CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.2  Email            9  2.2.3  Vulnerabilities

Header Privacy 1 Password Security

Another email issue is forgery, or message spoofing, due to the lack of sender authentication in vanilla (as opposed to PGP or S/MIME) email. If you’ve gotten spam, you’ve probably seen forged email. By “forged”, we mean email whose “From:” information along with other possible identifiable information is deliberately incorrect. Email can be forged for a variety of reasons, such as not wanting replies (senders of “make money fast” pleas generally don’t want tens of thousands of replies telling them to bug off, in their personal mailboxes), not wanting their identity to be known (in the case of someone who wants to communicate anonymously, just to protect their privacy), or wanting to pretend to be someone else (like the virus email which masquerades as an email from Microsoft Security). How do they do it?

Sometimes, it’s as simple as changing the “Name” field in their mail program, but leaving the email address as is. (Not very effective, but it is occasionally done, particularly when someone is using a “throwaway” Hotmail or ISP account to send a large volume of junk mail, and doesn’t care how many replies the sending account receives.) At other times, users take advantage of a feature of the SMTP protocol – you can claim to be anyone, without having to prove to the mail server that you are that person, by manually issuing commands to the SMTP server (or using a program designed to issue these commands for you, supplying whatever identifying information you provide it).

Header Privacy 1 Password Security