Spoofed Emails

admin — Thu, 12 Nov 2009 23:07:39 +0000

Ever encountered a time that you received an email supposedly coming from a contact but which your contact did not send to you? Or maybe a friend getting emails from you that you did not make?

The technology behind email sending is inherently unsecure. It would be easy to spoof or create any email that you would like to use. If only there is a way to somehow digitally imprint a unique signature into your emails to show authenticity of a given email source, then spoofed or fraudulent emails would not have a place in this world.

Until then, we should be able to recognize what is indeed a genuine email from hoax emails. As a first rule, whatever seems unreal maybe just that- not real. To confirm whether an email indeed came from a valid source, one may look at its full email headers to take a hint. (Now if the email source was correct, perhaps your email account was used without your permission but that is altogether another thing.)

Depending on what you are using- a web based email like Yahoo! or Gmail or if you are using an email client like Thunderbird, Evolution or Outlook- there are different ways to look at the full email headers. I shall not discuss it in here but you may consult relevant documentations.

This is an email header from a legitimate Yahoo! account to another Yahoo! account.

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=ZANLaoVFNJX8hJf/GCwrO578JoSeJGRIFr//vrhBBwO58vpUKMg1660syExDkK0w/qtb9HTJnj1qByE3dSyvv8DpWif8pg66HwnBnhpQtPK0nG2Axe1Jkns2hFlQCr+W5I6Z8IFW3EnC8fIF/WySIF5BMICTn+rVrNUlX0M8Tys=;
Message-ID: <101811.11242.qm@web44711.mail.sp1.yahoo.com>
Date: Wed, 11 Nov 2009 11:34:02 -0800 (PST)
From: True Sender
Subject: subject
To: True Recipient
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”0-637299057-1257968042=:11242″
Content-Length: 1675

This is the email header from one claiming to be from Yahoo! which was received by another email server. Notice the existence of an unwanted domain.

by a.corporateemail.com (Postfix) with ESMTP id 1887F9A7AC
for ; Mon, 9 Nov 2009 04:03:13 +0800 (PHT)
Received: from mxfirewall1.corporateemail.com (localhost [127.0.0.1])
by mxfirewall1.corporateemail.com (Proxmox) with ESMTP id 8324734C784
for ; Mon, 9 Nov 2009 04:18:20 +0800 (PHT)
Received: from netzona.cz (alfa.netzona.cz [89.187.131.211])
by mxfirewall1.corporateemail.com (Proxmox) with ESMTP id EE61C34C5E4
for ; Mon, 9 Nov 2009 04:18:17 +0800 (PHT)
Received: from /spool/local
by netzona.cz with [XMail 1.24 LMAIL Server]
for from ;
Sun, 8 Nov 2009 21:18:11 +0100
To: poorrecipient@corporateemail.com, poorrecipient@corporateemail.com,
poorrecipient@corporateemail.com
Subject: DEROGATORY SUBJECT!!!!
From: I am not as I am
MIME-version: 1.0
X-Priority: 1 (Highest)
Importance: High
X-Mailer: yahoomail.com
Reply-To: I am not as I am
Content-Type: text/plain; charset=”iso-8859-2″
Content-Transfer-Encoding: base64
Date: Sun, 8 Nov 2009 21:18:10 +0100
Message-Id: <20091108201818.EE61C34C5E4@mxfirewall1.corporateemail.com>

I shall also post the email headers of a sender disguising as a Yahoo! account and was sent to another Yahoo! account soon.

I have seen a case of a spoofed Yahoo! email account sent to another Yahoo! email account. The email subject is almost always something that would elicit the recipients curiosity thereby opening the said email and any atttachment it has. Little do the recipient know that the attachment contains a harmful software that may damage his/her computer.

What I do not understand is- why can’t Yahoo! flag emails like this as spam or suspicious? Is it hard to trace emails claiming to be from Yahoo! but which did not come from them?

Whatever the motive of the sender is- be it to make a prank, to fool someone etc., if we know how to tell a good email from something that is fishy, then basically this cheap trick of faking an email would be useless for us. Whoever is doing it only achieves one thing- that is, he makes a fool of himself and wastes his own time. Time which instead would have been spent on more productive things.

GREATWEBHOST.COM.PH » netzona

Spoofed Emails