Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today a Belgian MP claimed (backed up by a security expert) that her email headers show that her email was read during routing (text in Dutch).

The published screenshot of the headers highlights the final line in the extended headers:

message opened by mailclient 6.73.3.0

The IP resolves to a US DOD military base (Fort Huachuca).

Searching on "message opened by mailclient" gives thousands of emails with this line, with other IP-adresses also resolving to this particular military base, but also e.g. Japanese routing nodes(?).

The only thing I can find atm. is a vague comment:

I've seen this before. IIRC, the IPs resolving to Ft Huachuca are not actually IP's, they are just numbers within the header which the program picks up as an IP.

What is the technical interpretation of this header line? What can one conclude from it?

share|improve this question
4  
a Belgian MP should not use foreign webmail to communicate about parliament work. –  tomhermans Nov 2 '13 at 19:38
    
true. answer was given, nobody mentioned the obvious. that's why I did. –  tomhermans Nov 2 '13 at 21:00
3  
I initially read the title as "opened by malicient", as in "malicious client". Interesting.. –  Thomas Nov 3 '13 at 7:29
2  
@Thomas Same here. It wasn't until after 15 minutes that I found out it's mail client and not malicient. –  Adnan Nov 3 '13 at 10:38
add comment

3 Answers

I tried to filter Google results for "message opened by mailclient" as follows:

Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after mailclient becomes (on average). It goes like this:

  • (2008) message opened by mailclient 1.0.20.1
  • (2009) message opened by mailclient 4.6.0.0
  • (2010) message opened by mailclient 6.21.11.1
  • (2011) message opened by mailclient 6.35.6.0
  • (2012) message opened by mailclient 6.54.5.0
  • (2013) message opened by mailclient 6.71.3.0

As a result, it's safe to assume that those numbers are not IP addresses, but rather version numbers of the mail client. Looks like the Belgian MP is just jealous that the NSA are tapping Angela Merkel but not her.

Now, please send this answer's link to the news paper that published that article.

share|improve this answer
5  
Thanks for the input and numbercrunching. I came to the same conclusion looking at the sourcecode of Mail.com (the webservice used by the MP), that show shows that it is indeed the version number. I just tweeted this Stackoverflow-link to a journalist and IT-specialist that were sceptical about the story, we will if there is a retraction (to bad silly stories like this get so much attention, detracting from the real surveillance-issues). –  mhermans Nov 2 '13 at 17:30
add comment
up vote 18 down vote accepted

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js.

So, the message

message opened by mailclient 6.73.3.0

means exactly that: the mailclient (you as the user) opened the email through the Mail.com webinterface.

Lesson of today: make sure the "IT-expert" you consult can differentiate between an IP-adres and a version number ;-).

share|improve this answer
add comment

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so.

Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid of me to configure my mail server to add a header to indicate that I had done so!

We would need more technical detail to know for certain what has happened here, but my money is on a poorly configured mail server, not snooping.

Edit: I'm wondering if it is a "feature" of whatever back-end is running the gmx.com (and associated domains) mail server or webmail interface. I can reproduce the "header" line in question by sending email from gmail.com to gmx.com:

I'm standing by my conclusion that the header is not indicative of snooping, and the mail server is poorly configured in the sense that it's adding a human-readable header line that has no obvious meaning.

Return-Path: [redacted]@gmail.com
Received:  from mail-vc0-f180.google.com ([209.85.220.180]) by mx-ha.gmx.net
 (mxgmxus004) with ESMTPS (Nemesis) id 0LdpQ5-1W3Tig3xaN-00iyjP for
 <[redacted]@gmx.com>; Sat, 02 Nov 2013 16:47:58 +0100
Received: by mail-vc0-f180.google.com with SMTP id lc6so3571661vcb.25
        for <[redacted]@gmx.com>; Sat, 02 Nov 2013 08:47:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:from:date:message-id:subject:to:content-type;
        bh=jEEaGY9FD1DDKh9keJ/H5F18bxsFQwr5TvXHFCrp+Sw=;
        b=Tmxrwz8d+XFaUR+iIksktPamDVVZlG8myyEKbSnrHB5WRanmnIFh4xjFCZ1zna8J9s
         28S/QqQvArf8sHey5J1ZgGqvoTVBMobWFuK3hKob3CjWrvJu+abWx6EppiDFEXGAQord
         +c/X35Ho+b0bHH1sToBHmBDqvyT0bVzrnTiZCW2r7EXI+H/MQjFcNR+NbjFlngREMTZ9
         RO0eiRKYpHr8gfMn/fOoytSFy2TrxgGhTJSy93LrhHN0qjeuY+0SkW1RvSMFjyEVtlJo
         WSuWc+i7KP1HD+MS4R0ztBi6qR6YVJzEoz3OMPv6/9T/hkysax8gPO2iBhQMQy3wg45Z
         nUBQ==
X-Received: by 10.58.54.69 with SMTP id h5mr163046vep.25.1383407277299; Sat,
 02 Nov 2013 08:47:57 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.58.32.200 with HTTP; Sat, 2 Nov 2013 08:47:27 -0700 (PDT)
From: <[redacted]@gmail.com>
Date: Sat, 2 Nov 2013 [redacted]
Message-ID: <CAMx+XZ0_O+OLEH5=6=NJeLRb[redacted]@mail.gmail.com>
Subject: [redacted]
To: [redacted]@gmx.com
Content-Type: text/plain; charset=ISO-8859-1
Envelope-To: <[redacted]@gmx.com>
X-GMX-Antispam: 0 (Mail was not recognized as spam); Detail=V3;
X-GMX-Antivirus: 0 (no virus found)
X-UI-Filterresults: notjunk:1;V01:K0:K9FP11uQyc8=:yWrrPx81cP9DKLPzL6aspyrja5
 7acFJLybJttLIn9Z4D9+wV9STt7wN1wj6S2tLrYQT8Ui495N0GvQ3FbZFt1YruK9egZuNLt+Y
 OfTRgJgCzP4fZJ4P9r35mfKGPzMRktYYrMaxD1xGAbB6dgFd/xa63i6+xLqwF7OoXR1RHgEZ8
 rXxc4IECACEw1WoioXRHQ89MJUp3gUQ2ZQMa7d6cH2DSQ7Mc0JvQntCYGbp7jYVRS6msl9HYo
 8OzPDrHoOoRTAG0Ajocv56SJDDiruo5rHE9xBAZC1p2ztbIVmi0hOMhZ4LFkA09Z9BuF2NmnB
 Hh1aYaza0uf5ELwIqFIjbmrv37GbauuJOCl26m2ZEO7GBPyG4h7Fe0sEfyM4yYDOiyvmfVYE3
 +9uym9D2SI4MrQwKqMpbecW1fM0u7xoi7wTDLI002fhQImYjBZ3Ua3/eYpLmFLk1eYtskILA1
 Nfsz+b0J96Q1rP4a3cy/fptRP+iWaoEoJ/y8HButhQAiPQYPE1bGknPWnXZkG/fII8sTAO1m0
 nd/YmjWkLvH3m4q/n1YPEOgydKzbBrb0+lfaHKoYVnF2xBJxvMdBYKLGwDDH60vazgViQwdxP
 T6ra7ekyJoat4a3UYoMF/aXRDVDoFuqI+9BH6lH9oT2K7bt1Xo5UaBtORayxYU7WNRoQD1d1c
 wWLdY0YM8oElKageQrzWiyQY8X/8ghL3N2/l4ImE9pFgpq70FbGK1oG48RQD1GIAf2VXeu6FZ
 y/2cOYvz3ud09Pniqgy3K09G6WkbjTFBe08Zd6XX+5jdfNK+m2F9Qp3jRZ0ihxjBP9uycuEKf
 vX0YQiu29xKtMjCUaErT5K2hYe+YFWQrb1TBhVR/pH9k5R9skCwd4nQVzkt5mWgfRxvvO6iad
 YUdYwY+wf1xhMOz9oFSdoYfe3OU0QM5n6xU1MGCV4AzwbdaZxdmRiBZnE+xIPRNn4DDm+bEv4
 v+2w9lFqVXctPcS5jzYJ0oME6t9altQmc1Y+0m27IAnSTYWftWImcKZHFdCxaY5aQ4xpIVRZc
 CF3GRDsx6Z489p0hlw4wGGBlkpQwamIHlS2/CpmMA7bRdlow0Fe8//wES5Hh2U/NNM3r2onv+
 IxmgVaUBWX6bxcO1PBBckGk62nZLOZySDez5ij1DUsiGAMLte8vDaBT0DSkVC+rlTc9GNrwJv
 wS9j11C6cc3ocqYhlaENrwSA5ZJlSN9l9h+K5ep+jjdYuWU/T73LAstrVRiCx0BcZYxd4x8a+
 4k2Ocph8oMSI2ywr1Urlirc9dgfrcVZr6RDZy69YJ6SpPrfZxVIGTrGfdTEJBwyjknaI39Y29
 9aA2dThpGtVmPXkeZWmsKeoouZ5hzUqyamzJW4wdQ5XLtoX1AAJVMU9Ch8ZRYIXap5opIbEeo
 svEWP1J98n+UlGo5L+YWS4Yq6lZabp6s0MD/ARB1zc8jMmUUTCCkaXVwFpFiqyVYC7GFYWQTT
 JJp4wXQw==
X-GMX-UID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko
X-Flags: 1401



MailID: NjUyOAUgSzg3M8ChcT4xpToxMekO3kko


------------------------------------------------------------------------
message opened by mailclient 6.73.3.0 (6.73.1.0)
share|improve this answer
    
There is no more info then the published headers. I'm guessing this header is not completely arbitrary, given the large number of emails you find on Google... –  mhermans Nov 2 '13 at 15:44
    
The point it not that this header line itself is arbitrary. The point is that someone snooping on the email does not have to leave a header indicating that he has done so! He could leave no header at all, or leave an innocuous header like "No virus found" –  scuzzy-delta Nov 2 '13 at 15:51
    
"arbitrary" here meaning that the mail server can write whatever it wants, so it would be silly for someone spying on email to write "This email has been spied upon", which is essentially what this accusation is. –  scuzzy-delta Nov 2 '13 at 15:59
    
I'm in full agreement that adding/leaving such a header-line would make it a very clownish/unlikely attempt at snooping. I was mainly hoping for a technical reference on the message, e.g. if it was an addition of a standard software package, or not even an IP-adress, etc. But thanks for the input! –  mhermans Nov 2 '13 at 16:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.