System Forensics, Investigation, and Response, 3rd Edition

Email Protocols

The Simple Mail Transfer Protocol (SMTP) is a protocol used to send email. SMTP typically operates on port 25. For many years, Post Office Protocol version 3 (POP3) was the only means for retrieving email. POP3 operates on port 110. However, in recent years, POP3 has begun to be replaced by the Internet Message Access Protocol (IMAP), which operates on port 143. The main advantage of IMAP over POP3 is it allows the client to download only the email headers to the machine, so that the user can choose which messages are to be downloaded completely. This is particularly useful for smartphones and any wireless devices where bandwidth may be at a premium.

Each of these email protocols also has a secure version that is encrypted with the Transport Layer Security (TLS) Protocol. For SMTP, the secure alternative is SMTPS on port 465; for POP3, the secure version functions on port 995; and for IMAP, the secure version operates on port 993.

Faking Email

Criminals may fake their email messages. Some of them use email programs that strip the message header from the message before delivering it to the recipient. Or, they may bury the message header within the email program. In other cases, the “From:” line in a message header is fake.

In addition to manipulating the email header, perpetrators may simply set up a temporary, bogus email account. For example, free email accounts, as offered by Yahoo!, Gmail, and Hotmail, are easy to set up, and you can use any desired and available name.

Spoofing

Spoofing involves making an email message appear to come from someone or someplace other than the real sender or location. The email sender uses a software tool that is readily available on the Internet to cut out his or her IP address and replace it with someone else’s IP address. However, the first machine to receive the spoofed message records the machine’s real IP address. Thus, the header contains both the faked IP and the real IP address—unless, of course, the perpetrator is clever enough to have also spoofed his or her actual IP address.

Anonymous Remailing

Anonymous remailing is another attempt to throw tracing or tracking attempts off the trail. A suspect who uses anonymous remailing sends an email message to an anonymizer.

An anonymizer is an email server that strips identifying information from an email message before forwarding it with the anonymous mailing computer’s IP address.

FYI

The issue of spoofing emails, IP addresses, and similar identifying information brings up the question of the sophistication of computer criminals. Email spoofing is just like any other crime. There are a few very sophisticated criminals—and a host of unsophisticated criminals. The more sophisticated a criminal, the harder it is to find evidence. For example, if you wanted to send an email that you did not want traced to you, you could start by finding a free public Wi-Fi in an area at least one hour from your home. That way even if the IP address is traced, it will be traced to an address not connected to you.. Then you could spoof both your IP address and MAC address. Finally, you could send the email through an anonymous email account set up for that purpose. It is, however, very common for criminals to actually send emails from their own computers without even bothering to spoof their IP address or MAC address.

To find out who sent remailed email, try to look at any logs maintained by remailer or anonymizer companies. However, these services frequently do not maintain logs. In addition, you can closely analyze the message for embedded information that might give clues to the user or system that sent the message.

There are many websites that let someone send an email and choose any “from” address he or she wants. Here are just a few:

Valid Emails

It is also very common for an email to arrive, often from a trusted friend, colleague, or family member, that is valid in every respect except for the content of the message. The email passes all of the normal validity checks, such as header structure and content, and even comes from a known nonspam email server that is not blacklisted with any of the blacklist services such as SPAM Cop. However, the message is suspect and the website uniform resource locator (URL) pointed to is usually a hacker or phishing site. The message may read something like “Wow! Check out this great website: www.hackersite.com.” These messages usually contain no hidden URLs, pictures, or attachments and are very short. However, clicking the URL can unleash all sorts of malicious software or other negative results. The cause of valid, but clearly suspect, emails is likely that the trusted friend’s computer is infected with malware.

Table of Contents for System Forensics, Investigation, and Response, 3rd Edition

Table of Contents for
System Forensics, Investigation, and Response, 3rd Edition