1

Today I received a spam email from juliew@mchs.org.au requesting to contact Harry Black about a charity project. His email address is harryblack2013@rogers.com.

After I had done so and fallen for the bait, Harry Black replied to my email that he wants to give me $1,000,000,000 blah blah.

What bothers me is, I Googled rogers.com and mchs.org.au and they seems to be a massive respected site. How then could the spammers have access to email accounts at these sites and if they can, can these companies be alerted that they have been hacked? Or if they let the spammers do it, shouldnt Google be penalizeing them?

3

Rogers is a very large Canadian ISP, and their every cable client gets a @rogers.com address, so finding one that has a weak password would be trivial.

  • Should I alert rogers about that? – Lucky Luke Oct 21 '13 at 15:08
  • And what about the other site? – Lucky Luke Oct 21 '13 at 15:10
  • @LuckyLuke - it would be good to inform Rodgers. They should have some kind of abuse address that you can send information to or you could just try abuse@rodgers.com It might or might not be accurate, but it's a fairly typical address for such purposes. – AJ Henderson Oct 21 '13 at 15:10
  • The other site is probably just a spoof. It's unlikely that they have an actual account there. – AJ Henderson Oct 21 '13 at 15:10
  • @AJHenderson about the other site, it too recieved my reply – Lucky Luke Oct 21 '13 at 15:12
3

You probably checked this, but are you 100% sure you replied to that email address? It's possible that they used a spoofed from address like harryblack2013@rogers.com while the reply-to address was evil@spammer.com

I don't know the current state of play, but with older versions of Outlook you could do some devious trickery on this front, e.g.

Reply-to: harryblack2013@rogers.com <evil@spammer.com>

When you replied to such a message, the visible reply address would be harryblack2013@rogers.com while it would actually send to evil@spammer.com

  • I typed it out myself! – Lucky Luke Oct 21 '13 at 15:08
  • Ok, that rules out my theory :-) – paj28 Oct 21 '13 at 15:10
  • 2
    This is not devious or reliant on specific Outlook versions, this is as designed by the SMTP spec. – AviD Oct 21 '13 at 15:32
1

The email system was originally built on trust. Your mail server could claim to be sending on behalf of any domain it liked and the other server would trust it. Since spammers have been abusing that trust, some strategies were put in place to prevent the abuse.

SPF is a standard designed to allow the MCHS to prevent anyone in the world from sending email pretending to be from mchs.org.au. The way it works is that they publish a DNS record under their domain that lists all the valid mail server IP addresses that are allowed to send email claiming to be from mchs.org.au.

The DNS record can also state what should be done with emails that come from other IP addresses. Unfortunately, in the case of mchs.org.au they say that mail servers can "do what you like, we don't care".

The last part of their SPF record should read -all instead of ?all. If it did, this mail may have been dropped instead of being delivered to your inbox.


Note: It also may not have been dropped depending on the Envelope-from address and the IP address the email was actually sent from.


DKIM is another standard designed to prevent malicious people from sending email pretending to be you. It works in a different way by cryptographically signing certain header fields using a private key and publishing the public key using DNS.

It's difficult to determine whether a domain uses DKIM or not without seeing the DKIM header in one of the emails from that domain.

They do publish a DKIM public key in their DNS. I guessed until I hit on the selector default. If there is a DKIM header in the email (and the signature is validated) or a Received-From: header that contains either 121.200.228.200 or 202.12.141.131 or 125.255.85.3 then you can be certain that the email was actually sent from an MCHS server.

0

Spammers who are intending to lure the unwary have to use a real email address to receive their replies, but that isn't difficult and doesn't imply that any email provider is compromised or complicit. Don't confuse the "spam blast" which ought to set off alarms if sent conventionally, with the tiny trickle of legitimate-looking correspondence between the intended victims and the bad guys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.