Article View: comp.security.misc
Article #412Re: Fake headers on Internet mail
From: Ian MacPhedran
Date: Wed, 19 Aug 1992 01:06
Date: Wed, 19 Aug 1992 01:06
30 lines
2268 bytes
2268 bytes
From article <1992Aug12.151404.1424@lub001.lamar.edu>, by sherer@lub001.lamar.edu: > This is the first time I've posted to News, so please be kind. > > I have been informed of a suspected problem in Internet mail by one of my > operators. He received some mail from some valid users at our site, and he > responded to those messages. The people that supposedly sent the messages > claimed they never sent them. Then he (the operator) received e-mail from > himself on a VMS node to his account on our ULTRIX node. He did not send the > mail himself, and he checked the last login time on the account on the VMS >+ node > and found that no one had logged in on that account in quite a while, so he >+ did > not believe anyone figured out his password. Most of the replies have been w.r.t. SMTP mail tricking. Since this is between two DEC machines, the mail could also have been sent by DECnet mail (Mail 11) which is also easily tricked by any user with extra time to waste. If you have copies of the mail headers, you can track down which scheme was used, but not much else. Ian. ---------------------------------------------------------------------------- Ian MacPhedran, Engineering Computer Centre, University of Saskatchewan. 2B13 Engineering Building, U. of S. Campus, Saskatoon, Sask., CANADA S7N 0W0 macphed@dvinci.USask.CA macphedran@sask.USask.CA -- ---------------------------------------------------------------------------- Ian MacPhedran, Engineering Computer Centre, University of Saskatchewan. 2B13 Engineering Building, U. of S. Campus, Saskatoon, Sask., CANADA S7N 0W0 macphed@dvinci.USask.CA macphedran@sask.USask.CA
Technical Details
Message-ID:
<1992Aug19.010651.16998@access.usask.ca>Path:
arc1-ca.pugleaf.net!sparky!uunet!wupost!gumby!destroyer!ubc-cs!unixg.ubc.ca!kakwa.ucs.ualberta.ca!access.usask.ca!dvinci!macphedReferences:
<1992Aug12.151404.1424@lub001.lamar.edu>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!wupost!gumby!destroyer!ubc-cs!unixg.ubc.ca!kakwa.ucs.ualberta.ca!access.usask.ca!dvinci!macphed From: macphed@dvinci.USask.Ca (Ian MacPhedran) Subject: Re: Fake headers on Internet mail Message-ID: <1992Aug19.010651.16998@access.usask.ca> Originator: macphed@dvinci Sender: news@access.usask.ca (USENET News System) Nntp-Posting-Host: dvinci.usask.ca Reply-To: macphed@dvinci.USask.Ca Organization: University of Saskatchewan References: <1992Aug12.151404.1424@lub001.lamar.edu> Date: Wed, 19 Aug 1992 01:06:51 GMT Lines: 30