LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 11-06-2023, 07:03 AM   #1
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,291

Rep: Reputation: 52
can an email date be forged?


I have a very small number of received emails from the same sender that I am sure were not there a few days ago but dated prior to these few days.

Is this entirely my fault (my imagination) or is it possible for a sender to date an email and send it, for example, a week later?
Or is it possible that my paid email service failed to send those emails for a number of days?
Or is there any possible trick capable of giving that result?

There is nothing wrong with my email account I have with this email service, other emails sent or received do and did work as expected.

Thank you for your help.
 
Old 11-06-2023, 07:16 AM   #2
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 7,347
Blog Entries: 3

Rep: Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766Reputation: 3766
Yes to all of the above. It is possible to set a different date on the mail than it was actually sent.

However, there is a perennial problem with m$ products in regards to mail. Stuff that people try to send via or from Outlook / Exchange can get lost -- often -- but even if it does not get lost it can get delayed by days. Either incident is quite common.
 
1 members found this post helpful.
Old 11-06-2023, 08:46 AM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,683
Blog Entries: 4

Rep: Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947
Anything(!) about an "SMTP/POP e-mail" can be faked, because there is no "default" content-verification. (Unlike this, for example, "https: website!)

There are various "public standards," such as PGP®/GPG and S/MIME, as well as various commercial vendors. All of these provide "cryptographic wrappers" which properly secure and verify your transmissions, as well as the identity of the people you are talking to. Amazingly enough(!), these have never become "standard" for e-mail ... although GMail briefly offered it but then withdrew it. (Hmmmm....)

"MS-Exchange®" is an entirely-different and entirely-proprietary venue for exchanging "e-mail."

Last edited by sundialsvcs; 11-06-2023 at 08:51 AM.
 
1 members found this post helpful.
Old 11-06-2023, 09:48 AM   #4
NevemTeve
Senior Member
 
Registered: Oct 2011
Location: Budapest
Distribution: Debian/GNU/Linux, AIX
Posts: 4,880
Blog Entries: 1

Rep: Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871Reputation: 1871
Nonetheless the various "Received" headers should be examined (it is View+Source or View+Headers in any conventional mail-client (this doesn't include web-mail or Outlook)).
 
1 members found this post helpful.
Old 11-06-2023, 02:56 PM   #5
scasey
LQ Veteran
 
Registered: Feb 2013
Location: Tucson, AZ, USA
Distribution: CentOS 7.9.2009
Posts: 5,742

Rep: Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222Reputation: 2222
Yes. I suppose the Received: headers could be modified, but not by the originator of the message.
And there’s no reason for a mail server to mess with the Received: headers it adds to the message.

They will show the progress of the message from the originating server to the final server. Watch out for different time zones when checking times on them.
 
1 members found this post helpful.
Old 11-07-2023, 05:00 AM   #6
rblampain
Senior Member
 
Registered: Aug 2004
Location: Western Australia
Distribution: Debian 11
Posts: 1,291

Original Poster
Rep: Reputation: 52
Thank you for the answers.

Last edited by rblampain; 11-07-2023 at 05:09 AM.
 
Old 11-17-2023, 09:14 PM   #7
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,683
Blog Entries: 4

Rep: Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947
It all comes down to "a matter of trust." In other words, how suspicious are you – and, how suspicious should you be?

For example: in the case of "standard SMTP/POP email," the transfer of the message relies upon a network of so-called "mail transfer agents (MTAs)." Each of which handles your message (in plaintext form), and is supposed to do the right thing. This implies that you trust that each of the MTAs which handled your message "did the right thing." (And that none of them "singled out" your message.) Bear in mind also that every component in the MTA network implicitly "trusts" every other one, to the extent that they forward mail-headers to the next party "as tendered."

Other e-mail transfer protocols do exist, including proprietary ones such as Microsoft Exchange.® Which have an entirely different architecture and use cryptography.

Nonetheless: "if you send a sensitive message using any email," regardless of how it is sent, you(!) should secure its content via suitable cryptography, and you should not trust any "contextual information" such as headers. Nor the behavior or presumed-behavior of any "agent" which handled the message in transit. The only information which you should have any reason to "trust" is what is contained in the encrypted payload.
 
Old 11-17-2023, 09:23 PM   #8
wpeckham
LQ Guru
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, VSIDO, tinycore, Q4OS, Manjaro
Posts: 5,757

Rep: Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761
The original email standard definition did not require encryption, verification, or correctness of fields not required for routing. IT also allowed ONLY plain text payloads. The current standard is not far different, but everyone and their brother ignores the standard anyway. It is a testament to the rapid and widespread adoption of that standard that email as we know it is so pervasive. IT is really a testament to our complacency and stupidity that we have not adopted a more robust and secure standard or service for communication that requires proper and accurate data definitions and time-stamps (and encryption).
 
Old 11-18-2023, 03:34 PM   #9
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,683
Blog Entries: 4

Rep: Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947Reputation: 3947
It continues to baffle me that I can use "southwest.com" and be certain that I am talking to the airline. But I cannot receive an email "from Southwest Airlines" and be certain that the message really is coming from them.

Briefly, Google's "gmail" service did support email encryption and message signing according to standards. But then, they took it out.

It should be "an entirely routine thing, by now," that every email message would routinely be "digitally signed." Both the S/MIME and the PGP®/GPG standards easily support this, and another standard could easily be invented. Any business's email messages are just as important as their web site.

Last edited by sundialsvcs; 11-18-2023 at 03:36 PM.
 
Old 11-18-2023, 07:11 PM   #10
wpeckham
LQ Guru
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, VSIDO, tinycore, Q4OS, Manjaro
Posts: 5,757

Rep: Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761
Quote:
Originally Posted by sundialsvcs View Post
It continues to baffle me that I can use "southwest.com" and be certain that I am talking to the airline. But I cannot receive an email "from Southwest Airlines" and be certain that the message really is coming from them.

Briefly, Google's "gmail" service did support email encryption and message signing according to standards. But then, they took it out.

It should be "an entirely routine thing, by now," that every email message would routinely be "digitally signed." Both the S/MIME and the PGP®/GPG standards easily support this, and another standard could easily be invented. Any business's email messages are just as important as their web site.
For some tings I use tutanota.com (or now tuta.com if you go with a subscription plan) for that security. Alas, it really only works securely between totanota/tuta mail users. But between two tuta users all traffic is encrypted by default.

Last edited by wpeckham; 11-18-2023 at 07:24 PM.
 
Old 11-19-2023, 11:41 AM   #11
dugan
LQ Guru
 
Registered: Nov 2003
Location: Canada
Distribution: distro hopper
Posts: 11,249

Rep: Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323
To put it succinctly: the short answer is yes. But emails also have headers that are available for you to look at.
 
Old 11-19-2023, 04:07 PM   #12
wpeckham
LQ Guru
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, VSIDO, tinycore, Q4OS, Manjaro
Posts: 5,757

Rep: Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761Reputation: 2761
Quote:
Originally Posted by dugan View Post
To put it succinctly: the short answer is yes. But emails also have headers that are available for you to look at.
HEader in the mail packets can also be smudged, but someone would have to know 1% more and have a 10% greater desire to muck you up. Also, you may have a mail log (depending on how you get your mail and if you run your own processes) that you can use to extract additional data. Including the Date-time stamp on the processing of that mail. That is something terribly you may not be able to get through a web interface to a remote server easily. OR at all!
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
sendmail - can't send to gmail/hotmail... - Relaying denied. IP name possibly forged spids Linux - Server 2 03-30-2009 07:57 PM
Guarding Against Forged Email Bounces kemplej Linux - Networking 5 08-05-2005 09:16 PM
Forged email inaki Linux - Security 6 07-21-2005 06:08 PM
Forged Email address from my domain! vittibaby Linux - Newbie 10 11-30-2003 07:00 PM
Localhost 127.0.0.1 may be forged ?? Mzee Linux - Networking 14 03-20-2003 01:51 PM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 04:33 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration