Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose a guy sends emails through a service that sends newsletters, but he copies an invitation sent to him, and uses this service to send more invitations to uninvited people, and puts the email of the host as the sender. Can we know who did that? Is there something in the email that could let us know the service he used, or any other way to know from where came this fake invitation?

share|improve this question
3  
Step 1: email server headers. Step 2: subpoenas. –  Jeff Ferland Nov 28 '12 at 6:30
    
Or, if you're not law enforcement... Step 1: email server headers. Step 2: Police. In the US it's a violation of the CAN-SPAM act to send unsolicited marketing or scam emails. –  Polynomial Nov 28 '12 at 6:59
    
@JeffFerland Polynomial Thanks a lot, in what kind of trouble is the guy who sent the fake invitations? It was just annoying, not anything to see with money, but it was a private event for 25 people, and it was sent to we-dont-know-how-many people. Thanks –  Pauls Nov 28 '12 at 8:37
    
He's in no trouble at all @Pauls, sending a few fake invitations isn't going to be enough to get anyone in law enforcement interested as they have bigger fish to fry. The perp will almost certainly get away with it. –  GdD Nov 28 '12 at 9:28
1  
I'm having a hard time following what you are actually describing, but the short answer is probably not. E-mail isn't an at all secure format and the sender can be easily faked. It sounds like this may have been done through some online service at which point figuring out the sender would be completely dependent on the policies of the service doing the sending. The e-mail header as updated by your mail server should at least have the IP address or URL of the server it received the mail from. That would be your best start. –  AJ Henderson Nov 28 '12 at 14:09
show 4 more comments

1 Answer

Bottom line - forget about it and move on

Email is inherently insecure. It is a trivial task to fake mail headers, there are far too many insecure and misconfigured mail servers which will accept/dispatch/relay messages from anywhere and there are numerous services available to send 'anonymous' messages. While mail headers may provide some information, you have to treat the information as suspect and only use it as a possible indicator.

The situation is further complicated by the fact that this is a global issue. While many countries have legislation which prohibits sending of unsolicited email and/or prohibits using false information, such as sender details, the ability of law enforcement to do anything about it is limited. We have about 50,000 users where I work and over 70-80% of the email traffic delivered to our sight is identified as spam (that is a conservative estimate). Even if law enforcement was able to do something about this, just the huge volume is enough that they will only be able to investigate a very small percentage. I suspect if you did report your case, the authority concerned would possibly take down your details and then file it in the round filing cabinet under their desk.

There is also the added complication of viruses and malware. There have been numerous examples of these using local adress books to send emails under the credentials of the system owner without them even being aware it is going on. This makes it even more difficult to prove a message has been sent deliberately and with intent. Even if it wasn't done by a virus or malware, the user could easily say, "yes, sorry about that, I accidentally hit the wrong button". Unless you can show repeated and deliberate malicious behaviour, there is little that can be done.

There are ways to make email more secure. Unfortunately, few if any, are transparent to the recipient. For example, you could use certificates and/or PGP signatures etc, but unless the recipients client is able to handle such techniques, there is little point. This also won't stop someone with malicious intent who is a legitimate recipient of your message from doing something like re-distributing your invite to others.

Tim

share|improve this answer
    
Thanks, i understand, thanks for the details. I think the most important now is to find the guy, then i think we will see, about the law, someone caught has already lost something, his status of "anonymous", and i think this is the most important for those who were annoyed by this. Thanks anyway! –  Pauls Nov 30 '12 at 21:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.