Hacker News Reader

Comment by DenisM | Hacker News Reader

At Microsoft, when an email has an internal sender address it will not get delivered unless that email did in fact come from an internal Exchange server.

In 1998 I was able to use SMTP to send an email "from Bill Gates" (only sent it to myself for my own personal amusement), but the trick stopped working later.

View on HN

That doesn't seem like it would guard against an e-mail sent from "a very similar email domain" like ndespres described.

Yes, but I could always double-click on the mail address in Outlook and see the internal address book entry if the email is spelt correctly.

When verification is easy, people do more of it.

Which brings it back to being a process issue: if folks are diligent about verifying (whether that's a phone call or clicking on a name), then this is harder to pull off.

There are a lot sent along with an email besides the To/From names. The name is pretty easy to spoof, but the SMTP request and timestamps is much harder. Also most reputable senders now use SPF, a type of DNS record, to verify email servers. But email usually trusts by default, unless your servers are very locked down. You can still send 'unverified' email, but its easier to trip spam filters if you send too much.

I ran into something like that when demonstrating our report delivery at a company. I remember saying "Now notice I change the header to say it comes from [person in room] which of course the e-mail server will reject... oh, my... well, I guess it doesn't...". I was 'encouraged' to have a talk with the e-mail team.

In 1993, I had a summer internship at Apple. After I returned to the university that fall, I sent a fake email from Andy Grove (the CEO of Intel at the time) to my new friend at Apple.

I did this just by opening a telnet session to the SMTP port at apple.com and manually typing in SMTP commands and associated text.

Apple's SMTP server happily delivered a fake email from agrove@intel.com from a system at ucdavis.edu.

Lol, those were the days....

DMARC makes this pretty trivial these days. A mail shouldn't be accepted by _any_ system unless it is authentic.

Reply on news.ycombinator.com