Article View: vmsnet.mail.pmdf
Article #678Did a rewritten "From:" make a message appear forged?
From: Aidan Evans
Date: Thu, 17 Dec 1992 14:46
Date: Thu, 17 Dec 1992 14:46
44 lines
2620 bytes
2620 bytes
One of our users (ECH) got a message that said in the VMS MAIL "From:" line:
From: IN%"hannon@ac.dal.ca" 16-DEC-1992 11:55:18.99
and replied to that message. When user "hannon" got the reply she was
surprised, because she hadn't sent the original message. She was worried that
someone was forging mail.
We got ECH to send us the original message he replied to. The headers,
including VMS MAIL's, looked like this:
From: IN%"hannon@ac.dal.ca" 16-DEC-1992 11:55:18.99
To: IN%"ECH@ac.dal.ca"
CC:
Subj: Beer compatible solder
Return-path: <hannon@sparc3303.cacd.cr.rockwell.com>
Received: from sparc3303.cacd.cr.rockwell.c (sparc3303.cacd.cr.rockwell.com) by
AC.DAL.CA (PMDF #2545 ) id <01GSDREERFN4001Z65@AC.DAL.CA>; Wed,
16 Dec 1992 11:28:35 -0400
Received: from pc234sun2601.cacd.cr.rockwell.com ([131.198.60.234]) by
sparc3303.cacd.cr.rockwell.com (4.0/SMI-4.0) id AA15863; Wed,
16 Dec 92 09:27:56 CST
Date: 16 Dec 1992 09:25:20 +0000
From: hannon@ac.dal.ca (<hannon@sparc3303.cacd.cr.rockwell.com>)
Subject: Beer compatible solder
To: ECH@ac.dal.ca
Message-id: <QB2F4A61@pc234sun2601>
Content-transfer-encoding: 7BIT
My theory, based on the domain name "pc234sun2601.cacd.cr.rockwell.com" in
one of the "Received:" lines, is that a badly written PC mail program wrote
the original "From:" line like
From: hannon (<hannon@sparc3303.cacd.cr.rockwell.com>)
and that PMDF rewrote "hannon" to "hannon@ac.dal.ca". Is this possible? If
so, is there any way to prevent PMDF from doing this? I can see it might be
difficult, given that mapping my theoretical "From:" line to VMS MAIL might
produce ``From: IN%"hannon"'' which is not much better than what was done in
the first place.
Aidan Evans (AE@AC.Dal.CA), Computer Facilities & Operations,
University Computing & Information Services, Dalhousie University,
Halifax, N.S., Canada, B3H 4H8
Technical Details
Message-ID:
<01GSF445WO760023A4@AC.DAL.CA>Path:
arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!mccall!ipmdf-newsgate!listShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!mccall!ipmdf-newsgate!list Newsgroups: vmsnet.mail.pmdf Subject: Did a rewritten "From:" make a message appear forged? Message-ID: <01GSF445WO760023A4@AC.DAL.CA> From: Aidan Evans <ae@ac.dal.ca> Date: 17 Dec 1992 10:46:24 -0400 Organization: The Internet Return-Path: <epmdf@YMIR.CLAREMONT.EDU> Resent-Date: 17 Dec 1992 10:46:24 -0400 Resent-From: epmdf@YMIR.CLAREMONT.EDU Errors-To: epmdf@YMIR.CLAREMONT.EDU Resent-Message-ID: <01GSEWUZSAJ690MWCV@YMIR.CLAREMONT.EDU> X-Vms-To: IN%"ipmdf@ymir" X-Vms-Cc: AE Mime-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII Content-Transfer-Encoding: 7BIT Lines: 44