> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se>

Show Full Headers

Complete Article Headers

Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!pacific.mps.ohio-state.edu!linac!mp.cs.niu.edu!rickert
From: rickert@mp.cs.niu.edu (Neil Rickert)
Subject: Re: Fake headers on Internet mail
Message-ID: <1992Aug14.150204.5296@mp.cs.niu.edu>
Organization: Northern Illinois University
References: <1992Aug13.164814.11389@aio.jsc.nasa.gov>> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se>
Date: Fri, 14 Aug 1992 15:02:04 GMT
Lines: 16

Reply to Parent Message