Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I have received an email with an 'out of office' notification, as a reply to one of my emails, which I actually didn't send. I think it was sent automatically from my address, as a result of submitting some code, to some people that needed to be automatically notified.

  • How is this done? Is this related to the domain login?
  • What other things may I assume from this? (It is a corporate work email account)
  • Why this choice of account usage? I mean someone could be notified of my actions from any account. (I was thinking of simplicity or integration with other solutions maybe)
share|improve this question
    
Do you have a delegate who is able to send e-mails on your behalf? –  DKNUCKLES Jun 27 '12 at 19:06
    
Not that I know of. –  liviu Jun 27 '12 at 19:07
    
do you have any trace in your 'sent messages' or 'delete folder'? Can you also check your mail account activity? if you're using gmail for ex. you can see that. –  fduff Jun 27 '12 at 19:33
    
No traces. It's corporate email account, set up with Outlook. –  liviu Jun 27 '12 at 19:38
    
@DKNUCKLES "Do you have a delegate who is able to send e-mails on your behalf?" technically, you don't need to. Sending email from: DKNUCKLES@example.com is not restricted a priori –  curiousguy Jun 27 '12 at 22:06

2 Answers 2

Your question was pretty tough to follow and understand. I understood this: You got an auto-reply from someone's email, but you never sent an email to them in the first place. And you're thinking that something else sent an email as you and you want to know how that is possible. My response is based off of that assumption.

Mail forgery is pretty simple. Anyone can set up a SMTP mail server that sends email out from yourname@yourdomain.com. Most mail servers will reject it, based off of PTR and MX record checks (I believe) and they'll see it came from an IP address that doesn't quite match up with the MX records. However, I think a lot of mail servers will accept mail if it sees the "from" part is coming from it's own domain, or if the content of the email is simple (text only, no links).

That is how I can get mail from all of my servers without them being "official" mail servers for my domain. As part of my business's application, the users have the ability to email themselves content from certain parts of our app. When our mail server sends the email out, we forge the email with the user's address in the "From" part, so when they get the email, it looks like it came from themselves.

At any rate, to directly answer your question, this process can easily be scripted and put in a cron job.

share|improve this answer
    
Thanks, you understood what I meant. I don't understand however the motive, why should someone be notified from my (forged) address (and not from a notifier account or something)? There must be a reason to this –  liviu Jun 27 '12 at 19:06
    
"Anyone can set up a SMTP mail server that sends email out from yourname@yourdomain.com. Most mail servers will reject it, based off of PTR and MX record checks (I believe) and they'll see it came from an IP address that doesn't quite match up with the MX records" this is not correct, as there is no relation between MX (SMTP servers) and SMTP client email servers. Almost all legitimate email would be lost with such filtering. There no reason why all email with a particular From email address should be emitted by the same SMTP server. –  curiousguy Jun 27 '12 at 19:38
    
That's why I put "I believe" because wasn't exactly sure how that part of the mail system works. Point being, though, is that very first sentence, which is still true. It's very easy to set up a SMTP mail server that sends email out from yourname@yourdomain.com. –  Safado Jun 27 '12 at 20:24
    
@Safado "It's very easy to set up a SMTP mail server that sends email out from yourname@yourdomain.com." Yes indeed. What makes you think it is not a legitimate use? –  curiousguy Jun 27 '12 at 22:12
    
I still believe it's a legitimate use, but I don't see it yet. Better I will ask directly the ones in charge. –  liviu Jun 28 '12 at 6:04

In your e-mail account go into your "sent items folder" (or whatever it is called in your client) and look for the automated e-mail that was sent from your account. If it's not there then the e-mail may not have been sent from you and was spoofed. It's not very hard for an e-mail to have a fake "from" or "reply-to" address, so this certainly is a possibility. If it is there then you need to turn off your out of office reply. You need to tell us which e-mail client (e.g. Outlook 2007) you use for specific instructions on how to do this.

Is this related to the domain login?

Probably not.

What other things may I assume from this?

This is pretty vague question, I wouldn't assume anything from this.

Why this choice of account usage?

If it is your corporate one then maybe someone wants your colleges to think you are out of the office and not reachable. But do you have reason to believe this is malicious and not an innocent mistake or something you yourself did?

share|improve this answer
1  
"e-mail that was sent from your account" technically an email from: foo is not sent "from foo's account" –  curiousguy Jun 27 '12 at 22:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.