Instructor: Email header analysis. 2 2
In this lesson we're going to talk about those email headers, 3 3
those things that are essentially hidden from view 4 4
but contain a lot of important information. 5 5
An email internet header 6 6
is a record of the email servers involved 7 7
in transferring an email message 8 8
from the sender to a recipient. 9 9
Let's talk a little bit about how this works 10 10
when you send an email. 11 11
Now, when the email is created, 12 12
you create this on what's called a mail user agent, or MUA. 13 13
This is essentially going to be your email program 14 14
or Gmail, if you're running in the browser. 15 15
We're going to use Gmail as our example here. 16 16
Now this program is going to create your initial header 17 17
and then it forwards that information 18 18
over to a mail delivery agent, known as an MDA. 19 19
This essentially goes from your email client 20 20
to your email server, and this happens over SMTP. 21 21
Now, that mail delivery agent is going to do some checks, 22 22
like ensuring that the sender 23 23
is authorized to send the message from that domain. 24 24
This may be done using digital certificates 25 25
or using a username and password, 26 26
which is much more common. 27 27
Now, once that's done, the MDA is going to check and see 28 28
if that email can be served locally from its server. 29 29
For example, if I'm sending an email 30 30
from myself to my video editor, 31 31
we both use the same email server, diontraining.com, 32 32
and so in that case, 33 33
the MDA would simply take that message 34 34
and put it in their mailbox. 35 35
But if I'm sending something to you at Gmail.com, 36 36
it now has to transfer that to Gmail servers, 37 37
and so the MDA passes it over to an MTA, 38 38
which is a message transfer agent. 39 39
This message transfer agent 40 40
is going to route the message to the recipient 41 41
using DNS to locate the different recipient's 42 42
mail transfer agent to accept that message. 43 43
Once I get it over to Gmail servers, 44 44
or Microsoft servers, 45 45
or whoever it is I'm sending it to, 46 46
the MTA collects that message. 47 47
Now, a lot of times this doesn't go 48 48
straight from my server to the destination, 49 49
but it routes between multiple servers 50 50
going across the internet. 51 51
Every time it goes to a new message transfer agent, 52 52
that message transfer agent 53 53
is going to add information into the email's internet header 54 54
and this way we have a log 55 55
of every single place this message went. 56 56
Once it gets to an MTA, that MTA finally looks and says, 57 57
"Ah, this is on my server, 58 58
I'm going to send this to my person." 59 59
And so it will send it over to the MDA, 60 60
the mail delivery agent for its server. 61 61
Once it does that, 62 62
the mail delivery agent puts it into the mailbox 63 63
and then it sits there and waits 64 64
until you connect using something like POP3 or IMAP 65 65
to access that message from your mailbox 66 66
into your desktop client, the MUA, 67 67
which, again, is our mail user agent. 68 68
And so again, this is a simple example of how mail goes 69 69
from a mail user agent on one end 70 70
through the different mail delivery agents, 71 71
through the mail transfer agents, 72 72
and eventually back through the mail delivery agents 73 73
to the mailbox and over to the mail user agent once more, 74 74
where it's going to get to its destination and be read. 75 75
So now that we've talked about how email goes 76 76
from one place to another, 77 77
let's talk about some of the vulnerabilities 78 78
that could be exploited by attackers. 79 79
First, attackers can exploit the fact 80 80
that there are actually three sender address fields 81 81
inside of an email, and this is something 82 82
that is going to be something that they can exploit. 83 83
The first one is what's known as the Display From address. 84 84
For instance, if you get an email from my support team, 85 85
you're going to get an email that looks like this. 86 86
It's going to say Support <support@diontraining.com>. 87 87
That is the Display From. 88 88
Now, that doesn't actually mean anything. 89 89
We can make that say whatever it is we want it to say 90 90
but that is what's going to be displayed 91 91
and that's part of the three fields that we're going to have 92 92
as part of this internet header. 93 93
This is what's known as the From header 94 94
or the Display From header, and this Display From 95 95
is going to be basically just a pretty friendly name 96 96
with anything we want to put in there. 97 97
Now, what attackers will often do 98 98
is they'll change it to make it look 99 99
like it comes from Support at Dion Training, 100 100
even though if you looked underneath, 101 101
it might actually be something 102 102
like Support@diontraining.com <theft@badguy.com>. 103 103
If I had that 104 104
and you only saw the Support@diontraining part, 105 105
that's all you're going to be seeing, 106 106
because a lot of our mail clients only show 107 107
the friendly part outside of the brackets 108 108
and not what's inside the brackets. 109 109
So you might see support@diontraining in your Gmail client 110 110
and not the theft@badguy.com, for example. 111 111
Now the second thing they can exploit 112 112
is what's called the Envelope From. 113 113
This is another from field. 114 114
Now, the Envelope From 115 115
is going to have various labels 116 116
that are actually hidden from your mail client. 117 117
This is essentially your return address. 118 118
And so if your email is actually rejected 119 119
by the mail transfer agent, 120 120
it's going to go and send it back 121 121
to where the Envelope From is. 122 122
So this field can be anything again. 123 123
In this case we might have something 124 124
like support@badguy.com, 125 125
but you'd never see it 126 126
because it's something that's hidden 127 127
from your display client. 128 128
And then the third thing we have 129 129
is what's called to Receive From/By. 130 130
And this is a list of all the different MTAs 131 131
that have processed this email. 132 132
Every time an MTA, a mail transfer agent, touches this email 133 133
as it's going through these different servers along its way, 134 134
there is a chance that this Received By could be changed. 135 135
Now again, this is a field 136 136
that's not displayed to your client, 137 137
but it is in those internet headers. 138 138
And so if you think you have a message 139 139
that may have been spoofed, 140 140
you can open up your internet headers 141 141
and see all the different Received From/Bys 142 142
and that would tell you exactly 143 143
which servers it's gone through 144 144
as it's passed along the internet. 145 145
Now, as I said, most headers are not displayed 146 146
by your email applications by default 147 147
but, if you see something that looks suspicious, 148 148
you can open up those headers and start doing some analysis, 149 149
which is what we're going to do here on a sample email. 150 150
Now, in the example I'm going to show you here 151 151
we've actually removed some of the fields 152 152
to make it a little easier to read 153 153
and we've pulled out some of the original information 154 154
and we've put in some placeholder information, 155 155
things like spam.foo and things like that 156 156
as opposed to using real IP addresses or real domain names. 157 157
The reason we did this is because, on the exam, 158 158
this is similar to what CompTIA will do for you 159 159
because they don't want to have anybody's real IP addresses 160 160
or domain names shown inside of an exam simulation, 161 161
because those IP addresses change all the time 162 162
and it may not be malicious anymore. 163 163
So let's take a look at this email header. 164 164
This is what it looks like. 165 165
Now, this is a lot of text, 166 166
so I'm going to give you a second to read through it. 167 167
I'm not going to read through it all right this second 168 168
because we're going to go through it step-by-step 169 169
as we go through our analysis. 170 170
Now, one of the first things I'm going to look for 171 171
when I open up an email header is 172 172
where is the authentication results 173 173
and what do they look like? 174 174
So if I skip down to the fourth paragraph here 175 175
you'll see authentication results. 176 176
In here you'll see the Header From, 177 177
in this case it's spam.foo, 178 178
and this came from smtp.mailfrom identified as spam.foo. 179 179
So this was the spam server 180 180
or the phishing server that sent that information. 181 181
This is a clue that this is bad. 182 182
Now, in the real world, it wouldn't be spam.foo, 183 183
it might be a real domain name 184 184
but this is the area that you'd be looking at 185 185
to see where did that message actually come from 186 186
and what was the IP address. 187 187
In this case, it's been abbreviated as w.x.y.z, 188 188
because again, we don't want to use a real IP address 189 189
that's actually owned by some real server. 190 190
After that, we are going to read from the bottom up. 191 191
Now as we read from the bottom up 192 192
going from that authentication, 193 193
we are going to see all the servers it's gone through. 194 194
Now the first one we see here 195 195
is it went through openrelay.foo, 196 196
which is our spam server here, 197 197
and again, we have an IP address of w.x.y.z. 198 198
Now as we look at this, 199 199
we're going to be able to see exactly where it came from 200 200
and that openrelay was somebody 201 201
that was sending spam through that server. 202 202
A server that's been taken over and used by a bad guy 203 203
is what's known as an open relay, 204 204
which is why we have that placeholder here. 205 205
Now, this field is showing us the SMTP server 206 206
where the message was actually originated from. 207 207
In this case it came from openrelay.foo. 208 208
Now, if I went and looked at openrelay.foo, 209 209
I might look it up and get some information about it, 210 210
do some open source intelligence and figure out, 211 211
is this a known spam agent? 212 212
And if it is, it may be found on some blacklist, 213 213
and if so, we might want to add it to our blacklist as well, 214 214
so we're not getting that spam inside our systems either. 215 215
Now, the next thing I want to look at 216 216
is how we can do a much cleaner and easier way 217 217
of looking at this information. 218 218
Well, one of the things 219 219
is that this information is a lot of text 220 220
and it's pretty heavy to look through, 221 221
but there are some tools out there that you can use. 222 222
One of them is called testconnectivity.microsoft.com, 223 223
and if you go there, you'll find the tool 224 224
called the Message Header Analysis. 225 225
You can take your message header 226 226
and paste it into the top block, like I've done here, 227 227
hit Analyze headers, and it will actually break it down 228 228
into areas for you to see in a much easier format. 229 229
So for example, here you can see 230 230
the first hop was openrelay.foo, 231 231
and then at the bottom we can see 232 232
that authentication results I showed you before, 233 233
smtp.mailfrom=spam.foo 234 234
and header.from=spam.foo. 235 235
Both of those are the pieces of information we wanted 236 236
as we started looking through the different headers 237 237
and we wanted to see where it came from. 238 238
By using something like this, 239 239
it is a lot quicker and easier 240 240
for you to identify things quickly 241 241
as you're looking through them 242 242
and identify exactly what the delays were in between 243 243
and how long things sat. 244 244
For instance, if a message sat someplace with a long delay 245 245
that could have been time that an attacker was using 246 246
to modify that message, 247 247
and so it'd be something you'd want to look at as well. 248 248
Now let's take a look at the actual message itself 249 249
as we go through some of the rest of the headers here. 250 250
As we continue down the header, 251 251
we'll see some more information, 252 252
for instance, the subject, in this case, 253 253
"Your account is blocked by the administrator". 254 254
That's a pretty alarming subject 255 255
and it might get somebody's attention to open up 256 256
and click that email and click a link inside of it. 257 257
Then we can see the content inside of it. 258 258
We can see different content type, the date, 259 259
the MIME version, the From account, the To account, 260 260
and the Return-Path. 261 261
Let's take a look at that From account 262 262
a little bit more in depth. 263 263
Now look at that, it says: 264 264
Gmail Accounts <spammer@spam.foo>. 265 265
So again, remember that From header 266 266
is just what we want it to display. 267 267
I could type anything I want in there 268 268
and so in this case, we're saying 269 269
this is from Gmail Accounts, even though it's not. 270 270
It's from spammer@spam.foo. 271 271
And then we have the return path. 272 272
This is where the email actually goes back to 273 273
if there's a problem delivering it. 274 274
And in this case you could see it's spammer@spam.foo, 275 275
which is the real email address. 276 276
Now, again, I can change that From account 277 277
to anything I want, 278 278
but the return path has to be the right one, 279 279
otherwise the MTA will not deliver the messages. 280 280
All right, let's look at the next part of the header. 281 281
Here I have what are called the X headers 282 282
and you'll see X-MS-Exchange, 283 283
X-MS-Office, X-Sender, X-SID, 284 284
bunch of different stuff here. 285 285
Now, X headers indicate custom headers 286 286
that are controlled by the SMTP server administrator. 287 287
So you'll notice in my example here, 288 288
we have things like MS Exchange, MS Office 365, 289 289
Microsoft Anti-Spam. 290 290
These are all things controlled by that server 291 291
and, in the example I showed you earlier on the diagram, 292 292
we were sending our information 293 293
to a Microsoft Exchange server 294 294
that was run by the Microsoft Corporation 295 295
and that's who's controlling these headers. 296 296
So if I look at that, 297 297
you might see one here that has X-SID-PRA. 298 298
Now, X-SID-PRA is giving me spammer@spam.foo again. 299 299
Again, this is some information that helps us 300 300
as we are going through and figuring out spam 301 301
and it's something that we can actually use 302 302
as part of our analysis 303 303
by setting up these X headers 304 304
to be able to document different pieces of information. 305 305
This is one that is used by Microsoft 365 306 306
as part of their anti-spam efforts. 307 307
So I hope you enjoyed this quick walkthrough 308 308
of the email's internet header 309 309
as we looked at some of the basic information in it. 310 310
For the exam, you should be able 311 311
to read and pull out different pieces of information 312 312
if you're given an email header. 313 313
Now, later in this section 314 314
we are going to go into our lab environment 315 315
and I'm going to walk through some more headers with you 316 316
so you can get comfortable with this concept. 317 317
But in this lesson, 318 318
I just wanted to give you the introduction 319 319
and so you could understand 320 320
how to read the different parts of it.