🚀 go-pugleaf

In article <1992Nov10.201503.6288@gw.wmich.edu> 873nikorawal@gw.wmich.edu writes:
>  What I do not understand is that how a user can send mail to a different user
>on the same system, and make it appear as though it has been sent by the
>operator or any other user on the system. Unless Of-course he has access to the
>operator/other persons account !!!!!

It's trivial, but we're not going to tell you how to do it.

>							Curiocity !!!!!!

I don't ever flame people for bad spelling, but the six exclamation marks
are unforgivable.

--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629

> It's trivial, but we're not going to tell you how to do it.

Sure we will.

RTFRFC

873nikorawal@gw.wmich.edu writes:

>  What I do not understand is that how a user can send mail to a different user
>on the same system, and make it appear as though it has been sent by the
>operator or any other user on the system. Unless Of-course he has access to the
>operator/other persons account !!!!!

>							Curiocity !!!!!!

Its a rather simple exercise to forge email from anyone at anywhere.
I of course am not going to say how its done, other than to say it's
pretty trivial to accomplish this. Basically I could send you mail from
root on your machine without ever having logged in or been near that 
machine.

James

probreak@kitty.ksu.ksu.edu (James Michael Chacon) writes:

>873nikorawal@gw.wmich.edu writes:

>>  What I do not understand is that how a user can send mail to a different user
>>on the same system, and make it appear as though it has been sent by the
>>operator or any other user on the system. Unless Of-course he has access to the
>>operator/other persons account !!!!!

>>							Curiocity !!!!!!

>Its a rather simple exercise to forge email from anyone at anywhere.
>I of course am not going to say how its done, other than to say it's
>pretty trivial to accomplish this. Basically I could send you mail from
>root on your machine without ever having logged in or been near that 
>machine.

>James
Even if I installed tcp wrapper ?
	Mx
-- 
 -- Massimo Cotrozzi  Computer Science Dept. Milan Italy
            cotrozzi@ghost.dsi.unimi.it  +39-2-27201253
 #include     <std/disclaimer.h>

In article <1992Nov12.141902.5402@ghost.dsi.unimi.it> cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:
>Even if I installed tcp wrapper ?

tcp-wrapper won't be very helpful in the suggested scenario... unless
the victim has reason to /suspect/ a forgery why would s/he ask the
sysadmin to check the logs?  Of course if the sysadmin regularly checks
both the sendmail and wrapper logs, s/he might notice something amiss,
but it still won't help you track down the perp unless s/he happened
to be nice/foolish enough to execute the forgery on a machine that's
running authd, and from his/her own account.

--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629

In article <1992Nov12.141902.5402@ghost.dsi.unimi.it> cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:
>probreak@kitty.ksu.ksu.edu (James Michael Chacon) writes:
>
>>pretty trivial to accomplish this. Basically I could send you mail from
>>root on your machine without ever having logged in or been near that 
>>machine.
>
>>James

>Even if I installed tcp wrapper ?

You spawn sendmail out of inetd?  How would you disable forgeries without
affecting legitimate mail connections?

--Dave
-- 
System Administrator, Population Research Institute    barr@pop.psu.edu

>
>It's trivial, but we're not going to tell you how to do it.
>
OK, so if you won't say how to do it (possibly reasonable enough...).
Can you say how to prevent it?
Can you say how to detect it?
Is it truly that trivial and foolproof?  Or does it just make the header *look*
like it came from someone else (read root) to the non-attentive eye?

						-tcvz

-- 
Ted C Van Zwol                           |    Genius does what it must,
uucp:      {...!}uunet!bcstec!vanzwol    |    Talent does what it can.
internet:  vanzwol@bcstec.ca.boeing.com  |                  -Emerson
                         ^^^^ new...

In article <4225@bcstec.ca.boeing.com> vanzwol@bcstec.ca.boeing.com (Ted Van Zwol) writes:
>OK, so if you won't say how to do it (possibly reasonable enough...)
>Can you say how to prevent it?

With the current set of Internet standard protocols, there is no way of
preventing forged mail.  The technology to do that exists with public-key
crytography and electronic signatures, but since there are not yet any
widely implemented standards for using this technology on the net, it is
not practical for an individual to do so.

>Can you say how to detect it?

Detection is trick... if the message was a forgery of a "local" message on
a Unix system, you can probably detect it from the sendmail logs; if they
message were authentic it would not have passed through SMTP.  If the
forgery was one where a user spoofed a user on a remote system, you might
need cooperation of the sysops of other systems along the route for 
reliable detection, making it practically very difficult if the forger
was clever.

Note that the former covers the case Mr. caps-and-exclamation-marks was
asking about; it is quite easy to detect the case where a user of a multi-
user Unix system tries to spoof a message from "root" (however, detection
will be from the logs, not the message itself.)

>Is it truly that trivial and foolproof?  Or does it just make the
>header *look* like it came from someone else (read root) to the
>non-attentive eye?

If done correctly, the header of a forged message will be *exactly* identical
to the header of the message had it been authentic.  If there's any way of
identifying the forgery in such a case it's via logs of network activity,
not the message itself.  And yes, if you have a resonably good understanding
of what a correct message header /should/ look like, it's quite trivial to
execute such a forgery.

Note however that in many cases of actual forgeries the headers might
provide a clue to the fact that the message is a forgery because a lot
of the forgers do /not/ really understand what a correct message header
looks like, or conversely, they produce a "correct" looking header but
the real system would have produced different or less correct one.
--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629

In article <BxrJCL.9sC@mtholyoke.edu> jbotz@mtholyoke.edu (Jurgen
Botz) writes:

   >Can you say how to detect it?

   Detection is trick... if the message was a forgery of a "local"
   message on a Unix system, you can probably detect it from the
   sendmail logs; if they message were authentic it would not have
   passed through SMTP.

Be careful.  Remember that different users will use different programs
for reading their mail.  Some of these programs connect to the local
mail server by SMTP, while others use /bin/mail.

   If done correctly, the header of a forged message will be *exactly*
   identical to the header of the message had it been authentic.  If
   there's any way of identifying the forgery in such a case it's via
   logs of network activity, not the message itself.  And yes, if you
   have a resonably good understanding of what a correct message
   header /should/ look like, it's quite trivial to execute such a
   forgery.

If you run a modern mail server it should be detectable.  For example
there is a mail server on a dedicated machine here - ppsw1.cam.ac.uk -
but it won't let you pretend to be an arbitrary person.  If your
machine is running RFC931 you won't be able to pretend to be anyone at
all; if not you will be able to pretend to be any user on the machine
you are sending the forged message from.  This is very different from
being able to pretend to be any user on the Internet.

Old mailers will accept anything they are fed by the forgers, and
these mailers should really be upgraded.
--
---------------------------------------------+ "A tight hat can be stretched.
Pete Chown, pc123@phx.cam.ac.uk (Internet)   |  First damp the head with steam
            pc123@uk.ac.cam.phx (Janet :-)  -+  from a boiling kettle."

In article <1drec6INNmf3@kitty.ksu.ksu.edu> probreak@kitty.ksu.ksu.edu (James Michael Chacon) writes:
>873nikorawal@gw.wmich.edu writes:
>
>>  What I do not understand is that how a user can send mail to a different user
>>on the same system, and make it appear as though it has been sent by the
>>operator or any other user on the system. Unless Of-course he has access to the
>>operator/other persons account !!!!!
>
>>							Curiocity !!!!!!
>
>Its a rather simple exercise to forge email from anyone at anywhere.
>I of course am not going to say how its done, other than to say it's
>pretty trivial to accomplish this. Basically I could send you mail from

So, you don't study this in university? :) Well, to satisfy Curiocity !!!!!!
of original poster I would recommend ftp'ing to nic.ddn.mil and grabbing 
/rfc/rfc821.txt. Don't assume e-mail is secure. des the message with password
known to recipitant if you want to send anything important.

Oleg