🚀 go-pugleaf

In article <4225@bcstec.ca.boeing.com> vanzwol@bcstec.ca.boeing.com (Ted Van Zwol) writes:
>OK, so if you won't say how to do it (possibly reasonable enough...)
>Can you say how to prevent it?

With the current set of Internet standard protocols, there is no way of
preventing forged mail.  The technology to do that exists with public-key
crytography and electronic signatures, but since there are not yet any
widely implemented standards for using this technology on the net, it is
not practical for an individual to do so.

>Can you say how to detect it?

Detection is trick... if the message was a forgery of a "local" message on
a Unix system, you can probably detect it from the sendmail logs; if they
message were authentic it would not have passed through SMTP.  If the
forgery was one where a user spoofed a user on a remote system, you might
need cooperation of the sysops of other systems along the route for 
reliable detection, making it practically very difficult if the forger
was clever.

Note that the former covers the case Mr. caps-and-exclamation-marks was
asking about; it is quite easy to detect the case where a user of a multi-
user Unix system tries to spoof a message from "root" (however, detection
will be from the logs, not the message itself.)

>Is it truly that trivial and foolproof?  Or does it just make the
>header *look* like it came from someone else (read root) to the
>non-attentive eye?

If done correctly, the header of a forged message will be *exactly* identical
to the header of the message had it been authentic.  If there's any way of
identifying the forgery in such a case it's via logs of network activity,
not the message itself.  And yes, if you have a resonably good understanding
of what a correct message header /should/ look like, it's quite trivial to
execute such a forgery.

Note however that in many cases of actual forgeries the headers might
provide a clue to the fact that the message is a forgery because a lot
of the forgers do /not/ really understand what a correct message header
looks like, or conversely, they produce a "correct" looking header but
the real system would have produced different or less correct one.
--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629