Fabrizio d'Amore damore@dis.uniroma1.it - Sapienza
Fabrizio d'Amore damore@dis.uniroma1.it - Sapienza
Fabrizio d'Amore damore@dis.uniroma1.it - Sapienza
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
how to check for spoofing <br />
• no success-guaranteeing techniques<br />
o it is often easy to detected spoofed messages<br />
o sometimes it is hard or almost impossible<br />
• a good chance is to analyze the complete<br />
message (full header + body)<br />
o standard e-mail clients normally hide most of the header, since<br />
considered uninteresting<br />
o the analyst has to get the integral and original message: no standard GUI,<br />
IMAP can be good means<br />
o check fields From, Return-Path, Reply-To, Received<br />
• compare values (not all fields necessarily present in header)<br />
• lookup IP numbers (if any) and check domain names<br />
o many tools available for that<br />
E-Mail intro (2) March 2013 5
Change language