Mixing
Is it possible to fake 'received' field in the e-mail?
Clash Royale CLAN TAG#URR8PPP
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0;
up vote
2
down vote
favorite
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but then I've read this post which mentions that Received field can't be faked. It seems that received is proper in case of the e-mail I'm talking about:
Received: (wp-smtpd mx.tlen.pl 14490 invoked from network); 2 Oct 2018 07:19:36 +0200
Received: from mx.beniculturali.it ([194.242.241.200])
(envelope-sender <pm-pie.aglie@beniculturali.it>)
by mx.tlen.pl (WP-SMTPD) with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
for <myemail@10g.pl>; 2 Oct 2018 07:19:36 +0200
Received: from sea2.mail.beniculturali.it (localhost.localdomain [127.0.0.1])
by localhost (Email Security Appliance) with SMTP id 15EE31ECEEA_BB2FFE8B;
Tue, 2 Oct 2018 05:19:36 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (mb2.mail.beniculturali.it [192.168.123.122])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(Client CN "email.beniculturali.it", Issuer "Actalis Authentication CA G3" (not verified))
by sea2.mail.beniculturali.it (Sophos Email Appliance) with ESMTPS id 1C9BD1E9E28_BB2FFE7F;
Tue, 2 Oct 2018 05:19:35 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (192.168.123.122) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4; Tue, 2 Oct 2018 07:19:30 +0200
Received: from ca4.mail.beniculturali.it (192.168.123.144) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4 via Frontend Transport; Tue, 2 Oct 2018 07:19:29 +0200
Received: from MDC.mail.beniculturali.it ([192.168.123.171]) by
ca4.mail.beniculturali.it ([192.168.123.144]) with mapi; Tue, 2 Oct 2018
07:19:29 +0200
Is it possible to spoof Received field somehow, perhaps using advanced techniques?
email email-spoofing
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |Â
up vote
2
down vote
favorite
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but then I've read this post which mentions that Received field can't be faked. It seems that received is proper in case of the e-mail I'm talking about:
Received: (wp-smtpd mx.tlen.pl 14490 invoked from network); 2 Oct 2018 07:19:36 +0200
Received: from mx.beniculturali.it ([194.242.241.200])
(envelope-sender <pm-pie.aglie@beniculturali.it>)
by mx.tlen.pl (WP-SMTPD) with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
for <myemail@10g.pl>; 2 Oct 2018 07:19:36 +0200
Received: from sea2.mail.beniculturali.it (localhost.localdomain [127.0.0.1])
by localhost (Email Security Appliance) with SMTP id 15EE31ECEEA_BB2FFE8B;
Tue, 2 Oct 2018 05:19:36 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (mb2.mail.beniculturali.it [192.168.123.122])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(Client CN "email.beniculturali.it", Issuer "Actalis Authentication CA G3" (not verified))
by sea2.mail.beniculturali.it (Sophos Email Appliance) with ESMTPS id 1C9BD1E9E28_BB2FFE7F;
Tue, 2 Oct 2018 05:19:35 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (192.168.123.122) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4; Tue, 2 Oct 2018 07:19:30 +0200
Received: from ca4.mail.beniculturali.it (192.168.123.144) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4 via Frontend Transport; Tue, 2 Oct 2018 07:19:29 +0200
Received: from MDC.mail.beniculturali.it ([192.168.123.171]) by
ca4.mail.beniculturali.it ([192.168.123.144]) with mapi; Tue, 2 Oct 2018
07:19:29 +0200
Is it possible to spoof Received field somehow, perhaps using advanced techniques?
email email-spoofing
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but then I've read this post which mentions that Received field can't be faked. It seems that received is proper in case of the e-mail I'm talking about:
Received: (wp-smtpd mx.tlen.pl 14490 invoked from network); 2 Oct 2018 07:19:36 +0200
Received: from mx.beniculturali.it ([194.242.241.200])
(envelope-sender <pm-pie.aglie@beniculturali.it>)
by mx.tlen.pl (WP-SMTPD) with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
for <myemail@10g.pl>; 2 Oct 2018 07:19:36 +0200
Received: from sea2.mail.beniculturali.it (localhost.localdomain [127.0.0.1])
by localhost (Email Security Appliance) with SMTP id 15EE31ECEEA_BB2FFE8B;
Tue, 2 Oct 2018 05:19:36 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (mb2.mail.beniculturali.it [192.168.123.122])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(Client CN "email.beniculturali.it", Issuer "Actalis Authentication CA G3" (not verified))
by sea2.mail.beniculturali.it (Sophos Email Appliance) with ESMTPS id 1C9BD1E9E28_BB2FFE7F;
Tue, 2 Oct 2018 05:19:35 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (192.168.123.122) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4; Tue, 2 Oct 2018 07:19:30 +0200
Received: from ca4.mail.beniculturali.it (192.168.123.144) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4 via Frontend Transport; Tue, 2 Oct 2018 07:19:29 +0200
Received: from MDC.mail.beniculturali.it ([192.168.123.171]) by
ca4.mail.beniculturali.it ([192.168.123.144]) with mapi; Tue, 2 Oct 2018
07:19:29 +0200
Is it possible to spoof Received field somehow, perhaps using advanced techniques?
email email-spoofing
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I've received some strange e-mail recently. The e-mail has different From and Reply-To fields. It has also To set to Undisclosed recipients but it's not crucial.
At first I thought it's fake, but then I've read this post which mentions that Received field can't be faked. It seems that received is proper in case of the e-mail I'm talking about:
Received: (wp-smtpd mx.tlen.pl 14490 invoked from network); 2 Oct 2018 07:19:36 +0200
Received: from mx.beniculturali.it ([194.242.241.200])
(envelope-sender <pm-pie.aglie@beniculturali.it>)
by mx.tlen.pl (WP-SMTPD) with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP
for <myemail@10g.pl>; 2 Oct 2018 07:19:36 +0200
Received: from sea2.mail.beniculturali.it (localhost.localdomain [127.0.0.1])
by localhost (Email Security Appliance) with SMTP id 15EE31ECEEA_BB2FFE8B;
Tue, 2 Oct 2018 05:19:36 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (mb2.mail.beniculturali.it [192.168.123.122])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(Client CN "email.beniculturali.it", Issuer "Actalis Authentication CA G3" (not verified))
by sea2.mail.beniculturali.it (Sophos Email Appliance) with ESMTPS id 1C9BD1E9E28_BB2FFE7F;
Tue, 2 Oct 2018 05:19:35 +0000 (GMT)
Received: from MB2.mail.beniculturali.it (192.168.123.122) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4; Tue, 2 Oct 2018 07:19:30 +0200
Received: from ca4.mail.beniculturali.it (192.168.123.144) by
MB2.mail.beniculturali.it (192.168.123.122) with Microsoft SMTP Server (TLS)
id 15.0.1395.4 via Frontend Transport; Tue, 2 Oct 2018 07:19:29 +0200
Received: from MDC.mail.beniculturali.it ([192.168.123.171]) by
ca4.mail.beniculturali.it ([192.168.123.144]) with mapi; Tue, 2 Oct 2018
07:19:29 +0200
Is it possible to spoof Received field somehow, perhaps using advanced techniques?
email email-spoofing
email email-spoofing
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 hours ago
Landeeyo
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 hours ago
Landeeyo
1113
asked 4 hours ago
Landeeyo
1113
1113
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Landeeyo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago
add a comment |Â
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
4
down vote
It is possible to add arbitrary fields to the mail and this includes Received header. But, any proper mail transport server will add new Received header on top of the mail which means that depending on the exact delivery infrastructure the attacker can at most fully fake all bot the top most Received header. In your specific example the top Received header seems to be some internal server and the next Received header is the one from your mail server at the perimeter which accepts mails from outside. All other Received headers might be faked.
And even the Received header added by the server at the perimeter might contain fake information. It is common that it includes the hostname claimed by the SMTP client within the EHLO or HELO command. Thus, in your specific example mx.beniculturali.it might be faked by the attacker while ([194.242.241.200]) is added by the receiving mail server to show from which source IP the mail was received and cannot be faked.
answered 4 hours ago
Steffen Ullrich
107k12182247
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
4
down vote
It is possible to add arbitrary fields to the mail and this includes Received header. But, any proper mail transport server will add new Received header on top of the mail which means that depending on the exact delivery infrastructure the attacker can at most fully fake all bot the top most Received header. In your specific example the top Received header seems to be some internal server and the next Received header is the one from your mail server at the perimeter which accepts mails from outside. All other Received headers might be faked.
And even the Received header added by the server at the perimeter might contain fake information. It is common that it includes the hostname claimed by the SMTP client within the EHLO or HELO command. Thus, in your specific example mx.beniculturali.it might be faked by the attacker while ([194.242.241.200]) is added by the receiving mail server to show from which source IP the mail was received and cannot be faked.
answered 4 hours ago
Steffen Ullrich
107k12182247
add a comment |Â
up vote
4
down vote
It is possible to add arbitrary fields to the mail and this includes Received header. But, any proper mail transport server will add new Received header on top of the mail which means that depending on the exact delivery infrastructure the attacker can at most fully fake all bot the top most Received header. In your specific example the top Received header seems to be some internal server and the next Received header is the one from your mail server at the perimeter which accepts mails from outside. All other Received headers might be faked.
And even the Received header added by the server at the perimeter might contain fake information. It is common that it includes the hostname claimed by the SMTP client within the EHLO or HELO command. Thus, in your specific example mx.beniculturali.it might be faked by the attacker while ([194.242.241.200]) is added by the receiving mail server to show from which source IP the mail was received and cannot be faked.
answered 4 hours ago
Steffen Ullrich
107k12182247
add a comment |Â
up vote
4
down vote
up vote
4
down vote
It is possible to add arbitrary fields to the mail and this includes Received header. But, any proper mail transport server will add new Received header on top of the mail which means that depending on the exact delivery infrastructure the attacker can at most fully fake all bot the top most Received header. In your specific example the top Received header seems to be some internal server and the next Received header is the one from your mail server at the perimeter which accepts mails from outside. All other Received headers might be faked.
And even the Received header added by the server at the perimeter might contain fake information. It is common that it includes the hostname claimed by the SMTP client within the EHLO or HELO command. Thus, in your specific example mx.beniculturali.it might be faked by the attacker while ([194.242.241.200]) is added by the receiving mail server to show from which source IP the mail was received and cannot be faked.
answered 4 hours ago
Steffen Ullrich
107k12182247
It is possible to add arbitrary fields to the mail and this includes Received header. But, any proper mail transport server will add new Received header on top of the mail which means that depending on the exact delivery infrastructure the attacker can at most fully fake all bot the top most Received header. In your specific example the top Received header seems to be some internal server and the next Received header is the one from your mail server at the perimeter which accepts mails from outside. All other Received headers might be faked.
And even the Received header added by the server at the perimeter might contain fake information. It is common that it includes the hostname claimed by the SMTP client within the EHLO or HELO command. Thus, in your specific example mx.beniculturali.it might be faked by the attacker while ([194.242.241.200]) is added by the receiving mail server to show from which source IP the mail was received and cannot be faked.
answered 4 hours ago
Steffen Ullrich
107k12182247
answered 4 hours ago
Steffen Ullrich
107k12182247
answered 4 hours ago
Steffen Ullrich
107k12182247
answered 4 hours ago
Steffen Ullrich
107k12182247
107k12182247
add a comment |Â
add a comment |Â
Landeeyo is a new contributor. Be nice, and check out our Code of Conduct.
Landeeyo is a new contributor. Be nice, and check out our Code of Conduct.
Landeeyo is a new contributor. Be nice, and check out our Code of Conduct.
Landeeyo is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f194980%2fis-it-possible-to-fake-received-field-in-the-e-mail%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
You could export a email from one inbox (e.g., *.eml format) and import it into another mailbox. Many clients won't complain. An email could be put into your inbox server side, it's just a file. I will let someone else go into more detail about why a server may accept or not accept fake headers when it receives it from a sender.
– Eric G
1 hour ago