2

Our University recently had a case where some notorious fellows used a fake emailing service to send an email to all students on behalf of the administration. Although most good email services (like Gmail?) can warn us that the mail is likely a phishing attempt, many users not educated in security may fall in this trap.

My understanding of emails (I am no pro, so pardon me if there are flaws) was that if I need to use something like Telnet to send fake emails with a local email service (on LAN), it would be anyways possible, but I would need to enabling some kind of 'relay' to be able to do so for services like Gmail.

My question here: how is this fake emailer (or any other) doing this? I am not looking for theory on email. Maybe some security guys could have a look at the page's source and give clearer details.

6

E-mail spoofing is possible because Simple Mail Transfer Protocol (SMTP), the main protocol used in sending e-mail, does not include an authentication mechanism. The MAIL FROM: header has got, by default, no checks to see that the sending system is authorized to send on behalf of that address.This means you can send an email and instead if using your real email address in the MAIL FROM header you specify some other address.

The only way of making sure an email is legitemately coming from a certain person is by using GPG/PGP. Pretty Good Privacy (PGP) is a data encryption and decryption computer program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications.

1

To add to Lucas' answer, if you're seeing that you're seeing a lot of spoofed email, you can add a Sender Policy Framework (SPF) record to your DNS to ensure that FROM emails can originate only from specified servers. You should also disable Open Mail Relay if it has been enabled for whatever reason. There will still be ways to phish your organization (for example, example.com and examp1e.com can be easily thought to be the same in an email), but these are far more detectable and preventable than if the email appears to be from a known person.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.