Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is personal and I have not provided it. Also, this email is neither in my 'Sent' folder nor in my 'Trash' Folder.

Delivered-To: myFriend@gmail.com
Received: by 10.220.187.65 with SMTP id cv1cs37222vcb;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)
Received: by 10.236.176.38 with SMTP id a26mr5411029yhm.410.1309289105028;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)
Return-Path: <MyEmailId@gmail.com>
Received: from ROCKY (host216-212-117-146.birch.net [216.212.117.146])
    by mx.google.com with ESMTP id l25si2327155yhm.109.2011.06.28.12.25.04;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)
Received-SPF: neutral (google.com: 216.212.117.146 is neither permitted nor denied by domain of MyEmailId@gmail.com) client-ip=216.212.117.146;
Authentication-Results: mx.google.com; spf=neutral (google.com: 216.212.117.146 is neither permitted nor denied by domain of MyEmailId@gmail.com) smtp.mail=MyEmailId@gmail.com
Message-Id: <4e0a2a91.a5b5ec0a.0aa1.ffffdca7SMTPIN_ADDED@mx.google.com>
MIME-Version: 1.0
From: "MyFullName"
<MyEmailId@gmail.com>
To: MyFriend@gmail.com
X-Priority: 1
 Priority: urgent
Importance: high
Date: 28 Jun 2011 15:25:18 -0400
Subject: Email from MyEmailId@gmail.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

<Subject>

Here MyEmailId and MyFriend are two email addresses that are not real. Everything else is. I have not posted the Subject as it is personal.

So if my email id was spoofed, how could the spoofer know my personal details ? What are the possibilities ? I run outlook. I installed MacKeeper yesterday (software for cleaning up mac) . Any connections ?

share|improve this question
1  
There is way to little information in your question to give a detailed answer. What is the domain part of your email-address? What is the domain part of the target's email addres? Is that the complete header? Especially are there more Received/To/From/Date lines? Was 216.212.117.146 your IP-address? Was the private subject line something you have used or something made up by the sender of that email? Do you use an email client or the google webinterface to normally send email? –  Hendrik Brummermann Jun 28 '11 at 21:09
    
@hendrik: Full header posted. –  Legolas Jun 28 '11 at 21:38
1  
I agree with @palo-ebermann. This is not necessarily indicative of a breach of your e-mail account. It was years ago I leaned how to telnet to port 25 to interact with sendmail. However the attacker doesn't even need this minor level of sophistication to spoof your e-mail address. As a precaution change your password and review athe Gmail security checklist Check 'Last account activity' to see if there are times or IP addresses that don't look like you. –  this.josh Jun 28 '11 at 23:17
1  
also look at security.stackexchange.com/q/1601/485 for a little simple info on how these things usually happen with no access to your mailserver. –  Rory Alsop Jun 29 '11 at 7:55
    
As a side note, you might want to get rid of MacKeeper, if you can. It is considered 'invasive malware' by some. More details can be found here: discussions.apple.com/thread/4276731?tstart=0 –  MrWonderful May 5 at 17:06

1 Answer 1

up vote 13 down vote accepted

There is no hack necessary to send mail with your mail address - anyone can send mails with any sender address to anyone, if the receiving mail server does not have stronger policies. (This is caused by the open structure of the Internet.)

A hack would be necessary to read your mail.

If you want to make sure that no one can send mails in your name, sign your mails (using PGP or S/MIME), and tell all your correspondents that they should discard any non-signed mail claiming to come from you.


Some analysis of the header lines.

The additional two Received lines do not add much.

Received: by 10.220.187.65 with SMTP id cv1cs37222vcb;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)
Received: by 10.236.176.38 with SMTP id a26mr5411029yhm.410.1309289105028;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)

These are private addresses, inside a local network, and they don't say from where they receivded the message. (These are the last stations that the message went through before arriving at your friend). If your friend used the Gmail web interface, these most likely are Gmail-internal servers.

Then we have these:

Return-Path: <MyEmailId@gmail.com>
Received: from ROCKY (host216-212-117-146.birch.net [216.212.117.146])
    by mx.google.com with ESMTP id l25si2327155yhm.109.2011.06.28.12.25.04;
    Tue, 28 Jun 2011 12:25:05 -0700 (PDT)

The return path shows what was mentioned in the SMTP dialogue as MAIL FROM. This was added by the receiving mail server, most likely the one in the next line: mx.google.com. This server got the mail from a SMTP client who identified itself in the SMTP dialogue as ROCKY, had the IP address 216.212.117.146 (which has a reverse DNS mapping to host216-212-117-146.birch.net).

This seems to be an IP address in the US (assigned by ARIN to Birch Telecom and from them to Premier Mortgage Funding. Either they have a bot-infected computer there, or they really sent the mail. (Or someone earlier in the list was spoofing the whole header.)

Do you know anyone at this location? Does the contents of the mail in any way relate to mortgage funding?

Received-SPF: neutral (google.com: 216.212.117.146 is neither permitted nor denied by domain of MyEmailId@gmail.com) client-ip=216.212.117.146;
Authentication-Results: mx.google.com; spf=neutral (google.com: 216.212.117.146 is neither permitted nor denied by domain of MyEmailId@gmail.com) smtp.mail=MyEmailId@gmail.com

These lines are added by the same server, most likely. The server did an SPF check on the mail address and sender's IP address, and has neither a positive nor negative result.

Google's SPF DNS records look like this (line breaks by me):

gmail.com.         259  IN   TXT     "v=spf1 redirect=_spf.google.com"

_spf.google.com.   236  IN   TXT     "v=spf1 ip4:216.239.32.0/19 ip4:64.233.160.0/19
                                             ip4:66.249.80.0/20 ip4:72.14.192.0/18
                                             ip4:209.85.128.0/17 ip4:66.102.0.0/20
                                             ip4:74.125.0.0/16 ip4:64.18.0.0/20
                                             ip4:207.126.144.0/20 ip4:173.194.0.0/16
                                             ?all"

Some IP ranges (which likely include GMail's web servers) are explicitely whitelisted, and the rest is mentioned as neutral by the ?all tag at the end.

If the mail were sent from GMails web interface (or via Gmails SMTP authenticated submission port), then there would likely be a "spf=positive" or similar result in the header instead.

Message-Id: <4e0a2a91.a5b5ec0a.0aa1.ffffdca7SMTPIN_ADDED@mx.google.com>

This message-Id is also added by the accepting mail server.

From: "MyFullName"  <MyEmailId@gmail.com>
To: MyFriend@gmail.com

(I suppose name and mail address were on one line.) Now it gets interesting. The sender knew your full name, as well as a fitting mail address. Do a Google search - is this combination public knowledge (i.e. findable on the web)? If not, then it is likely that either someone's address book got "hacked" (i.e. someone got some malware which is collecting these addresses), or some website where you entered these sold your data.

X-Priority: 1
 Priority: urgent
Importance: high

These header lines would give the mail a quite good chance to get stuck im my filter, I think :-)

Subject: Email from MyEmailId@gmail.com

This is also a typical spam subject line.

<Subject>

I have not posted the Subject as it is personal.

Do I understand right, the text of the mail contains personal details, and not a generic spammy message? Could this be some text copied from a mail you (or someone else) wrote before?

Other than this, it could be someone who knows you and your friend and who wants to play a prank to both of you.

share|improve this answer
    
@Paulo : Full header posted. –  Legolas Jun 28 '11 at 21:45
    
It is difficult to get casual e-mail users to configure their e-mail clients for signature verification. I wish I could get everyone I send e-mail to import my public key into their clients. –  this.josh Jun 28 '11 at 23:06
    
@Legolas: I did a bit more of analysing this. But I'm not really an expert about these things, so everything is without any guarantee. –  Paŭlo Ebermann Jun 28 '11 at 23:21
    
Thanks man. I am starting to read your answer. But the subject was nothing related to mortgage. It was something personal about my everyday life. –  Legolas Jun 28 '11 at 23:48
    
The subject of the email was - not sent before ! It was probably something I had written before, and it must have been in the drafts folder. Whats interesting is that, It is not in the drafts folder now, and not in the sent , and not in the thrash folder either. –  Legolas Jun 28 '11 at 23:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.