Section 3.3. Forging Your Own Headers

3.3. Forging Your Own Headers

There are good reasons why you might want to forge the headers of your own messages. I have several scripts that run as root and send out notification emails whenever certain events take place. I don't want people replying to root, so I forge the From address to either my address or that of the recipient. This is a useful technique that illustrates just how easy it is to generate spam.

You can try this for yourself using sendmail on a Unix system. Regular mail clients like Outlook and Thunderbird are not set up to do this. Start by writing a simple message to yourself in a file using an editor. Put your address in the To line and set the From line to whatever you like. In this example, I am going to impersonate someone at O'Reilly. Add a Reply-To header and even make up your own Message-Id. For example:

     To: [e-mail]     From: [e-mail]     Reply-To: [e-mail]     Message-Id: <[e-mail]>     Subject: Test     Hello World

Tell sendmail to read those headers from the file rather than the command line by giving it the -t flag.

     % /usr/lib/sendmail -t < test_message 

The message as received should look similar to this:

     Return-Path: <[e-mail]>     Received: from biotech.craic.com (biotech.craic.com [208.12.16.3])             by gateway.craic.com (8.11.6/8.11.6)             with ESMTP id j21NSQ721278             for <[e-mail]>; Tue, 1 Mar 2005 15:28:26 -0800     Date: Tue, 1 Mar 2005 15:28:21 -0800     Reply-To: [e-mail]     Message-Id: <[e-mail]>     To: [e-mail]     From: [e-mail]     Subject: Test     Hello World

While this looks totally convincing when viewed in a mail client, the headers still show the correct Return-Path and hostname for the sender. You can fix the first of these problems by specifying the From address as a command-line option, thus:

     % /usr/lib/sendmail -t [e-mail] < test_message 

To change the hostname, you need to edit the line in the /etc/hosts file that contains the sender's IP address. The fake hostname should precede the real one, like this:

     208.12.16.3   bogus.oreilly.com   biotech.craic.com 

With both of these in place, the headers of the received message are close to what you want:

     Return-Path: <[e-mail]>     Received: from bogus.oreilly.com (biotech.craic.com [208.12.16.3])             by gateway.craic.com (8.11.6/8.11.6)             with ESMTP id j21Mui721208             for <[e-mail]>; Tue, 1 Mar 2005 14:56:44 -0800     Date: Tue, 1 Mar 2005 14:56:44 -0800     Reply-To: [e-mail]     Message-Id: <[e-mail]>     To: [e-mail]     From: [e-mail]     Subject: Test

All I would need to do to make this a near perfect forgery is remove the reverse DNS table entry for biotech. It's that easy.