How can header information track down an email spoofer?
Spammers can use spoofed headers to hide the true origin of unwanted email. In this SearchSecurity.com Q&A, application security expert Michael Cobb explains how to trust where a message is coming from.
"Anyone can 'fake' the email address of a sender, but the encrypted headers contained in every email are tagged to the sender's PC. Also, your Internet service provider (ISP) is obliged to keep logs of all emails sent by their users."
Is it correct that the ISP will keep a full record of the emails, including content, and not just the tag to the PC? Presumably, it is possible for the recipient to leave the headers intact and change the information within the email?
Even if your colleague can show that the email originated from you, it may have still been sent by a malicious program that has infected your PC. Run a full virus scan on your machine to rule out this possibility. As things stand, an ISP doesn't have to save all of your email unless it is presented with a legitimate law enforcement request. There doesn't really seem to be a standard practice of what ISPs do and do not keep, so you'll need to check with your ISP for its current policy and practices.
The easiest way to trust an email's origin data is to use digital signatures, such as Pretty Good Privacy (PGP). This provides a way of ensuring that messages are from whom they appear to be from, verifying also that the message has not been altered in transit. When a message is digitally signed and sent, a unique mathematical value is calculated using a hashing or message authentication algorithm. This value is then encrypted with your private key, creating a digital signature for that specific message. This encrypted value is attached to the end of the message along with your digital certificate, which also contains your public key.
When the recipient's email program receives a signed message, it calculates its own hash of the message and then uses your public key to decrypt the sent email's hash value; the two values are then compared. If the two values match, you can be sure that the message has not been altered and was signed by you.
If the person you are sending an email to also has a digital certificate, you can sign and encrypt the email to ensure that it cannot be altered or read by anyone other than the intended recipient. Also, as a matter of good practice, I would always write an email as if it were a postcard, adding a salutation, date and time in the body of your messages. This ensures that the context of the message is clear.
Dig Deeper on Threats and vulnerabilities
Related Q&A from Michael Cobb
Symmetric vs. asymmetric encryption: What's the difference?
Explore the differences between symmetric vs. asymmetric encryption, including how they work and common algorithms, as well as their pros and cons. Continue Reading
What is shellcode and how is it used?
Shellcode is a set of instructions that executes a command in software to take control of or exploit a compromised machine. Read up on the malware ... Continue Reading
Is bitcoin safe? How to secure your bitcoin wallet
As bitcoin use increases, so too have the number of cyber attacks on cryptocurrency exchanges and wallets. Learn how to keep bitcoin use secure. Continue Reading