Email spoofing

Email spoofing is the creation of email messages with a forged sender address. It is easy to do

Because the core protocols do not have any mechanism for authentication. It can be accomplished from within a LAN or from an external environment using Trojan horses.[1] Spam and phishing emails typically use such spoofing to mislead the recipient about the origin of the message.

Technical detail

When an SMTP email is sent, the initial connection provides two pieces of address information:

Together these are sometimes referred to as the "envelope" addressing, by analogy with a traditional paper envelope.[2]

Once the receiving mail server signals that it accepted these two items, the sending system sends the "DATA" command, and typically sends several header items, including:

The result is that the email recipient sees the email as having come from the address in the From: header; they may sometimes be able to find the MAIL FROM address; and if they reply to the email it will go to either the address presented in the From: or Reply-to: header - but none of these addresses are typically reliable,[3] so automated bounce messages may generate backscatter.

Use by spam and worms

Malware such as Klez and Sober and many more modern examples often search for email addresses within the computer they have infected, and use those addresses both as targets for email, but also to create credible forged From fields in the emails that they send, so that these emails are more likely to be opened. For example:

Alice is sent an infected email which she opens, running the worm code.
The worm code searches Alice's email address book and finds the addresses of Bob and Charlie.
From Alice's computer, the worm sends an infected email to Bob, but forged to appear to have been sent by Charlie.

In this case, even if Bob's system detects the incoming mail as containing malware, he sees the source as being Charlie, even though it really came from Alice's computer; meanwhile Alice remains unaware that her computer has been infected with a worm.

Fooling media

It has happened that the media printed false stories based on spoofed e-mails.

Legitimate use

In the early Internet, "legitimately spoofed" email was common. For example, a visiting user might use the local organization's SMTP server to send email from the user's foreign address. Since most servers were configured as "open relays", this was a common practice. As spam email became an annoying problem, these sorts of "legitimate" uses fell out of favor.

When multiple software systems communicate with each other via email, spoofing may be required in order to facilitate such communication. In any scenario where an email address is set up to automatically forward incoming emails to a system which only accepts emails from the email forwarder, spoofing is required in order to facilitate this behavior. This is common between ticketing systems which communicate with other ticketing systems.

The effect on mailservers

Traditionally, mail servers could accept a mail item, then later send a Non-Delivery Report or "bounce" message if it couldn't be delivered or had been quarantined for any reason. These would be sent to the "MAIL FROM:" aka "Return Path" address. With the massive rise in forged addresses, Best Practice is now to not generate NDRs for detected spam, viruses etc.[5] but to reject the email during the SMTP transaction. When mail administrators fail to take this approach, their systems are guilty of sending "backscatter" emails to innocent parties - in itself a form of spam - or being used to perform "Joe job" attacks.

Identifying the source of the email

Although email spoofing is effective in forging the email address, the IP address of the computer sending the mail can generally be identified from the "Received:" lines in the email header.[6] In many cases this is likely to be an innocent third party infected by malware that is sending the email without the owner's knowledge.

Counter measures

SSL/TLS in mail transfer software can be used to enforce authentication, but is seldom used for this in practice.[7] However a number of effective systems are widely used, including:

Although their use is increasing, estimates vary widely as to what percentage of emails have no form of domain authentication: from 8.6%[8] to "almost half",[9][10][11] but to effectively stop forged email being delivered, receiving mail systems also need to be configured to check this authentication.

See also

External links and references

  1. ↑ SMEmail – A New Protocol for the Secure E-mail in Mobile Environments, Proceedings of the Australian Telecommunications Networks and Applications Conference (ATNAC'08), pp. 39–44, Adelaide, Australia, December 2008.
  2. ↑ "A quick overview of SMTP", University of Toronto
  3. ↑ http://www.slate.com/id/2063042/
  4. ↑ Fraudsters’ fingerprints on fake Samsung deal
  5. ↑ See RFC3834
  6. ↑ "e-mail impersonators: identifying “spoofed” e-mail", http://www.wwlegal.com/
  7. ↑
  8. ↑ "Internet-wide efforts to fight email phishing are working", Google
  9. ↑ "SPF Deployment Trends", Lars Eggert
  10. ↑ "DKIM Deployment Trends", Lars Eggert
  11. ↑ "In First Year, DMARC Protects 60 Percent of Global Consumer Mailboxes", dmarc.org
This article is issued from Wikipedia - version of the Wednesday, May 04, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.