[Discuss] e-mails with a "from" address that is of some concern

[Alan W. Irwin]

On 2014-04-19 16:34-0700 Alan W. Irwin wrote:

> On 2014-04-19 17:50-0500 mskala at ansuz.sooke.bc.ca wrote:
>
>> On Sat, 19 Apr 2014, Alan W. Irwin wrote:
>>> We have recently started seeing spam that purports to be sent from our
>>> own computer, e.g., <somename>@<FQDN> where FQDN is the fully
>>> qualified (and quite unique) local name I happen to give my computer in
>>> /etc/hosts.
>> 
>> Is it possible that the mail is coming in with no FQDN - for instance, as
>> <somename> with no @ part, or <somename>@<ip address> - and then your
>> mailer is assuming that that is local and filling in the FQDN?
>> 
>>> As far as I know, I have never leaked that fully qualified name out in
>>> e-mail or anywhere else.
>> 
>> Does the box that has this name ever send mail?  If so, the name could
>> have leaked out via a Received: header.  Does it ever receive mail?  If
>> so, the name may have appeared in the receiving mailer's HELO or EHLO
>> identification.
>
> I keep a copy of all e-mail sent.  The name was not leaked via a
> Received: header, but I just now discovered a few cases of e-mail over
> the years that leaked the name with a References: header (from
> the Debian reportbug application).  But there are certainly no such
> recent leaks.
>
>> In any case, is this actually a problem?
>
> Probably not, but if I can find no credible explanation, then one
> nasty possibility left is the spammers somehow have access to my
> /etc/hosts file (i.e., they own the box).

I have investigated further, and it turns out what I stated above is
not completely correct. My mailer software is alpine which is
configured to collect a copy of all my outgoing e-mail in a particular
file.  If I look at that file with alpine (with full headers enabled)
it does not see many instances of the name of my box as I reported
above, but if I look at that file with "less" there are lots of such
instances of leaked information about my box name in slightly wrong
header syntax ("from" without the trailing colon). So I assume that
wrong syntax is why alpine does not see that box name information.  If
I send a test message to myself, that "from" (as opposed to "from:")
information is stripped somewhere (verified by using less on my INBOX
file), but it is plausible that stripping occurs late in the e-mail
path so that it is accessible to spammers to use where e-mail is
stored earlier in the path.

So I think I now have a plausible explanation about how spammers got
hold of my specific and unique internal name of my box. In any case I
have now reconfigured alpine so the box name published via "from"
(without the colon) is simply localhost.localdomain.

Alan
__________________________
Alan W. Irwin

Astronomical research affiliation with Department of Physics and Astronomy,
University of Victoria (astrowww.phys.uvic.ca).

Programming affiliations with the FreeEOS equation-of-state
implementation for stellar interiors (freeeos.sf.net); the Time
Ephemerides project (timeephem.sf.net); PLplot scientific plotting
software package (plplot.sf.net); the libLASi project
(unifont.org/lasi); the Loads of Linux Links project (loll.sf.net);
and the Linux Brochure Project (lbproject.sf.net).
__________________________

Linux-powered Science
__________________________