🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: vmsnet.mail.pmdf
Article #678

Did a rewritten "From:" make a message appear forged?

#678
From: Aidan Evans
Date: Thu, 17 Dec 1992 14:46
44 lines
2620 bytes
  One of our users (ECH) got a message that said in the VMS MAIL "From:" line:

        From:   IN%"hannon@ac.dal.ca" 16-DEC-1992 11:55:18.99

and replied to that message.  When user "hannon" got the reply she was
surprised, because she hadn't sent the original message.  She was worried that
someone was forging mail.
  We got ECH to send us the original message he replied to.  The headers,
including VMS MAIL's, looked like this:

From:   IN%"hannon@ac.dal.ca" 16-DEC-1992 11:55:18.99
To:     IN%"ECH@ac.dal.ca"
CC:
Subj:   Beer compatible solder

Return-path: <hannon@sparc3303.cacd.cr.rockwell.com>
Received: from sparc3303.cacd.cr.rockwell.c (sparc3303.cacd.cr.rockwell.com) by
 AC.DAL.CA (PMDF #2545 ) id <01GSDREERFN4001Z65@AC.DAL.CA>; Wed,
 16 Dec 1992 11:28:35 -0400
Received: from pc234sun2601.cacd.cr.rockwell.com ([131.198.60.234]) by
 sparc3303.cacd.cr.rockwell.com (4.0/SMI-4.0) id AA15863; Wed,
 16 Dec 92 09:27:56 CST
Date: 16 Dec 1992 09:25:20 +0000
From: hannon@ac.dal.ca (<hannon@sparc3303.cacd.cr.rockwell.com>)
Subject: Beer compatible solder
To: ECH@ac.dal.ca
Message-id: <QB2F4A61@pc234sun2601>
Content-transfer-encoding: 7BIT

  My theory, based on the domain name "pc234sun2601.cacd.cr.rockwell.com" in
one of the "Received:" lines, is that a badly written PC mail program wrote
the original "From:" line like

        From: hannon (<hannon@sparc3303.cacd.cr.rockwell.com>)

and that PMDF rewrote "hannon" to "hannon@ac.dal.ca".  Is this possible? If
so, is there any way to prevent PMDF from doing this?  I can see it might be
difficult, given that mapping my theoretical "From:" line to VMS MAIL might
produce ``From: IN%"hannon"'' which is not much better than what was done in
the first place.

Aidan Evans (AE@AC.Dal.CA), Computer Facilities & Operations,
University Computing & Information Services, Dalhousie University,
Halifax, N.S., Canada, B3H 4H8
Technical Details
Message-ID: <01GSF445WO760023A4@AC.DAL.CA>
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!mccall!ipmdf-newsgate!list

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!mccall!ipmdf-newsgate!list
Newsgroups: vmsnet.mail.pmdf
Subject: Did a rewritten "From:" make a message appear forged?
Message-ID: <01GSF445WO760023A4@AC.DAL.CA>
From: Aidan Evans <ae@ac.dal.ca>
Date: 17 Dec 1992 10:46:24 -0400
Organization: The Internet
Return-Path: <epmdf@YMIR.CLAREMONT.EDU>
Resent-Date: 17 Dec 1992 10:46:24 -0400
Resent-From: epmdf@YMIR.CLAREMONT.EDU
Errors-To: epmdf@YMIR.CLAREMONT.EDU
Resent-Message-ID: <01GSEWUZSAJ690MWCV@YMIR.CLAREMONT.EDU>
X-Vms-To: IN%"ipmdf@ymir"
X-Vms-Cc: AE
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-Transfer-Encoding: 7BIT
Lines: 44