Tracking anonymous emails

Have you ever read an email? I bet you were about to say "yes!", but I assure you that you most likely have not.

What you've read is just what the sender wanted you to see. Emails are not delivered to your computer screen by some magical force, the process invloves various transformations that are applied to the email while it is en route. The real thing looks different, and it contains various details that indicate how the message travelled across the globe before it reached you.

I will reveal some of the details about how it works, and explain how this can be used to track anonymous messages. While the story itself is in plain English, there are some technical quirks that I'll include for the geeks in the audience; feel free to skip those and look at the pictures instead.

Email is based on several communication protocols, such as POP3 (to retrieve messages) and SMTP (to send them). These protocols are quite straightforward, once you familiarize with them you learn that:

• an email traverses multiple nodes on a network before it reaches you
• various headers are added to it at each step of the way
• the server trusts whatever the sender says

The last bit is particularly interesting - when I connect to an SMTP server to send a message, I have to specify the recipient, the subject of the email, as well as say who I am. I can write whatever I want in the "from" field. Even though my name is Alex, nothing prevents me from saying that I am Jane, and that my address is svetlanushka1984@example.com, instead of alex@example.net.

Who would design such a protocol? Doesn't it open a lot of possibilities for abuse?

Those are reasonable questions. Life was simple back in the old days, protocols were not designed with security in mind. The ancient Geeks were doing things simply because they could, and it was good™™... until evil and greedy people began to exploit this and ruined the experience for all of us. But I digress.

Today, a properly configured SMTP server will not accept messages from a random person in the street, so spoofing identities (i.e. sending something as if it came from someone else) is not as trivial as it used to be.

One day I received such an email, it happened during the exam period at the university, this is what it looked like:

The context is that a number of students copied someone else's work, which I recognized due to a paragraph in the text. I wanted to find the original author, and that's when the anonymous messages began pouring in. The mailing list provides a historical record.

What did I do next? Having read the specifications of the POP3 protocol, I knew that there's more in that email than the untrained eye can see. So I took a look at its headers - those extra bits prepended to the message whenever it goes from one node to another.

Here's how to do that, it is very simple, so fire up telnet right away and connect to the POP3 server of your email provider. The example below illustrates how that works when there's no encryption involved.

You can see that it is quite straightforward. The commands are easy to understand and you can read your email this way. The nice side effect is that when girls ask you about your favourite email client, you can say "telnet", and they'll be impressed by your 1337 skills!

Here's a real example of such a session:

+OK
USER omniflez@mail.ru
+OK
PASS plut01snotapLanet
+OK Welcome!
LIST
+OK 5 messages (242688 octets)
1 8090
2 28626
3 142800
4 30885
5 31683
.
RETR 1
+OK 8090 octets
Return-path: <direct.mruxezldoqwtsmrxgeydsojvg4wtknrxguwtmmzs-omniflez=mail.ru@returns.bulk.yahoo.com>
Received: from [69.147.64.204] (port=29199 helo=n7.bullet.sp1.yahoo.com)
by mx36.mail.ru with esmtp
id 1I6JRr-0009jw-00
for omniflez@mail.ru; Thu, 05 Jul 2007 09:00:11 +0400
Received-SPF: none (mx36.mail.ru: 69.147.64.204 is neither permitted nor denied by domain of returns.bulk.yaho
o.com) client-ip=69.147.64.204; envelope-from=direct.mruxezldoqwtsmrxgeydsojvg4wtknrxguwtmmzs-omniflez=mail.ru
@returns.bulk.yahoo.com; helo=n7.bullet.sp1.yahoo.com;
Message-Id: <1183611611.2428347954@mx36.mail.ru>
Received: from [216.252.122.218] by n7.bullet.sp1.yahoo.com with NNFMP; 05 Jul 2007 05:01:17 -0000
Received: from [69.147.66.55] by t3.bullet.sp1.yahoo.com with NNFMP; 05 Jul 2007 05:01:17 -0000
Date: 04 Jul 2007 22:35:57 -0700
Received: from [127.0.0.1] by dmserver2.ycrm.sp1.yahoo.com with NNFMP; 05 Jul 2007 05:35:57 -0000
From: "Yahoo! Photos" <directmail@yahoo-inc.com>
To: omniflez@mail.ru
Subject: Yahoo! Photos is closing -- Action Required
Errors-To: yahoo_delivers_11393112@reply.yahoo.com
Reply-To: mktg-comm@yahoo-inc.com
Mime-Version: 1.0
X-yahoo-newman-property: direct
X-RocketSRV: sbc=9ccfff;siu=http://us.i1.yimg.com/us.yimg.com/a/di/direct/y_16.gif;siw=16;sih=16;allow=all;liv
ewords=false
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0

 

Dear Yahoo! Photos user,

For some time now, we've
[blablabla, a lot of text here]

.
QUIT
+OK POP3 server at mail.ru signing off

You should have noticed at least two things:

• the password is sent to the server in plain text
• when I retrieve the message, the server sends me some mumbo-jumbo
  • followed by some empty lines, which mark the beginning of the actual message (it is called a body - that's what normal people see)
  • the end of the message is marked with a single dot in the line. "What if my body contains a line with a single dot in it?" - this is left as an exercise to the reader

The other thing you need to know is that the message contains the IP address of the original sender.

I then used a WHOIS server to find out more details about this address. Just go to your favourite search engine and type "whois railean.net" or "whois 127.0.0.1" (replace the localhost address with the IP you're interested in). You can learn things such as:

• which country the IP address is located in
• which Internet provider it belongs to
• which person to contact if you notice any abuse from this address

Here's an actual example (I somewhat changed the email addresses to protect the innocent) of a query related to an IP address from Sri Lanka:

inetnum: 220.247.239.0 - 220.247.239.255
netname: SLTADSL-SLT-LK
country: LK
descr: ADSL SECTION-IP &BB
descr: ADSL - SRI LANKA TELECOM
descr: COLOMBO
admin-c: AE70-AP
tech-c: AE70-AP
status: ASSIGNED NON-PORTABLE
changed: hostmaster@slt.lkkk 20050202
mnt-by: MNT-SLT-LK
source: APNIC

person: Asela Eranda
nic-hdl: AE70-AP
e-mail: aselaeranda@slt.com.lkkk
address: Internet Division
address: 7th floor
address: OTS Building
address: Sri Lanka Telecom
address: Lotus Road
address: Colombo-1
phone: +94-11-2021913
fax-no: +94-11-2322622
country: LK
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-
remarks: Please send all IP abuse complaints to abuse@slt.lkkk
remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-
changed: aselaeranda@slt.com.lkkk 20090331
mnt-by: MAINT-LK-ASE
changed: hm-changed@apnic.netkk 20090507
source: APNIC

That's how I figured out this was someone from Moldova, the same city as the one I live in, and that the company responsible for the IP address is Moldtelecom.

However, that doesn't answer the question "who the hell is this person?", does it? I needed to harvest more information, thus I applied some social engineering.

I responded to the students' mailing list in a way that encouraged the sender to write more messages of this kind. After collecting some additional samples, I saw that they all originate from the same address. This part was important, because otherwise I would be forced to extrapolate from a single data-point, and that's not a good thing.

To map the IP address to a person, I relied on my uber-archive; it contains almost every message I ever sent or received since I had an email account. Being able to search the entire message (that is - the header and the body, not just the body) is the key ingredient.

After a few moments, the search results were displayed.

There were several emails that came from that IP address: the anonymous ones, and two other people, who consistently used the same IP since the beginning of the semester. Most of the messages (and all of the recent ones) came from one person.

That person was the mysterious sender. It's easy when you know it, right? Yes, but not quite so. This was easy because the sender didn't take the basic measures to conceal their location.

References:

• I'm behind 7 proxies
• Consequences will never be the same

Comments