Email Spoofing

It is something I have not done before. It came into my mind, and I decided to try it, while mourning at the death of my grand computer.

The poor victim happened to be my University's departmental mail server and a automated-registration roster that I attempted upon.

The automated script is simple, you are going to send an email with the subject title "Registration" without quotes plus some lines of text ( which is unnecessary, which I found out ), and your email will be appended to the roster.

Of course, it is very easy to use my own email to do it. It will be merely several clicks.

First to state, I am having VPN access. I have no computers at this moment to do any non-VPN access though.

I attempted at first by using a program to do it, but turned out to be more than necessary ( but it is quite interesting, anyway there was some problems and it failed sadly, but I will check it out later ). Then, I resolved to raw protocol talk and succeeded.

I also built my own mail-server ( qmail ) to test. The results are more or less the same, with some differences.

RFC 821 is a good start.

Thoughts :

1. The mail server did not check very much on the details ( was it because of VPN it assumed it is already authenticated? Possibly they put it into a list of authenticated hosts. ) ( it is the one used in horde , the link is here. ). I have not checked deeply into whether it is the mail server configuration or so.

2. There is a field that I did not go into deeply trying to spoof, but I will go into testing the difficulty to spoof it well.

3. It definitely is a perfect look from the outside but there is a single field ( above ) that leaves traces for a perfect lockdown, no good. ( As verified in ethereal easily ) Got to know how to fix that.

4. How could you spam "well" into a mail server? Again, I have not yet checked how the mail server automates spam finding.

5. How can this be extended to general spamming and how is industrial spamming done? As mine is extremely naive. ( Yes! Definitely! )