E-Mail Forgery

Definition

E-mail forgery is the alteration of the headers of an e-mail to circumvent spam filtering, gain the trust of the recipient, or commit a crime such as identity theft. This is an easy thing to accomplish, it is very effective, and for webmasters there is almost no defense against this.

Symptoms - End User

Because of the way e-mail is displayed in most e-mail applications, it is virtually impossible to determine if an e-mail is legitimate, or if the headers have been forged. There are a few mechanisms that can be used to verify the identity of the sender, but these methods are out of the reach of the general public. Most of this technology has to be implemented by the Internet Service Provider.

Symptoms - Company

If your e-mails address is being forged, usually the only indication is "bounce messages". These are server messages that are sent in response to a bad e-mail address. For example, you may get a message saying that an e-mail address is invalid, but you have never sent an e-mail to that address.

How to Forge E-Mail Headers

There are a few different ways someone might forge the e-mail headers. The easiest, and frighteningly, a very effective method, is to simply change the reply-to address in your E-mail client before sending the message. Note that it is easy for an investigator to track these e-mails back to the sender.
The second method is to find an e-mail server on the web, establish a telnet connection to the mail server using forged credentials, and send the e-mail. This hides your actual e-mail address and makes it harder to determine your IP address. This is one of the more common methods, as spammers will use this technique to bypass spam filters.
The third method is to compromise a web site that sends e-mail, such that you can feed the web site a list of e-mail addresses, and let the server do the work. This very effectively hides your identity, and the messages from the compromised server will contain the headers associated with the company whose site was attacked. Because these e-mails are coming from the company web server, any authentication method that the recipient uses will allow the messages to pass through.

Defense

The first thing to do is ensure your server is as secure as possible. Make sure you are using strong input validation on all scripts on your web site, and make sure your e-mail server does not allow anonymous users to send e-mail. Also, make sure you log all access to scripts on your site that send e-mail, and log all traffic to your mail server so if a compromise does occur, you can track down the offender.

Secure Redirects

Recently, SANS (a security certification organization) posted an article related to the exploit of the redirect system on Google. The exploit was used to hide URLs in spam e-mails. The article had a lot of detail on the attack, but didn't give much information about how to defend against this type of attack. Since redirect scripts are fairly common as they allow webmasters to track traffic on outbound links, I wanted to post some defensive information.

The Problem

You have paid advertising, or other types of outbound links on your web site, and to track the outgoing traffic you have installed a redirect page. The redirect page invisibly redirects users to the final destination after logging information about the redirect.

The Exploit

To exploit a redirect, you simply need to have a URL that you need to get past a filter, and a redirect that meets the requirements of the filter. For example, lets say you want to post a link to your web site in a forum that does not allow links to outside web sites. The forum does, however, allow internal links, such as those to other posts on the forum.
The first step is to find a redirector on the domain. So if you are posting on blog.com, you would browse through blog.com, looking at the various outgoing links until you find one that goes to a url like blog.com/redirect.php?url=www.somesite.com. This is the redirector. To exploit the redirect, you would replace the ad URL with your own URL - ie blog.com/redirect.php?url=myurl.com.

The Defense

There are a few defenses, but most of them have drawbacks. For example, you could set up the redirect script to only allow the redirect if the user came from another page on the current site. Unfortunately, many anti-spyware programs hide the referring page and would cause legitimate traffic from following the link.
Another option would be to use cookies. However, the same software may disable tracking cookies.
Possibly the most effective method would be to use a code based on the user's IP address. If you are using your redirects to track ads, and the ad code is dynamically generated you could add an extra parameter that contains the sum of the four segments of the user's IP address as a check. If the check is not there, or if it fails, the user would be taken to an error message instead of being redirected. An attacker creating a static link would be unable to create a working exploit because the URL changes for every visitor.