Hot answers tagged

33

The one and foremost problem with this approach is that in your example, only the first one is actually a syntactically valid email address. The three others are not. This means that one of the two following options holds: The "email address" is merely a suggestion. The system wants a unique login identifier; email addresses are reasonably good identifier ...


17

Only the first email address is actually a valid address. Of course, email address validation is hard, so trying to implement perfect validation does not make sense. At a maximum, you can approximate validation, and for usability reasons, you should be lenient with your filter. Because of this, you should not base your security on the validity of email ...


16

I have now added this : v=spf1 include:_spf.google.com ~all The ~all at the end just causes a soft fail, that is that mail will still be delivered. If you want to have a permanent fail use -all. Of course this only affects mail server which check the SPF records, which are not all.


7

TL;DR: Change your passwords Enable two-factor authentication to prevent attackers from changing your password Warn your sysadmin You should change your passwords ASAP. From a machine that you trust. What good is it going to do that the attacker can still log in too? What if they find a way to change the password, too? Any suspicious activity should ...


6

From the mail it looks like they are sending from a google account, circumenting the SPF record.Misread the respective headers. It's not the case My recommendation would be to roll out DMARC and DKIM. This allows you to ask the receiving servers to discard or quarantine mail if it wasn't sent and signed by your server. I don't know if DKIM is possible ...


5

Usually you cannot detect if a mail was tampered with. You can only detect this if the mail was signed and the person you suspect to tamper with the mail is not in possession of the key needed to sign the mail again. In theory it might be possible to store a fingerprint or similar for all delivered mails and thus check if this is the original mail, but I ...


4

First of all, I would change my password. Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access again, and actually change your password (is this possible with Hotmail? I know GMail supports it). You definitely don't want to be locked out of your own ...


4

What you are speaking about is an airgap, a device or network with no network connections outside of its own loop. If you had an email client within the airgap then you could view emails that have been transferred over to the airgapped system on removable media, but you could still be infected by any malware that is contained within them. A well known ...


4

If you're getting bounce messages back to you, that's known as backscatter. It's possible to filter out bogus bounce messages. See also http://www.dontbouncespam.org/#BS for other ways to filter backscatter. This does not stop the spammer from sending emails to victims, using your name in the From: line.


3

I disagree with @quietsigns answer. There are other people that could potentially see your email. For one - email can be sniffed while in transit. Probably not super likely but still possible. Second - if the destination email is ever compromised (or is currently compromised) then it's likely that this email will just be sitting there. If you are really ...


3

I can't help with why this is happening. There could be too many reasons. However, I can tell you what it's doing: It has a large list of numbers (var b) which are actually stored character codes. The program splits them up into var z like this: ...


3

There is a way to safely encrypt email, but you would know (without looking at the headers) since there must be a way for you to authenticate yourself as the receiver. If they put a signature cert on the email, that does not mean that it is encrypted, that only provides a way for you to confirm the identity of the sender. The encryption must be performed ...


2

If you're reading your mail in a browser, then the browser can read your mail. This means that Firefox or Google or Microsoft or Apple or Opera or whoever makes your browser can read your email. But it's worth pointing out that Google is no more likely than any other browser maker to want to read your mail. They don't have a reason to. Plus, open source ...


2

Should I then use Chrome or another browser to check my inbox? The problem is probably less the browser since this browser is used by lots of others and such behavior might be detected. More of a problem are likely browser extensions you have installed, malware injected into the browser or any software which does SSL interception. SSL interception is ...


2

They may use machine learning and data analysis techniques similar to those used for spam filtering to find seditious content. As with spam filters, if you chose your wording carefully, most likely it will get through (but you need to be aware of what wording they are filtering on so it might take some trial and error). If you want to employ methods of ...


2

I'm assuming that they either need to be on the same network as the sending or receiving end of the email. There are lot more possibilities: In the sending or receiving network. This vector could be mostly eliminated when sending/receiving the mail with TLS, at least if the certificates are correctly validated (which is mostly the case in this step of ...


2

Maybe. In theory it might be that the (unknown) mail client you use already extracts information from the attachment when you simply hover over it. And the practice might not be that far away from this theory: There were several bugs in the past where the preview feature for mails could be used to execute malware, see Can malware be activated by previewing ...


2

By default there is no such functionality that could be exploited itself. What is possible and mostly done with attached PDF's but also possible with other file formats is to exploit vulnerablities in the viewer software. This is the only way to compromize a system through a non executeable file. But also in that case the success of the attack relies on the ...


1

Plenty of things could have happened. To start with, emails which are not digitally signed cannot be trusted: they can be tampered with in transit (not very likely when the exchange is between two large providers) the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach ...


1

There is definitely a security issue that stems from a provider allowing the registration of almost identical email addresses. But it's not quite the one that your specific examples are testing. And its effects aren't even necessarily limited to users of the email service, but can more broadly impact anyone receiving mail from a user that service. The ...


1

All but the first should be rejected simply because they are not valid email addresses. When you copy&paste them verbatim into your favorite email client they might do what you expect, but the most likely behavior is that it interprets them all the same. So if you want email addresses to uniquely identify users, you should insist on entering one ...


1

The problem that you are describing is known as spoofing, where you are able to send a message from personA@company.com, even though you are not personA@company.com. Because the SMTP protocol dates back to the early 1980's, when the internet was in its early stages and used only by a relatively small number of users, the engineers of the SMTP protocol did ...


1

Change your passwords from a trusted machine to prevent further access. Check your local privacy laws if that amount of monitoring is even legal in your jurisdiction. File a complaint that the monitoring activity interferes with your work and that you have reason to suspect abuse. But do not accuse a specific person without any proof.


1

It might not be an admin, networksec, or a teacher. What if someone hacked their login? It might be best to raise the issue with your school. Do they have anyone that manages the security of their systems? Perhaps ask for a meeting with them and your college principal to have the issue investigated.


1

What steps do I need to take in order to prove this individual did send these emails? You can't with just the information you have on your MX. You can't both technically (information from the other MX aren't accessible to you) and legally (you aren't allowed to investigate or prosecute). Provide evidence This is the job for your authorities, who will ...


1

In theory yes. This could be possible for any company with any Browser they have code access to. They only need to send the response to their own servers. However, I can not imagine this will be ever the case. It would be a huge scandal if that would be publicly and the user can easily recognize this by viewing the upload size. This would be the end for ...



Only top voted, non community-wiki answers of a minimum length are eligible