🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #412

Re: Fake headers on Internet mail

#412
From: Ian MacPhedran
Date: Wed, 19 Aug 1992 01:06
30 lines
2268 bytes
From article <1992Aug12.151404.1424@lub001.lamar.edu>, by sherer@lub001.lamar.edu:
> This is the first time I've posted to News, so please be kind.
> 
> I have been informed of a suspected problem in Internet mail by one of my
> operators. He received some mail from some valid users at our site, and he
> responded to those messages. The people that supposedly sent the messages
> claimed they never sent them. Then he (the operator) received e-mail from
> himself on a VMS node to his account on our ULTRIX node. He did not send the
> mail himself, and he checked the last login time on the account on the VMS
>+ node
> and found that no one had logged in on that account in quite a while, so he
>+ did
> not believe anyone figured out his password.

 Most of the replies have been w.r.t. SMTP mail tricking. Since this is 
 between two DEC machines, the mail could also have been sent by DECnet
 mail (Mail 11) which is also easily tricked by any user with extra time
 to waste. If you have copies of the mail headers, you can track down
 which scheme was used, but not much else.

Ian.
----------------------------------------------------------------------------
Ian MacPhedran, Engineering Computer Centre, University of Saskatchewan.
2B13 Engineering Building, U. of S. Campus, Saskatoon, Sask., CANADA S7N 0W0
macphed@dvinci.USask.CA  macphedran@sask.USask.CA
-- 
----------------------------------------------------------------------------
Ian MacPhedran, Engineering Computer Centre, University of Saskatchewan.
2B13 Engineering Building, U. of S. Campus, Saskatoon, Sask., CANADA S7N 0W0
macphed@dvinci.USask.CA  macphedran@sask.USask.CA
Technical Details
Message-ID: <1992Aug19.010651.16998@access.usask.ca>
Path: arc1-ca.pugleaf.net!sparky!uunet!wupost!gumby!destroyer!ubc-cs!unixg.ubc.ca!kakwa.ucs.ualberta.ca!access.usask.ca!dvinci!macphed
References: <1992Aug12.151404.1424@lub001.lamar.edu>

Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc
Path: arc1-ca.pugleaf.net!sparky!uunet!wupost!gumby!destroyer!ubc-cs!unixg.ubc.ca!kakwa.ucs.ualberta.ca!access.usask.ca!dvinci!macphed
From: macphed@dvinci.USask.Ca (Ian MacPhedran)
Subject: Re: Fake headers on Internet mail
Message-ID: <1992Aug19.010651.16998@access.usask.ca>
Originator: macphed@dvinci
Sender: news@access.usask.ca (USENET News System)
Nntp-Posting-Host: dvinci.usask.ca
Reply-To: macphed@dvinci.USask.Ca
Organization: University of Saskatchewan
References: <1992Aug12.151404.1424@lub001.lamar.edu>
Date: Wed, 19 Aug 1992 01:06:51 GMT
Lines: 30