🚀 go-pugleaf

In article <BxrJCL.9sC@mtholyoke.edu> jbotz@mtholyoke.edu (Jurgen
Botz) writes:

   >Can you say how to detect it?

   Detection is trick... if the message was a forgery of a "local"
   message on a Unix system, you can probably detect it from the
   sendmail logs; if they message were authentic it would not have
   passed through SMTP.

Be careful.  Remember that different users will use different programs
for reading their mail.  Some of these programs connect to the local
mail server by SMTP, while others use /bin/mail.

   If done correctly, the header of a forged message will be *exactly*
   identical to the header of the message had it been authentic.  If
   there's any way of identifying the forgery in such a case it's via
   logs of network activity, not the message itself.  And yes, if you
   have a resonably good understanding of what a correct message
   header /should/ look like, it's quite trivial to execute such a
   forgery.

If you run a modern mail server it should be detectable.  For example
there is a mail server on a dedicated machine here - ppsw1.cam.ac.uk -
but it won't let you pretend to be an arbitrary person.  If your
machine is running RFC931 you won't be able to pretend to be anyone at
all; if not you will be able to pretend to be any user on the machine
you are sending the forged message from.  This is very different from
being able to pretend to be any user on the Internet.

Old mailers will accept anything they are fed by the forgers, and
these mailers should really be upgraded.
--
---------------------------------------------+ "A tight hat can be stretched.
Pete Chown, pc123@phx.cam.ac.uk (Internet)   |  First damp the head with steam
            pc123@uk.ac.cam.phx (Janet :-)  -+  from a boiling kettle."