4:58 p.m.
I just received a message from
[sender](a)gmail.com
but the last line in the message is a bluish line saying
"Sent from Yahoo Mail on Android"
I do know someone named [sender] but the from address is not what I have
for that person, though the sender could have gotten a new e-mail
address very recently. Also, the from address being a Google e-mail
address seems to contradict the last line saying the message was sent
from Yahoo Mail. Is this message probably genuine or probably a spoof?
thanks,
Bill.
5:17 p.m.
On 19-07-13 17:58:12, home user via users wrote:
I just received a message from
[sender](a)gmail.com
but the last line in the message is a bluish line saying
"Sent from Yahoo Mail on Android"
I do know someone named [sender] but the from address is not what
I have for that person, though the sender could have gotten a new
e-mail address very recently. Also, the from address being a Google
e-mail address seems to contradict the last line saying the message
was sent from Yahoo Mail. Is this message probably genuine or
probably a spoof?
If you can't tell from the content, it's usually spam.
Look at the message header. (View Source is a good way, as it will be
exact.) The first Received: line and any lines before it come from
your email provider, who is mostly to be trusted, though anyone can
make mistakes. If that line says the "from" is reasonable, look at
the lines up to and inclucing the next Received: line and loop,
otherwise stop, it's spam. You can also look at other header fields;
it may be the sender did get a new email address but prefer replies to
go to the old one -- but probably not.
--
____________________________________________________________________
TonyN.:' <mailto:tonynelson@georgeanelson.com>
' <http://www.georgeanelson.com/>
6:29 p.m.
(Tony Nelson said)
[snip]
Look at the message header. (View Source is a good way,
as it will be exact.) The first Received: line and any
lines before it come from your email provider, who is
mostly to be trusted, though anyone can make mistakes.
If that line says the "from" is reasonable,
I attached the full message with line numbers added to help discussion,
and with private parts replaced with "[private]". You are referring to
line 31, not line 7, right? I don't see anything there saying/implying
the "from" is reasonable.
look at the lines up to and inclucing the next
Received: line and loop, otherwise stop, it's spam.
You're referring to line 33, right?
I don't understand what you mean by "line and loop".
The main thing troubling me is that the message claims to come from a
gmail address, but it's sent from Yahoo Mail. How is that possible?
thanks,
Bill.
6:37 p.m.
On 07/13/2019 05:58 PM, home user via users wrote:
I just received a message from
[sender](a)gmail.com
but the last line in the message is a bluish line saying
"Sent from Yahoo Mail on Android"
I do know someone named [sender] but the from address is not what I have
for that person, though the sender could have gotten a new e-mail
address very recently. Also, the from address being a Google e-mail
address seems to contradict the last line saying the message was sent
from Yahoo Mail. Is this message probably genuine or probably a spoof?
thanks,
Bill.
It is surely spam. You should advise your friend that his email has been
compromised, and he should be aware of any possible malware on his
computer. There probably is some! (I have seen this situation myself!)
--doug
6:56 p.m.
On 20190713 16:29:20, home user via users wrote:
(Tony Nelson said)
> [snip]
>
> Look at the message header. (View Source is a good way,
> as it will be exact.) The first Received: line and any
> lines before it come from your email provider, who is
> mostly to be trusted, though anyone can make mistakes.
> If that line says the "from" is reasonable,
I attached the full message with line numbers added to help discussion, and with
private parts replaced with "[private]". You are referring to line 31, not
line
7, right? I don't see anything there saying/implying the "from" is
reasonable.
> look at the lines up to and inclucing the next
> Received: line and loop, otherwise stop, it's spam.
You're referring to line 33, right?
I don't understand what you mean by "line and loop".
The main thing troubling me is that the message claims to come from a gmail
address, but it's sent from Yahoo Mail. How is that possible?
thanks,
Bill.
spoofheader.txt
1 X-Apparently-To: [private]; Sat, 13 Jul 2019 21:33:09 +0000
2 Return-Path: <[private]>
3 Authentication-Results: mta4406.mail.ne1.yahoo.com;
4 dkim=pass (ok) header.i=(a)gmail.com header.s=20161025;
5 spf=pass smtp.mailfrom=(a)gmail.com;
6 dmarc=pass(p=none sp=quarantine dis=none) header.from=gmail.com;
7 Received-SPF: pass (domain of gmail.com designates 209.85.166.41 as permitted
sender)
8 X-YMailISG: UfTWcpUWLDt9VbLjmP9pJbf3OmIC53rwpG_C7TjDRgDymvPB
9 BTNlUcZakGXI0sxvNXFx9wzjJmKP2kAY0t9JoARolsPbRSV4A4fCsh65475m
10 jclL.itnwmgSrdNG.AkDZjtUeVEEZOj8kwtvd4Ucw3zfi2jZWVYyKQuFkNyp
11 5EUUs3eEy4yJ6K7_SH_I64Ekx.2TOTseBrw55XGKXVb0oe0xLZ3k9EBxOmat
12 lvkQYub6IhXGJQMSjnkD4d.8bLvW3JwtamQh_jrWegyZgakvGmV018guKJjW
13 IzZNgBYT2zX4B6bRmwya0FPkga9FYlAwSUJjL6n4BAbPqAqyqWg0EEI1Jngq
14 MuQCnef8RiF75VlahGYYDQuDDK0KHs2UQmvOx6QItfSIdO8.v0glMZGxK17b
15 loYVsNGjFiuEPiNmgDfp8flbjNBBW6n6M.FG3msDMMPJ8FKqyIqdcn.qhQ.q
16 EynO_PhlDlSsYlTq5_YftYVABxPnhAhdgKZc8ve.YvvTLuQOQUF_YSyCdkNT
17 ElCIbOzaIx9dp7OmoF0l7y8d61VQEdP6MvWhnptBh5KYKVWsh3pQYCioKGue
18 KeFgvzEw5uj8mQYa_OzqcpCc9.l6RE17rIOkglKMivY._rRHeCs38uP4NBLg
19 z0pnQLsZg.LnzCoEIF7jCSvLx.cS02eniB2tvFyA1Mn84J_S9HwxrRcehDfd
20 lnO_UDzlDDhYWsMSzgAdFsvsQQM6VO61lN_WboZJFaVDj0YezwC_iQxrk.om
21 2gfQqXo.bDBUs9wyYbmqz2yJJfqsbW8gJReDClOrkZJbUFNa7MJwfV0bKXNW
22 A9BuWK3VaQKbBqxJDtj1xGhn9lNY5PpyBCQkFG1WVYN_SbJY2uGP50m2.tP3
23 VDwNXvUqwN6A.EToTeuTEUq_pMMq4W9O5ZxXH9oCiQORHHi5gDjFOd32bQLk
24 l_VrTlYbtTEG5uNsgWjsTPc_YHwLfeBf.m2bBS8AtVvjzKETSz0tpDiclDHI
25 zQ3JnWkop3i2RofghLWhBV6sEw1kDrIuE7bw70IXwRWibvTRwePFk_KtGlmZ
26 mvJg8azDq2y9l4wmvA_xMo15lCYOytM.y62IYjzzL.9_H9rmTct1ulWJF.2F
27 W00ZmlsX7ju3si2yG6GCsPGylbBB1k6fl1dQHm0UHPPbZPMQWt6eA6CZpFfn
28 DzQCnwS3S4Un.NZBfdhUPTmVltz.0qKQyvSu4X3CK4Mauw3Cdr0BIM2ELxXb
29 Uq.a700ZtETRgLZiYHkZYDE-
30 X-Originating-IP: [209.85.166.41]
31 Received: from 127.0.0.1 (EHLO mail-io1-f41.google.com) (209.85.166.41)
32 by mta4406.mail.ne1.yahoo.com with SMTPS; Sat, 13 Jul 2019 21:33:09 +0000
33 Received: by mail-io1-f41.google.com with SMTP id k8so27923627iot.1;
34 Sat, 13 Jul 2019 14:33:09 -0700 (PDT)
35 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
36 d=gmail.com; s=20161025;
37 h=date:from:reply-to:to:message-id:subject:mime-version:references;
38 bh=MgkjHii2ksvTjACY0qnqI3YCoTu9q9HsYjhT+2mleGw=;
39 b=QTBD19oaeu7t5qGDN2Tm/JEIccMRvh9+kwxLbhjDNh0auWHq58VPxTlRBVVuKWtpDD
40 g0eGmTLB74eCSkKj3UooCw46WfD0lEIFgt0Bg0WR7fIqqOtCgKqjDllKZVsslHM4MGxK
41 kq+aCIEsUVS2MDIoBqYmuwa+NaGpcl0j+VRqOgF0Ftmq8X5ya8yI+Fj33jugeMdMwyfT
42 97hiZunVJ/UDHNgJOgf0WFrApWVBiJnP2kudJGrTKlL2ooV58OxlLtaRw27wBJbrR5Lg
43 xqtlZb14gbk1MK/0gkRP9SfXCr2sWgg6nZWXa0k1G7MQpv8EzLeLudHleYxzK45Z2git
44 OiqQ==
45 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
46 d=1e100.net; s=20161025;
47 h=x-gm-message-state:date:from:reply-to:to:message-id:subject
48 :mime-version:references;
49 bh=MgkjHii2ksvTjACY0qnqI3YCoTu9q9HsYjhT+2mleGw=;
50 b=PsYXrRGycP3WDRvhunmjg0E1vCMI83JKy7XzgDGRuUKZVIL/IrYzjnans9AEamkhyL
51 5foQFF1xnmPe2ES31P1VFGDWnZUjlT9L+yGkxZsN8erHPHkOnASWtjPDbl5U3qzNve/s
52 3+91vMQKDZWFRNLPoqFHxyJEicmxHHSkLV+qiyVfzhNHUjQnkzaP8MQ1pXMR+ct3oEcF
53 23i+esUsdIAqC7AAJKQvQ4uM2MrVDCQxnlkmhqNaGWiKXHuv0CCLBs2ZXYKr6JpD4UeJ
54 FeFTmWhSpqorjpOo4v2KboO29ZU7BbrzxvPZwHH7oc+lX1MNth2ORa9JQHLlMVJPjdem
55 DoEw==
56 X-Gm-Message-State: APjAAAUieN/NT/7bCGWoOCM7p0nun2dENZf7WZrsTjn7e7JiNSaAQQ46
57 X+4+o9+krEqnlaDFkXSNKTHbhkfD
58 X-Google-Smtp-Source:
APXvYqxNOZUf94JAPxPHigDL21gIoXISKHQ4MHaZ+KA1x45IsuDXHevxMaE5RfBSUn/DcRe8IdhLiw==
59 X-Received: by 2002:a5d:9b1a:: with SMTP id y26mr17672471ion.238.1563053588544;
60 Sat, 13 Jul 2019 14:33:08 -0700 (PDT)
61 Return-Path: <[private]>
62 Received: from sonic316-12.consmr.mail.bf2.yahoo.com
(sonic316-12.consmr.mail.bf2.yahoo.com. [74.6.130.122])
63 by smtp.gmail.com with ESMTPSA id
z26sm13199729ioi.85.2019.07.13.14.33.07
64 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
65 Sat, 13 Jul 2019 14:33:07 -0700 (PDT)
66 X-YMail-OSG: 05TfIBwVM1nOm3krOdXc5g5lmLSqCqfZZ2ce7zPSafn7Sr63s53U.016lN9lA37
67 uRhpAvb.Mv5uv3IvADfErNmdBK_rICbXAcLzYiDvHWk8GE0WSaZ5Y4zURu9ZM0JM8uR2FmyZhn1u
68 bYN.b1gmvrZRlylvv6T7va1udVVznhpTj1QUseVarX47asTYiX_SLnQ9tt0NvO92UA9CiL0CpV2K
69 VqGFs.ANovj4Qd68cr4AAUESN8UzfFE.gXVM9DR2gPVUF5JCV6r67sD5HErYC0ZmXNK_ae59sb0g
70 dscL99YxuchHrBBAjvoDYGZIToxuUyHAdHBrGSaw3S4NYvV1pfjvu4R2a9VCkGo00KLEHDRDJYtj
71 LBiY71qiINS7Ha_jwqMSIlypGlJzezRFK2L7P9bA_4IdRYhI6hCGSbiUAA7alRg88cCTdpU1CJYE
72 5U0Gf5yGqnvgvSz5XNfnJ0y4QnVhDhpHHbTYt1Tc3lOpTm9rz98DmO_O7mMMHgKhwt9mwsxBUh_Z
73 iVgGQxK1uCooUbZV103jyWcYouw_3BUWgf2pfSJi_6nzqRMzeg8wjbpdSNmo2ozDD3Y5TqgpO8sv
74 V._6Y31EjYJZcUGq232rTran70ZMFiMoNJqmIu9tBZRqnI_65zK1dpPIgmr2b1ryK0hCkOHtE1cg
75 Fsj.J0F_Qc7L4MQz3MUtFiQ8n6vcjc6G1KtGo6dsgNb1OfMfKdqPmqep_5x0TwRTkVptxJlaR4Vv
76 YufOOyRXzblvAlxIZ8buY426YqrtioX4gMt9PtX.6IqPNWHZrv1Z4FYOJ5tkWganEoPIrFADNPce
77 AuImyY4NoipQ5tw7nHMkbCJNSDPl.5SQ7el7zDT0sTamvkGmoC89nn_H62QIgC2fK_NVax3XWC86
78 TCgakie6nLAkkyy.MkdAP1XiyjKHamhjHxtnrMrkn5NlP5_ielsgw0Di9cff6lNa6ha.7uMZOHRf
79 Imtufmlv7gIMY.CDv.z_ztslxxR.7gLFRmjyFISxPa0t9iF56ayKdLR5bBWctnb3FEx6ntp6338j
80 U_wgfbZrAVoSYULPv9BaM2Gr2m6y8qvxO_RxPnADfYgkRV8LhEL3KxlHiE3t4tiEN8k15rjWGpIJ
81 B4JGWNg_kAd69u3Tz04JjOPukjvRnJopT19IC.p.ES8np6vyxD4kVAW3WOMzzVFYL9TRVERWhoE2
82 Avesex8owsR7asEkxGkx5GnMBWiQHcS942pxzDRTwgYf0ED53eeGwyzPMJj.E86rWPM3QQ8O0LGF
83 Po8OFW75q1pd2xSfRcx_efQB6.7riPOE3rZHya8lLt_j33x1y8s9nNh6H
84 Received: from sonic.gate.mail.ne1.yahoo.com by
sonic316.consmr.mail.bf2.yahoo.com with HTTP; Sat, 13 Jul 2019 21:33:07 +0000
85 Date: Sat, 13 Jul 2019 21:33:02 +0000 (UTC)
86 From: "[private]" <[private]>
87 Reply-To: "[private]" <[private]>
88 To: [private] <[private]>, [private] <[private]>
89 Message-ID: <1006046679.433253.1563053582396(a)mail.yahoo.com>
90 Subject: [private]
91 MIME-Version: 1.0
92 Content-Type: multipart/alternative;
93 boundary="----=_Part_433252_1220207963.1563053582396"
94 References: <1006046679.433253.1563053582396.ref(a)mail.yahoo.com>
95 X-Mailer: WebService/1.1.13991 YahooMailAndroidMobile YMobile/1.0
(com.yahoo.mobile.client.android.mail/5.40.2; Android/8.0.0; R16NW; j7topltetmo; samsung;
SM-J737T; 5.46; 1280x720;)
96 Content-Length: 948
97
98 ------=_Part_433252_1220207963.1563053582396
99 Content-Type: text/plain; charset=UTF-8
100 Content-Transfer-Encoding: quoted-printable
101
102 [private]
103 [private]
104
105 Sent from Yahoo Mail on Android
106 ------=_Part_433252_1220207963.1563053582396
107 Content-Type: text/html; charset=UTF-8
108 Content-Transfer-Encoding: 7bit
109
110 [private]<br><br><div
id="ymail_android_signature"><a
id="ymail_android_signature_link"
href="https://go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature">Sent
from Yahoo Mail on Android</a></div>
111 ------=_Part_433252_1220207963.1563053582396--
At a quick glance the email itself probably flowed from a yahoo sender to your
gmail account. This portion of the bottom of the message bothers me:
href="https://go.onelink.me....
You erased one of the more important clues for legitimacy. Do the "Reply-To:"
and "From:" headers make sense when considered together?
I note that "anyone" (or any sufficiently clever robot) can create a yahoo
account and send at least a few emails. So if the email was unexpected and/or
from somebody you do not know it is right to question it. Does the "From:" make
sense considering the contents. There is no way I can tell. You even blanked the
subject. If it was a "your bank account has been compromised" email sent through
Yahoo, why are you asking here about legitimacy of such a monstrosity? And if
there is ANY question about the email and it is asking you to forward money "to
your boss vacationing in Mexico" faghedaboudit. Use some thinking. And if you
must worry about this send email back, gritting your teeth over the spamload
this will unleash to a known "good" address, and ask for some information only
you and your boss know. Establish identity beyond question before sacrificing money.
It's not paranoia when "they" really are out to get you but it's not
personal,
they will take any sucker they can get. It's prudence that says email is not to
be trusted beyond the value you stand to lose by trusting it.
{^_^} Joanne
7:16 p.m.
On 7/14/19 7:56 AM, jdow wrote:
You erased one of the more important clues for legitimacy. Do the
"Reply-To:"
and "From:" headers make sense when considered together?
You forgot the most important factor.
If you have to ask the question:
"Is this message probably genuine or probably a spoof?"
the answer is: "It's a Spoof!".
But, if you're really not sure because your friend does offer you $ from a dead
Nigerian
oil magnate, from time to time, you can email them back with your bank details. :-) :-)
--
Right: I dislike the default color scheme Wrong: What idiot picked the default color
scheme
7:58 p.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
Good evening,
(jdow asked)
Do the "Reply-To:" and "From:" headers make
sense
when considered together?
They match.
Does the "From:" make sense considering the contents.
Yes. Likewise the subject. But the info in those parts could have been
obtained from social networking sites.
(responding to everyone)
The message was personal (nothing about money), which is why the subject
and body were blanked. This was the first I had seen the "From" address
from this particular sender, which is a second thing that made me
uncomfortable.
The sender rarely answers the phone. But this time, the sender did
return my call. The message was genuine; it was not a spoof, the sender
was not hacked. The sender thought he/she sent the message from a yahoo
address that I've known for a long time; he/she was surprised when I
said the message came from a gmail address that I had never seen before.
The rules that y'all mentioned do make sense, but this turned out to
be an exception. I also did not know that yahoo had ways for people to
send messages and have them come from a gmail from address.
I've tagged this thread SOLVED. Still, what is the "line and loop,
otherwise stop, it's spam." that Tony mentioned?
Thank-you everyone. Have a good weekend.
Bill.
11:50 a.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
On Sat, 2019-07-13 at 18:58 -0600, home user via users wrote:
Still, what is the "line and loop, otherwise stop, it's
spam." that
Tony mentioned?
'If that line says the "from" is reasonable, look at the lines up to
and inclucing the next Received: line and loop, otherwise stop, it's
spam.'
I think he means:
1. Look at the lines up to and including the next received line.
2. Repeat the process, upwards.
3. Otherwise, stop looking any further, it's spam.
When you write an email, your mail client writes some headers above
your message, and posts it. The mail server adds more headers above
that, and sends it along its way. Every mail server it goes through
writes its own headers above the existing ones. They all do that,
until you get your hands on it. None of them change existing headers,
nor do they write anything below existing headers.
There are some exceptions to that rule (of only adding stuff to the
top).
Your mail client can add headers wherever it wants to, when it receives
emails. Chances are that it won't, but since you're the end of the
road, it doesn't have to comply with other things.
You might have anti-spam filtering software which adds some headers
that aren't at the top, as well.
List mail servers often add list headers just above the message. This
one does, you can see from a message through this list that the message
went through a few servers before it reached the Fedora servers, yet
there are mailman listserver headers just above the message (the
unsubscribe, etc., moderation headers).
Look at your original post for this thread, for an example.
Above the message are things that are probably from your mail client
when you posted it (cc, from, content- details), but could be from the
list. Then the list server has added several list- headers above them.
Above that are some x-mailman headers, above them are some things from
your mail client (user-agent, date, message-id [might be from you,
doesn't have to be], subject, to. Above that are received-by headers
from the first server that your post went through (three yahoo
servers). Above that is a received line from the fedora mail server.
Above that are some x-spam markers. Above that some more received
lines from the next couple of servers to handle the message. Then some
DKIM headers above them associated with the received line above them.
Above that, are headers pertaining to the message coming to me from the
list.
While there's a lot of chaos in there, the "received" headers should be
in logical sequence. Stacked on top of each other as each mail server
has received the message. If they add extra headers, too, they'd be
under *their* received headers.
Just think of it as going through several sorting offices, each putting
a sticker on top.
12:20 p.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
Thank-you, Tim, for the follow-up.
> 'If that line says the "from" is reasonable,
> look at the lines up to and inclucing the
> next Received: line and loop, otherwise
> stop, it's spam.'
I think he means:
1. Look at the lines up to and including the next received line.
2. Repeat the process, upwards.
3. Otherwise, stop looking any further, it's spam.
Parse Error! My mind incorrectly parsed what Tony said. I took "line
and loop" as two parallel verbs connected by the conjunction "and". Now
I see that "line" is a noun qualified by the adjective "Received:".
I believe I successfully followed the rest of what you said, but I don't
quite get what to look for as flags that a message is likely a spoof.
I've known for some time that
- messages from most countries other than my home country,
- messages claiming I'm in legal trouble, tax trouble, etc.,
- messages asking for crypto-currency, gift cards, and other hard or
impossible to trace payment, and
- threatening messages
are almost certainly malicious and should not be responded to or
forwarded, should not have links in them clicked or attachments to them
downloaded, perhaps should be reported to appropriate authorities, and
certainly should deleted. Those are not the messages that trouble me
most. It's other kinds of messages. The message that I started this
thread because of came from someone I've known for decades, but the
"From" was an address I had not seen before. But recent events have the
sender (and two other people) in a vulnerable position. I had to be
careful.
I've heard that if a malicious person/group
- can access someone's address book
AND
- has the tools to do spoofing,
then he/they can spoof the e-mail addresses of everyone in the address
book *without* knowing the password of anyone in that address book. I
think this happened to me a few years ago. I lost friends as a result
of this event. Changing passwords made no difference. I had to delete
all my e-mail accounts, create new ones, and do a lot of contact
information changing. 2-3 years after that, a friend got a message (an
e-card) from the old, dead-for-over-2-years e-mail address and clicked
the e-card link, which infected his system. I was able to verify that
the old e-mail address really was still dead.
I realize there is no perfect solution or 100% safety. But for the
benefit of others as well as myself, I'm following up on this. When I
do as Tony and Tim suggest, what am I looking for that would be a red
flag the the message is (probably) bad, or would be a green flag that
the message is (probably) genuine and safe?
thanks,
Bill.
8:03 p.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
On 7/15/19 10:20 AM, home user via users wrote:
are almost certainly malicious and should not be responded to or
forwarded, should not have links in them clicked or attachments to them
downloaded, perhaps should be reported to appropriate authorities, and
certainly should deleted. Those are not the messages that trouble me
most. It's other kinds of messages. The message that I started this
thread because of came from someone I've known for decades, but the
"From" was an address I had not seen before. But recent events have the
sender (and two other people) in a vulnerable position. I had to be
careful.
If you're not sure and it's important, then try contacting them to
verify it. Use an alternate method if possible.
I've heard that if a malicious person/group
- can access someone's address book
AND
- has the tools to do spoofing,
then he/they can spoof the e-mail addresses of everyone in the address
book *without* knowing the password of anyone in that address book. I
This is trivial to do and there is malware out there doing it.
think this happened to me a few years ago. I lost friends as a
result
of this event. Changing passwords made no difference. I had to delete
Right, because the senders aren't actually using your email account,
just sending emails that appear to be from your email address.
all my e-mail accounts, create new ones, and do a lot of contact
information changing. 2-3 years after that, a friend got a message (an
Are you going to change your email accounts every time some spammer
starts using the address? My email address has been used by virii and
spam for at least 15 years. It was funny because when this started to
be a thing, I got a few emails from people telling me to stop sending
them a virus.
I realize there is no perfect solution or 100% safety. But for the
benefit of others as well as myself, I'm following up on this. When I
do as Tony and Tim suggest, what am I looking for that would be a red
flag the the message is (probably) bad, or would be a green flag that
the message is (probably) genuine and safe?
The content is usually the first easy clue. If you're not sure, then
then you could just phone them to check. Otherwise, check the headers,
since it's extremely difficult, if not impossible to fully spoof those
because you can't control the receiving email server.
For example from this email I'm replying to:
From: home user via users <users(a)lists.fedoraproject.org>
Cc: home user <mattison.computer(a)yahoo.com>
Because of Yahoo's email policies, the mailing list has to mask your
From address, but I can still see it in the CC. In most cases, this
won't be an issue anyway. So the sender is claiming to be a Yahoo email
user.
Message-ID: <607fc195-8ffc-539a-2374-9a55d86df96e(a)yahoo.com>
Could be spoofed, but not likely. Most spammers and phishers don't try
very hard, they're just looking for easy targets. Good indication that
it did come from Yahoo.
Received: from bastion.fedoraproject.org (bastion01.fedoraproject.org
[209.132.181.2])
by gw.sieb.net (Postfix) with ESMTPS id E07299011D5
for <samuel(a)sieb.net>; Mon, 15 Jul 2019 10:22:12 -0700 (PDT)
Received: from mailman01.phx2.fedoraproject.org
(mailman01.phx2.fedoraproject.org [10.5.126.36])
by bastion01.phx2.fedoraproject.org (Postfix) with ESMTP id 3FD5C636AE3F;
Mon, 15 Jul 2019 17:21:35 +0000 (UTC)
Received: from mailman01.phx2.fedoraproject.org (localhost [IPv6:::1])
by mailman01.phx2.fedoraproject.org (Postfix) with ESMTP id 02BB558230940;
Mon, 15 Jul 2019 17:21:35 +0000 (UTC)
Received: by mailman01.phx2.fedoraproject.org (Postfix, from userid 991)
id 02EF1582303F1; Mon, 15 Jul 2019 17:20:47 +0000 (UTC)
Received: from smtp-mm-osuosl01.fedoraproject.org
(smtp-mm-osuosl01.vpn.fedoraproject.org [192.168.1.23])
by mailman01.phx2.fedoraproject.org (Postfix) with ESMTP id 759D8582303F1
for <users(a)lists.fedoraproject.org>; Mon, 15 Jul 2019 17:20:47 +0000 (UTC)
Received: from sonic303-24.consmr.mail.gq1.yahoo.com
(sonic303-24.consmr.mail.gq1.yahoo.com [98.137.64.205])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
Received: from sonic.gate.mail.ne1.yahoo.com by
sonic303.consmr.mail.gq1.yahoo.com with HTTP; Mon, 15 Jul 2019 17:20:45
+0000
Received: by smtp410.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with
ESMTPA ID 8e0e804dc1d033d6f53cc5944fce1b89;
Mon, 15 Jul 2019 17:20:43 +0000 (UTC)
This is the path that the mail took, the top line is the most recent.
The only ones that could be spoofed are at the bottom. Follow the trail
from the top and check that the times are reasonable. (Of course
someone's clock might be off.) My email server got it straight from the
Fedora mailman server. Before that it bounced around in the Fedora
infrastructure a few times, but eventually you see that they got it from
a Yahoo server. The Yahoo server doesn't say where it got it from, so
maybe it was webmail or else they hide the client IP address for
"security" reasons.
Here's an example from a phishing email that that could be scary if you
don't know or if you have been doing what it claims you've been doing.
I can't copy and paste the content of the email because it's only an
image of text. That's of course a huge red flag that's it's fake. The
message is that they've hacked my email account and my computer and have
been watching me use adult content sites. The From and To on my screen
show my full name and email address, scary! However, look a little
deeper. The reason my full name is showing is because my email client
got that from my contact info. (This actually had me wondering for
quite a while until I figured it out.) Check the headers.
From: <samuel(a)sieb.net>
To: samuel(a)sieb.net
Ok, but
Return-Path: <silviacarames(a)imagenesgammasrl.com.ar>
They didn't even try very hard to hide their tracks.
Received: from ar78bis.xvserver.com (ar78bis.xvserver.com [200.85.158.117])
by gw.sieb.net (Postfix) with ESMTPS id 3A6479010E0
for <samuel(a)sieb.net>; Sun, 31 Mar 2019 07:23:51 -0700 (PDT)
Received: from ([127.0.0.1]) with MailEnable ESMTPA; Sun, 31 Mar 2019
11:13:40 -0300
Message-ID:
<eou22i5u3ocnnd9qobvof9ltn.k5ef8nuy67.98155992898442.t7exji5xlo.w3zrnhyz(a)mail430.arr07.imagenesgammasrl.com.ar>
It came from some windows computer, maybe hacked, maybe not.
Spamassassin assassinated this one because it was so clearly spam, but
that's the idea of how to verify email.
10:28 p.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
Tim:
> I think he means:
> 1. Look at the lines up to and including the next received line.
> 2. Repeat the process, upwards.
> 3. Otherwise, stop looking any further, it's spam.
Bill:
Parse Error! My mind incorrectly parsed what Tony said.
I didn't find the language too clear, either. But knowing how to read
email headers, I took a crack at decoding what he wrote.
I've known for some time that
- messages from most countries other than my home country,
- messages claiming I'm in legal trouble, tax trouble, etc.,
- messages asking for crypto-currency, gift cards, and other hard or
impossible to trace payment, and
- threatening messages
are almost certainly malicious and should not be responded to
Here, in Australia, you can almost guarantee that you won't get
official mail about being in trouble. Legal, tax, debts, whatever will
be harassing you with phone calls, letters on paper, and pounding on
your front door. The phone calls are the hardest to tell if they're
legit, because they come from overseas call centres with bad English,
fake or no caller ID, the same as the nuisance calls.
You can't win a lottery you didn't enter, and although a friend could
buy a ticket for you, you'll probably find out about that from them,
and no legit lottery asks you to do dodgy things for your prize.
Gift cards will be a hard one to figure out, too. You might be
subscribed to something that gives you a special offer, but they don't
do it themselves, they've employed a third party. I usually avoid
special offers, anyway. You get some 20% off if you spend some $200
that you weren't going to spend in the first place. You save more
money by not buying anything. And you avoid further spam.
If I have a shop ask me for an email for warranty reasons, I hedge on
giving them anything. Though with today's vanishing invisible ink cash
register receipts, it may be a good idea with large purchases. I'll
give them an already public address, or special different address which
I can track who gave it away.
e.g. Some mail servers let you tag +word to your username, and they'll
deliver it to your normal address.
tim+fridge(a)example.com
tim+furniture(a)example.com
tim+insurance(a)example.com
All of them would be delivered to tim(a)example.com. If I receive some
spam from one of those addresses, I'll know exactly who sold my email
address. You could send them the bill for your email filtering
software/service.
I've virtually given up on reporting things. There's so many gazillion
spams and scams they can't get policed. Any time I've traced some bank
scam report, I can see that it's already been reported many times.
That's no surprise, with the sheer numbers of people they've spammed.
And I've found that when you make some reports, they contact the
miscreant *with* your complaint, including your details, and you get
more crap from the miscreant.
There are so many things that harvest contact details, if you make a
post in public you can almost guarantee that someone has copied the
address. Hence why I post on here from an auto-deleting mailbox.
Anybody can send an email with a "from" address stating whatever they
type into it. Although some servers verify that, by requiring you to
log in before sending, so spammers cannot post through them, not all
do. And some servers can refuse reception of unverified mail, or mail
from domains that have not gone through that domain's mail server.
e.g. Gmail will check a message that says it was posted from a yahoo
address, to see if it passed through the yahoo mail servers, and check
that the yahoo mail servers verified it.
It's the same kind of thing with nuisance calls. Your number is
harvested from somewhere, it gets sold to call centres. It could be
from some company you gave details to, it could be from an app on your
phone that copies all your stored contacts (including friends who've
given you their unlisted number). And you have call centres which hide
their caller ID, or write fake numbers into it (hoping to get past
people who don't answer anonymous calls). If the phone companies
refused to connect calls with faked numbers, we'd be a lot better off.
I get a lot of nuisance calls that have ridiculously long numbers, or
from numbers belonging to disconnected services. The phone system is
computerised, you can't convince me that they can't verify a number
before making the connection. Nor that they can't identify a call
centre from the huge volume of traffic coming from it, the mass of
wrong numbers, the calls that get answered for a few seconds and then
hungup on. ISPs have been doing firewalling and spam filtering for
years, it's about time the phone companies did, too.
I realize there is no perfect solution or 100% safety. But for the
benefit of others as well as myself, I'm following up on this. When
I do as Tony and Tim suggest, what am I looking for that would be a
red flag the the message is (probably) bad, or would be a green flag
that the message is (probably) genuine and safe?
I find that most spam has a stupid "from" address, often another
completely unrelated "reply-to" address. If you see an address that's
almost like a real one, be suspicious (slightly different spelling,
extra words, extra punctuation). Any mail addressed as coming from you
that *you* didn't type, is spam.
If you get an email that purports to advertise a new thing from your
bank, visit your bank website, and see if they advertise the same
thing. Don't click a link in the email, even avoid googling the
address for your bank. Hand-type the actual address for your bank in
your browser, then bookmark it for future reference. There's plenty of
website scams which have used an address that's just one letter
different from a real address.
Switch off features in your mail client which change how it displays
addresses in the viewer. Have it show addresses exactly how they were
typed in the message. Don't let it pick out the real names from your
address book, then use them, instead. Don't let it hide the email
address to just show the username.
If you can configure your mail program to show a few more headers above
the message, get it to include displaying the reply-to header. You can
even get it to show the mailer header (mine will show I'm using
Evolution, and occasionally Thunderbird). You'll eventually remember
what you're friends use, and spot some weird spam program as being
different, unusual, or missing.
Anti-spam filtering programs can add headers, you can have their spam
score displayed, too. Some will munge extra stuff in the subject, but
it *may* be more convenient to view the information separately.
If your mail program has a status bar, don't turn it off. Usually,
they'll reveal the addresses of links in the page if you hover the
mouse over the link without clicking on it. It's common for spammers
to try an obscure the address in various ways. One way is with HTML
mail, they'll write an address in the text that appears on the page,
but it's a link to some other address.
e.g. In HTML links are constructed with code like this:
<a href="address">text</a>
The link uses the address in the HREF= data, but displays whatever is
between the > </a> portion. That's how webpages work.
e.g. <a href="homepage">visit the homepage</a>
<a href="http://google.com/">use Google</a>
But if some bastard writes:
<a href="http://scam.example.com">www.google.com</a>
You'll *see* the google address written in the page, but the link will
take you to the scam address. If you have the status bar visible on
your program, hovering over the link without clicking on it will show
you where the link would take you, without actually going to it.
One day someone might think to create a plug-in that checks links with
two different addresses in such links, and red flags them.
Some people sign their posts so the recipients can check that *they*
were the author. You can do that, too.
--
[tim@localhost ~]$ uname -rsvp
Linux 5.0.16-100.fc28.x86_64 #1 SMP Tue May 14 18:22:28 UTC 2019 x86_64
Boilerplate: All mail to my mailbox is automatically deleted.
There is no point trying to privately email me, I only get to see
the messages posted to the mailing list.
- Mwuu haha haaaaa haaaa, soon the world will be mine!
- Sir, you've got to take your finger off the intercom button.
12:42 a.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
On 7/15/19 8:28 PM, Tim via users wrote:
One day someone might think to create a plug-in that checks links
with
two different addresses in such links, and red flags them.
Thunderbird warns me about some links. I'm not sure what its criteria
are, but it asks if I'm sure that I want to go to the link because it
doesn't match what it expects to be valid. For example, if I get an
email with a survey request that is at a different domain than the sender.
Some people sign their posts so the recipients can check that *they*
were the author. You can do that, too.
I assume that you mean crypto signing, but even using a single line text
signature would also help, at least to distinguish from automated
impersonation.
5:51 a.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
On Mon, 15 Jul 2019 at 22:52, Samuel Sieb <samuel(a)sieb.net> wrote:
[...]
Are you going to change your email accounts every time some spammer
starts using the address? My email address has been used by virii and
spam for at least 15 years. It was funny because when this started to
be a thing, I got a few emails from people telling me to stop sending
them a virus.
I've had the same experience.
I've been using the same personal address since internet reached the city
where
I lived (3 decades). My address ended up in the ghostscript documentation,
so has been harvested by spammers many times. There were a few times
that spam messages were coming faster than I could delete them, so
incoming mail was bouncing, but I was also getting legitimate requests for
help with ghostscript issues. My collection of spam messages was useful
to tweak filters.
One note: I do look at Reply-To header lines. Most of the spam I get
does not have Reply-To header lines, but perhaps some upstream filter
is blocking messages where the Reply-To address is suspicious.
--
George N. White III
2:50 p.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
(responding to Samuel, George, and Tim)
If you're not sure and it's important, then try contacting
them to verify it. Use an alternate method if possible.
That's how the message that triggered this thread was ultimately solved.
But sometimes that's not available. I have several foreign friends,
and e-mail is the only contact method available to me. Even if I did
have phone numbers for them, the time difference makes reaching them
impractical. (besides, who answers personal calls anymore?!)
Are you going to change your email accounts every time some
spammer starts using the address?
No. I did that only once 4+ years ago, when the situation was
particularly damaging and risky. Even now, 2 of my e-mail addresses get
some spam (in the strict sense of the word, that is, referring to
advertising), and I simply set the Thunderbird filters to screen them
out. Another e-mail address (used for job hunting) gets occasional
messages that I strongly suspect are malicious (not spam, i.e.
advertising). These have all been easy to recognize as probably
malicious (the sender address is international), so I just delete them.
(I wonder which of the companies I applied to was hacked.)
... The From and To on my screen show my full name and email
address,
scary!
That's an obvious case of something bad. But that's not the scary part.
A few years ago, I got phone calls in which the caller-id showed the
caller was me. I did not answer. But what scares me is that, if they
can call me using my number, then they can call other numbers using my
number, and can get me into very serious trouble. The same possibility
with e-mail addresses presumably also exists. Those phone calls were
the only time I reported spoofing to law enforcement (the FCC).
If I have a shop ask me for an email ....
I seriously fight that, too.
Some mail servers let you tag +word to your username, and
they'll deliver it to your normal address.
Interesting idea. I just tried it. Unfortunately, yahoo apparently
does not support it:
"554: delivery error: dd This user doesn't have a yahoo.com account"
Good tips from everyone. I'll try to keep them in mind next time.
Thank-you!
Bill.
1:43 a.m.
New subject: quick (I hope) e-mail security question. [SOLVED]
Bill:
That's an obvious case of something bad. But that's not the
scary
part. A few years ago, I got phone calls in which the caller-id
showed the caller was me. I did not answer.
I once answered the phone to hear a recording of myself saying hello
and saying my name. Then it hung up. I never figured out what that
was all about. Maybe I'm going to discover a time machine in the
future, and prank myself? ;-)
But what scares me is that, if they can call me using my number,
then
they can call other numbers using my number, and can get me into very
serious trouble. The same possibility with e-mail addresses
presumably also exists.
Now that such things can be so easily spoofed, I think any legal
proceedings needs to use more than just an end-recipient's caller ID
log. I'm also concerned that unfaithful logs might be accepted as
evidence with more weight than someone's verbal accounts. I've read
stories where they've used a google maps GPS log from someone's phone
to place someone at a scene, but I've seen how wildly inaccurate mine
is. e.g. I've spent an hour at a concert in a park, barely moving more
than 50 metres from one spot, yet the logs shows that I've gone on a
kilometre trek in a direction I'd not been in (not even in travelling
to and from the park).
With the fake caller IDs, the huge number of nuisance calls (in my case
it could be ten times more nuisance calls than real calls, in some
months), I can see the phone system being more and more rejected by
customers. I'm dubious about answering anonymous calls, or unknown
numbers.
Tim:
> Some mail servers let you tag +word to your username, and
> they'll deliver it to your normal address.
Interesting idea. I just tried it. Unfortunately, yahoo apparently
does not support it:
"554: delivery error: dd This user doesn't have a yahoo.com account"
It's going to depend on what services you use, perhaps even what region
(like Yahoo offers POP3 to some countries, but not to others). Here,
yahoo does let you set up separate alias addresses, but you have to do
that ahead of time.
If you do find one that offers the kind of thing that I described (some
services call it "plus addressing," but it may use some other symbol
than the plus sign, I've seen ones use a dot, or an equals sign), it
can be a useful feature. Fastmail and Gmail allegedly support it, and
gmail is said to ignore dots in your username. So if your username was
johndoe@gmail, you could splatter some dots in different places to
track leaks of your address in a similar way (e.g. johndoe(a)gmail.com
versus john.doe(a)gmail.com versus jo.hndo.e(a)gmail.com), or use them to
simply make combined names more readable.
At times you'll find some service that doesn't accept plus addressing,
claiming it's for some kind of (crap) security reason. And the chances
are that they're a service that already had serious (unrelated)
security and privacy problems. :-\ The world is run by morons...
As well as for tracking purposes, it's an easy to way to do mail
filtering, for those people who can't figure out how to set up email
header-based filtering rules.
--
uname -rsvp
Linux 3.10.0-957.21.3.el7.x86_64 #1 SMP Tue Jun 18 16:35:19 UTC 2019 x86_64
Boilerplate: All unexpected mail to my mailbox is automatically deleted.
I will only get to see the messages that are posted to the mailing list.
1746
days inactive
1750
days old
14 comments
8 participants
participants (8)
-
Doug McGarrett -
Ed Greshko -
George N. White III -
home user -
jdow -
Samuel Sieb -
Tim -
Tony Nelson