1

Let's say that I want to test whether an email in my inbox is safe or not. Can I tell this with 100% certainty just by investigating the .eml file or are there some other places to check for absolute certainty?

When I mean safe I mean safe from all possible attacks but mostly code that targets some exploit in the email client.

EDIT No2: So far the answers for my question are associated with the deception of the user (i.e phishing techniques). What about the aspect of exploiting the email client vulnerabilities? Will the evidence of such an attack exist in the email source? Also in my question I ask how to investigate the email for its safety and not if someone can send me an email pretending to be safe.

3

No. There are some SMTP fields like

MAIL FROM: - generally presented to the recipient as the Return-path: header but not normally visible to the end user, and by default no checks are done that the sending system is authorized to send on behalf of that address.

also

From: Joe Q Doe - the address visible to the recipient; but again, by default no checks are done that the sending system is authorized to send on behalf of that address.

Anyone can spoof any existing mail address. I could even send you a mail from your own mail address.

  • the question has been clarified - it's not about sender spoofing – schroeder Oct 24 '16 at 12:01
2

Concentrating on the email client and its vulnerabilities, for the most part evidence would indeed be in the eml file sent. I can imagine something like for example a buffer overflow in the image renderer or memory corruption in the html parser for html emails - evidence for these would be present in the .eml file. Whether it is obvious though, that's another question, in some special cases it may be subtle and if the question is whether you can automatically find these with some kind of a tool - probably no in case of zero-day flaws. But manual analysis (forensics) can identify these types of attacks from .eml files.

I can think of another thing that may or may not be of interest to you. An attacker may be able to somehow craft an email that is received by your smtp server and compromises that smtp through its own flaws in a way that later when presumably the same server serves that email to clients over imap or pop3, the attack is forwarded to clients inside imap or pop3 itself. In this case there would be no evidence in .eml files, the vulnerability was in the protocol implementation in the email client. Such an attack would be very unlikely though, but still I think not necessarily impossible.

So summing this up, I think the client may be compromised through two channels, either the email contents itself, which is much more likely, and evidence would then be in the raw .eml files, or through the protocol that it uses to download emails from the server, but that server is controlled by you, so it poses much less of a risk.

Another thing that comes to mind is if there is code execution exploited in the email client, it is possible that the attacker code executed actually changes the email file itself to hide evidence. Again I think this would be very difficult to actually do reliably in the general case, but theoretically not impossible. You would still have the unchanged email files on the server though, unless that too is compromised in a separate attack.

1

You can never class anything as 100% safe.

To answer your question properly, no you cant tell if something is safe just with the email source (or header) but you can tell if it is most likely unsafe. Remember that not knowing if something is safe does not mean it is unsafe.

1

The answer is NO. The only way to trust that a particular email is from an authentic source and the sender has not been spoofed nor the message maliciously altered is through a digital certificate issued by a trusted Certificate Authority.

A typical, widely used algorithm used to digitally sign and encrypt email is RSA. The message digest is encrypted using the private key known only to the sender of the message. Once the recipient of the email receives the message, he or she uses the public key of the sender to decrypt the message. If the sender was spoofed, the public key would not work as it is bound to a particular unique private key. If the message was altered during transmission in any way, the resulting decrypted message would be considered corrupted. Digital signatures are only trustworthy if the certificate used to generate them is trustworthy, which means a CA is needed to guarantee the identity of both sender and receiver.

  • the question has been clarified - it's not about sender spoofing – schroeder Oct 24 '16 at 12:02
1

Email security, from sender to you mailbox

SMTP is by design unsafe cause it's doesn't authenticate sender. So an attackant clever enough can forge a "safe looking" email just using telnet.

There's some initiatives to make SMTP safer: SPF and others, authenticated SMTP servers, PGP, etc... but since none of them has widely spread, smtp stay untrustable.

Also, keep in mind that even if it's email source show the same couple of relays has usual, the same mailer, etc..., this still won't make email safe cause attacker could control your correspondent mailbox because of:

  • a leak on a public site where your correspondent used same email address and same password than email account to register into.

  • A bruteforce attack, a vulnerability in FAI webmail software, a malware on his computer.

  • someone hijacking his session (always lock your computer if you go downstairs to smoke a cigarette).

  • A man pointing a gun in front of him and telling him to write that email.

The answer is clearly NO :) (and yeah, actually, every kind of communication is unsafe)

Email security, in your mailbox (added because of question edit) 

Since the original question has evolved, let's continue answering ;-)

As you say, an email can embed malicious code to exploit a vulnerability into your MUA. We can classify vulnerabilities into two categories:

  • Vulnerabilities in HTML renderer
  • Vulnerabilities in email's envelope (basically, headers parsing etc...).

I wish than, today, most of MUA embed improved and robust code for email's envelope parsing. Since envelope hasn't change for decades and it's quite basic (<header name>: <header value>) we can hope than this part is safe. But only "hope"... keep in mind that regression are introduced every day on every kind of software (Take a look at CVE-2007-6165 and CVE-2006-0395 for example).

And also remember that all vulnerabilities are not published, so unknown exploit can be used to abuse your email client.

To finish, the worst and more dangerous part is the HTML rendering engine: since it's in constant evolution, code evolve too and an attacker could try to exploit some vulnerabilities in this specific piece of software. HTML email is, IMHO, the most dangerous part of email.

Inspecting .eml will help you discover the more obvious attempts to exploit any vulnerabilities: malformed headers, strangely named attachments (big_b00bs.jpg.exe)

But since attack vector can be many others things, i think that this still isn't enought to consider an email safe.

But if:

  • you disable HTML rendering.
  • you disable image displaying.
  • you're cautious with attachment.
  • you use a antivirus (server-side is prefered) on your email chain.
  • you use a sandboxed email client.

You're like 90% safe :)

  • the question has been clarified - it's not about sender spoofing – schroeder Oct 24 '16 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.