Fake Mail FAQ

Article: 7501 of alt.hackers
From: rourke@seas.upenn.edu (Rourke McNamara)
Newsgroups: alt.hackers,alt.hackers
Subject: Fake Mail FAQ
Date: Thu, 09 Mar 1995 16:01:51 -0500
Organization: University of Pennsylvania
Lines: 174
Approved: GodNeedthNotSeekApproval
Message-ID: rourke-0903951601510001@matrix.resnet.upenn.edu
NNTP-Posting-Host: matrix.resnet.upenn.edu
Status: RO

I just through the following together. Anyone have any suggestions/comments?


T H E  "F A K E  M A I L"  F A Q
Version 0.2 950309
Written by Rourke McNamara
(rourkem@pobox.com)

A good number of people have asked me questions about how possible it is
to "Fake
Mail" on the internet. People have asked both becuase they wanted to
know if
someone could do to them or becuase they wanted to do it to someone else. I
decided that I'd write a small FAQ on the subject and add to it as I have time.


(1) Can people send "fake" mail on the Internet?

Yes. People can send mail that looks like it came from someone else. People can
send mail that looks like it was received by more people than actually received
it. HOWEVER, only very rarely is this mail truly indistinguishable from
mail that
really DID come from the person in question.

In any case the ONLY real way to be completely sure a message is from a
particular person is to have that person digitally "sign" the
message with
something like PGP.


(2) How do you know if a message you have is "fake"?

You can't always tell for sure. If the person was sloppy the message will
have a
line in the the header block (the text above the message with date and subject,
etc information) that says something like "Apparently-To:". You
can also compare
the full headers of the message to the full set of headers on another message
that you have received from that person. If they don't come close to matching
then ONE OF THEM is probably "fake". Also look for computer names
in the headers
that have nothing to do with your information provider or his information
provider.

In order to be better able to spot fake mail you need to understand how it is
sent. To do that see the section on sending fake mail below.

The above don't always work. If the person sending the "fake"
message is
particularly crafty he can make the headers look so similar it is nearly
impossible to catch. In this case you would have to ask the person who
'sent' you
the message whether or not it was really him.


(3) Why is it possible to "fake" mail?

It is possible to fake mail becuase all computer on the internet send mail
around
using something called SMTP - Simple Mail Transfer Protocal - and it is
possible
for a human to connect to a computer and pretend that it is another computer by
speaking SMTP. This problem will not go away. Mail programs (both clients and
SendMail servers) will probably learn to better recognize when someone
is trying
to send fake mail, but they will most likely never be able to detect
EVERYTHING.


(4) How can I "fake" mail?

That is perhaps the question that is hardest to answer and will take the
longest,
so I will start with the basic and most detectable technique and work up to the
most complicated and hard to detect technique. Of course, faking mail
REALLY well
is not such an easy and mechanical process. It requirs some amount of
creativity
in the techniques you apply. So, lets start with the basics....

(a) The Basics

To send fake mail you need to pretend that you are a computer transfering mail
legitimatly. You start by telnetting to the SMTP socket (25) on the remote
computer. For example, if I wanted to telnet to Cornell's SMTP port I
would type
the following from a UNIX prompt:
-> telnet cornell.edu 25

Once you have connected you ussually have to issue a "helo"
command. You
basically are saying hello to the other computer an telling it who you are. For
now lets just claim to be the computer that we are sending mail
"from". For this
example lets pretend to be rf34+@andrew.cmu.edu. Lets send this message to
"jmk17@cornell.edu" (he loves getting junk mail):
< helo andrew.cmu.edu

Sometimes there is an error entering that command. Enter it again and it will
work. After that we have to move on to starting the message and annoucing
who it
is from. We do this with the "mail" command. The syntax is
"mail from:
<noone@nowhere.com>" where the <>'s are optional on most
systems. In out example
we would type:
< mail from: rf34+@andrew.cmu.edu

After specifying who the mail it from we must specify who the mail is to. We do
this by using the "rcpt" command. The syntax of this command is
"rcpt to:
<bob@nowhere.com>" where the <>'s are once again
optional. This has
nothing to do
with who it APPEARS to get the message. The addresses specified with this
command
will actually receive the message. In our example we would issue the
command like
so:
< rcpt to: jmk17@cornell.edu

Next comes the actual message. You send specify the text of the message is to
follow by using the "data" command to begin and end with a
"." on a line by
itself. In our example we would do the following:
< data
> (answerback garbage)
< You suck. I hate you.
< .

Now we're almost done. All we have to do now is quit. We do this by typing
"quit".
< quit

(b) What about the headers?

The above message will be easy to spot as "fake". Instead of
saying "To:
jmk17@cornell.edu" it will say "Apparently To:
jmk17@cornell.edu". Similar will
happen with from and there will be no subject. To fix these problems we must
manually enter headers for the message. Here I will just talk about the most
important headers - To:, From:, Cc:, and Subject:.

The "To:" header will be who the recipient sees that the message
is "To:".
If the
recipient "group replies" he will reply to all people listed after
"To:" and
"Cc:" other than himself.

The "From:" header specifies who the message is from. You should
always have the
address that you used in the "mail from:" command somewhere here. It
looks more
real if you include the persons real name when issuing this command. One way to
do that is to have the email address and then the real name in parenthesis.

The "Subject:" line is what appears to the recipient as the
subject. End of
story.

You enter the header when entering the message. Lets alter our above example so
that we want it to look like bob@nowhere.net gets a carbon copy. We don't want
him to get a copy - we just want jmk17@cornell.edu to think so. All we would do
is change the second to last step so it looks like this:
< data
> (answerback garbage)
< To: jmk17@cornell.edu
< From: rf34+@andrew.cmu.edu (Randy Fields)
< Subject: I hate you!
< Cc: bob@nowhere.net
<
< You suck. I hate you.
< .

Note the space between the headers and the message. That is very important.

Now when jmk17@cornell.edu gets our message it will look like a normal message
>from  his friend Randy. If he had extensive knowledge regarding the
way mail
worked he's be able to figure out that it came from your computer and not
andrew.cmu.edu by looking at the extended headers. Since jmk17@cornell.edu is
just your average computer user he can look at the message all day and not
see a
problem with it.


-=-=-=-=-=-=-=-=-=-=-=-
This FAQ will be updated periodically. It can be found on Rourke's Home Page at
URL http://matrix.resnet.upenn.edu/rourke/ _or_
http://www.seas.upenn.edu/~rourkem

If you have any questions, suggestions, corrections, or comments please email
Rourke at rourkem@pobox.com.

--
Rourke McNamara
School of Engineering and Applied Science
University of Pennsylvania
rourkem@seas.upenn.edu
http://matrix.resnet.upenn.edu/rourke/home.html

Back to index