Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In my previous post here How can I send emails anonymously? the community framed and guided how we can send an anonymous emails through various ways which makes me thought about the following things
Normally we would trace the email using email headers; my scenario is in the following form:
How can we track-down the mail sender if he uses a virtual machine with an IP hiding tool and sending it through anonymous services
What are the best ways to track down this kind of anonymous mail sender?
If the service is working right, you can't.
You can just work with the information that is supplied to you, unless you can gather access to the anonymous mail sending service. This could be possible if you work for a LEA or are able to break into the service (but that would be illegal, of course). The information that is supplied is the body of the mail, the headers of the mail and attachments. Metadata in attachments can expose somebodies identity.
For example tormail has mailservers working as hidden services and some in the normal internet, so, if you send a mail, you are connected to the hidden service so your IP isn't exposed. Unless he gives the hidden service any information that would compromise his identity, you can't get anything to track him down.
Assuming no breaks in the anonymizing service, you're left with more conventional techniques.
Who would have the motive to send the email? Of the people who have the motive, who has the ability. Of the people with motive and ability, do you have text samples of theirs? Can you link the style of the email to the style of the suspect?
http://www.ncfta.ca/papers/emailforensics.pdf
Then get a warrant and search for evidence of anonymizers on the computers of the suspect and possible times of use. Compare the behaviour of any found anonymizers to the anonymous email in question.
I think if you could make the sender reply to something that could be useful and I think it depend if it accept rtf format. It could works better if the sender were using a webmail using Internet Explorer and I think it could be pixel tracking. The trick could be to make the sender think the email just bounced and hope the sender could receive it in two different computers. That way the email could be open and ignored without suspicion.
I'm pretty confident we could include a jointed pdf file including some crafted code to know a bit more.
Update:
Technically all of this should not happen right? Nobody should hide to send email so nobody should be searching on 'how-to' by-pass anonymity. But reality is kind of hugely different so the statement is reality-speaking irrelevant but still make sense to me.
One side of my brain feel like anonymity is so important, I feel I am obliged to write this stuff to clarify my position on what I know consider a subject more than a question.
There is one part of my head thinking how to defeat the other side and it bug me a lot. The bounty seem great as a personal challenge (it catch my attention) but I think it's kind of perpetual fight because we fight against yourself so we basically have nothing but a break for some time. I think all answer posted here will rely on breaking the human weakness cause the protocol don't have to think. We are king of bound to our own limit and just update them with new protocols and functions complicating a bit more the whole thing. If what is email now was the same as what are sms it could be much more easy do deal with.
This question really deals with the broader question of anonymity on the Internet. While the sender must establish a connection with a server to send it, they could act like they were just a relay for the message. Additionally, if they go through an annoymising service that doesn't keep records and delays transmission then there is almost nothing that can be done.
If the e-mail service didn't delay the message, it might be possible, with the appropriate legal assistance, to get access to the router logs of the ISP for the e-mail service and look for what connections came in at roughly the same time as the message went out. This would have a chance of allowing it to be traced back.
Ultimately though, while figuring out the source of an active connection isn't that hard (at least the first hop), log files are pretty much a requirement to move beyond there or to be able to see anything historical. The Internet was a very trusting place in its early years.
if he uses a virtual machine with an IP hiding tool and sending it through anonymous services
Let's try to take that apart.
Uses a virtual machine
With a local email server, you won't be able to have your emails delivered in most cases, assuming you are at home you will end up talking to the distant server with your home IP, there's no helping it. It's logged AND it will probably refuse you or try some grey listing tricks to see if you are a legit sending/receiving server or just a fake server put up to be anonymous for a day. With a distant server, like Google's gmail, this server is responsible to log and know what's going on, it won't let you send emails with fake headers, it can rewrite them in the worst case.
An IP hiding tool
I assume you are talking about TOR, which exit nodes are not known to be legit email servers. Bad idea. If you can bounce on a hacked legit node though, it might work, they will be able to get back to that machine (acting like a SMTP server) though, and from there logs at the network or host level might betray you. If you use TOR + bouncing you are pretty safe I guess, but TOR is not known to be a safe tool for criminal activities or spammers. Multiple bouncing from someone else's WiFi (far away from your usual places, and using an antenna + changing your MAC address and using no facebook/twitter or anything that connects to an account linked to your usual address(es)) can work well. You just need to maintain nodes on which you can bounce, and change your location.
IP are necessary to deliver a message, so except spoofing one node will be revealed, and from that, you should always assume the worst case, where nothing is safe/secure.
The best ways to track down this kind of anonymous mail sender?
If you really want to track people, log everything, use log organizer tools that can let you store, browse and match collected logs), contact the offending IPs managers (whois entry) and tell them that spam came from their IPs, give them all the details you have and if you should ever need to prosecute the responsible spammer/attacker, ask them to come back to you ASAP with what they have. In the worst case they will have nothing... That's for the pure technological part, you could also see what the emails contain and to who the spoofed email headers are sent to, try to understand the spoofer's motives, check for any link to their websites in the email, going the other way could prove useful, they don't send spoofed emails to say 'BUY STUFF ON AMAZON DUDE ITS AWESOME', but more like 'We lost your credit card number, please input it here: http: / / 42 . 42 . 42 . 42 / hoax.php'.
If you don't want to track them, install grey and black listing tools, monitor them closely at first to check that no legit email is blocked. Then it should get better and better, you can report spammers and get their IPs blocked on global black lists used by everyone. That's usually the way people (should) do it. You don't want to end up talking to Tunisia about some dude using his neighbor WiFi to send you emails, they won't care, it will take forever and you will get nothing out of it.
