Virgin UNIX accounts wanted! Upload info to Hacker7s HP-48 conf.

/f

 Area: alt.hackers 
  Msg#: 202                                          Date: 12 Mar 95  11:01:51
  From: Rourke McNamara                              Read: Yes    Replied: No 
    To: All                                          Mark:                     
  Subj: Fake Mail FAQ

From: rourke@seas.upenn.edu (Rourke McNamara)
Subject: Fake Mail FAQ
Date: Thu, 12 Mar 1995 16:01:51 -0500
Organization: University of Pennsylvania

I just through the following together. Anyone have any suggestions/comments?


T H E  "F A K E  M A I L"  F A Q 
Version 0.2 950312
Written by Rourke McNamara
(rourkem@pobox.com)

A good number of people have asked me questions about how possible it is to
"Fake Mail" on the internet. People have asked both becuase they wanted to know
if someone could do to them or becuase they wanted to do it to someone else. I
decided that I'd write a small FAQ on the subject and add to it as I have time.


(1) Can people send "fake" mail on the Internet?

Yes. People can send mail that looks like it came from someone else. People can
send mail that looks like it was received by more people than actually received
it. HOWEVER, only very rarely is this mail truly indistinguishable from
mail that really DID come from the person in question.

In any case the ONLY real way to be completely sure a message is from a
particular person is to have that person digitally "sign" the message with
something like PGP.


(2) How do you know if a message you have is "fake"?

You can't always tell for sure. If the person was sloppy the message will 
have a line in the the header block (the text above the message with date and
subject, etc information) that says something like "Apparently-To:". You can
also compare the full headers of the message to the full set of headers on
another message that you have received from that person. If they don't come
close to matching then ONE OF THEM is probably "fake". Also look for computer
names in the headers that have nothing to do with your information provider
or his information provider.

In order to be better able to spot fake mail you need to understand how it is
sent. To do that see the section on sending fake mail below.

The above don't always work. If the person sending the "fake" message is
particularly crafty he can make the headers look so similar it is nearly
impossible to catch. In this case you would have to ask the person who
'sent' you the message whether or not it was really him.


(3) Why is it possible to "fake" mail?

It is possible to fake mail becuase all computer on the internet send mail
around using something called SMTP - Simple Mail Transfer Protocal - and it is
possible for a human to connect to a computer and pretend that it is another
computer by speaking SMTP. This problem will not go away. Mail programs (both
clients and SendMail servers) will probably learn to better recognize when
someone is trying to send fake mail, but they will most likely never be able
to detect EVERYTHING.


(4) How can I "fake" mail?

That is perhaps the question that is hardest to answer and will take the
longest, so I will start with the basic and most detectable technique and
work up to the most complicated and hard to detect technique. Of course,
faking mail REALLY well is not such an easy and mechanical process.
It requirs some amount of creativity in the techniques you apply.
So, lets start with the basics....

(a) The Basics

To send fake mail you need to pretend that you are a computer transfering mail
legitimatly. You start by telnetting to the SMTP socket (25) on the remote
computer. For example, if I wanted to telnet to Cornell's SMTP port I would
type the following from a UNIX prompt: 

-> telnet cornell.edu 25

Once you have connected you ussually have to issue a "helo" command. You
basically are saying hello to the other computer an telling it who you are. For
now lets just claim to be the computer that we are sending mail "from". For
this example lets pretend to be rf34+@andrew.cmu.edu. Lets send this message to
"jmk17@cornell.edu" (he loves getting junk mail): 

< helo andrew.cmu.edu

Sometimes there is an error entering that command. Enter it again and it will
work. After that we have to move on to starting the message and annoucing who
it is from. We do this with the "mail" command. The syntax is "mail from:

<noone@nowhere.com>" 

where the <>'s are optional on most systems. In out example we would type: 

< mail from: rf34+@andrew.cmu.edu

After specifying who the mail it from we must specify who the mail is to. We
do this by using the "rcpt" command. The syntax of this command is "rcpt to:
<bob@nowhere.com>" where the <>'s are once again optional. This has nothing
to do with who it APPEARS to get the message. The addresses specified with this
command will actually receive the message. In our example we would issue the
command like so:
 
< rcpt to: jmk17@cornell.edu

Next comes the actual message. You send specify the text of the message is to
follow by using the "data" command to begin and end with a "." on a line by
itself. In our example we would do the following: 

< data 
> (answerback garbage) 
< You suck. I hate you. 
< .

Now we're almost done. All we have to do now is quit. We do this by typing
"quit". 

< quit

(b) What about the headers?

The above message will be easy to spot as "fake". Instead of saying "To:
jmk17@cornell.edu" it will say "Apparently To: jmk17@cornell.edu". Similar will
happen with from and there will be no subject. To fix these problems we must
manually enter headers for the message. Here I will just talk about the most
important headers - To:, From:, Cc:, and Subject:.

The "To:" header will be who the recipient sees that the message is "To:".
If the recipient "group replies" he will reply to all people listed after "To:"
and "Cc:" other than himself.

The "From:" header specifies who the message is from. You should always have the
address that you used in the "mail from:" command somewhere here. It looks more
real if you include the persons real name when issuing this command. One way to
do that is to have the email address and then the real name in parenthesis.

The "Subject:" line is what appears to the recipient as the subject. End of
story.

You enter the header when entering the message. Lets alter our above example so
that we want it to look like bob@nowhere.net gets a carbon copy. We don't want
him to get a copy - we just want jmk17@cornell.edu to think so. All we would do
is change the second to last step so it looks like this: 
< data 
> (answerback garbage) 
< To: jmk17@cornell.edu 
< From: rf34+@andrew.cmu.edu (Randy Fields) 
< Subject: I hate you! 
< Cc: bob@nowhere.net 
< 
< You suck. I hate you. 
< .

Note the space between the headers and the message. That is very important.

Now when jmk17@cornell.edu gets our message it will look like a normal message
from his friend Randy. If he had extensive knowledge regarding the way mail
worked he's be able to figure out that it came from your computer and not
andrew.cmu.edu by looking at the extended headers. Since jmk17@cornell.edu is
just your average computer user he can look at the message all day and not see
a problem with it.


-=-=-=-=-=-=-=-=-=-=-=- 
This FAQ will be updated periodically. It can be found on Rourke's Home Page at

URL http://matrix.resnet.upenn.edu/rourke/ _or_
http://www.seas.upenn.edu/~rourkem

If you have any questions, suggestions, corrections, or comments please email
Rourke at rourkem@pobox.com.

-- 
Rourke McNamara
School of Engineering and Applied Science
University of Pennsylvania
rourkem@seas.upenn.edu
http://matrix.resnet.upenn.edu/rourke/home.html