Email hacks via RDP

Question

Someone has sent an email from my account that is making me look bad. I am trying to determine if someone either actually did it physically from my computer or via RDP. As there is reason to believe it could have been done RDP although both are plausible but actually doing it from my computer is less plausible but not impossible. I do sleep. My question is if it was done RDP is there anyway to prove it or would it look like it came from me regardless?

Answer 1

You do not need to have the password, RDP or access to your computer to send an email from you. SMTP is the protocol used to send mail and this protocol does not do any kind of authentication. Take a look at the code below from the library nodemailer.js:

// setup e-mail data 
var mailOptions = {
    from: '"Charles Sarver" <charlessarver@gmail.com>', // sender address
    to: 'someone@gmail.com',  // list of receivers
    subject: 'I hate you', // Subject line
    text: 'My name is Charles Sarver and i do not like you', // plaintext body

};

transporter.sendMail(mailOptions, function(error, info){
    if(error){
        return console.log(error);
    }
    console.log('Message sent: ' + info.response);
});

Source: https://nodemailer.com/

As you can see, with SMTP, you can send an email and specify the sender address to any email because SMTP does not check the authenticity of the sender. I can send the email above and it would say it was from charlessarver@gmail.com. One way to check to see if this email is actually from you, is to check the email headers. In the headers it will specify a source IP address. This will tell you where the email was sent from. Use link below to see how you can view the email header. If you know someone who received an email from you that you did not send then have them use this: https://mxtoolbox.com/Public/Content/EmailHeaders/

After you find the header, copy it and paste it in this tool: http://mxtoolbox.com/EmailHeaders.aspx

Find the header "X-Originating-IP". There should be a number in this format x.x.x.x.

Take that number or IP address and paste it into this tool: https://www.iplocation.net/

This will give you a rough location of where the email was sent from. The false sender could also be using a VPN or proxy which could also spoof this IP address.

You can use this tool to look up your own IP address: http://whatismyipaddress.com/ip-lookup

But this IP can change depending on where you are located and your ISP

Answer 2

It's also possible it was done with powershell or other terminl connection that could manually send smtp commands to a poorly configured email server. You should be able to tell from the email header, or the server logs, exactly where the email came from. If it came from your machine, you are looking for RDP or powershell sessions connected to your machine. Powershell could have been set to delay, so you are looking for all sessions at the time, or prior.

Anyway, I'd say you should see if there are any logs of the RDP session. Since you have a time when it happened (from the email headers), it shouldn't be hard to localize. If it was powershell it is tougher, because many places aren't logging powershell, because it doesn't log by default, so they don't know they aren't logging it until they need it, and it isn't there.