1 1 00:00:00,810 --> 00:00:03,090 Email header analysis. 2 2 00:00:03,090 --> 00:00:06,330 In this lesson we're going to talk about those email headers, 3 3 00:00:06,330 --> 00:00:08,460 those things that are essentially hidden from view 4 4 00:00:08,460 --> 00:00:11,070 but contain a lot of important information. 5 5 00:00:11,070 --> 00:00:12,330 An email internet header 6 6 00:00:12,330 --> 00:00:14,370 is a record of the email servers involved 7 7 00:00:14,370 --> 00:00:15,640 in transferring an email message 8 8 00:00:15,640 --> 00:00:18,300 from the sender to a recipient. 9 9 00:00:18,300 --> 00:00:19,830 Let's talk a little bit about how this works 10 10 00:00:19,830 --> 00:00:21,690 when you send an email. 11 11 00:00:21,690 --> 00:00:23,550 Now, when the email is created, 12 12 00:00:23,550 --> 00:00:27,360 you create this on what's called a mail user agent, or MUA. 13 13 00:00:27,360 --> 00:00:29,730 This is essentially going to be your email program 14 14 00:00:29,730 --> 00:00:31,860 or Gmail, if you're running in the browser. 15 15 00:00:31,860 --> 00:00:34,290 We're going to use Gmail as our example here. 16 16 00:00:34,290 --> 00:00:36,660 Now this program is going to create your initial header 17 17 00:00:36,660 --> 00:00:38,385 and then it forwards that information 18 18 00:00:38,385 --> 00:00:42,000 over to a mail delivery agent, known as an MDA. 19 19 00:00:42,000 --> 00:00:44,310 This essentially goes from your email client 20 20 00:00:44,310 --> 00:00:48,030 to your email server, and this happens over SMTP. 21 21 00:00:48,030 --> 00:00:50,460 Now, that mail delivery agent is going to do some checks, 22 22 00:00:50,460 --> 00:00:51,660 like ensuring that the sender 23 23 00:00:51,660 --> 00:00:54,390 is authorized to send the message from that domain. 24 24 00:00:54,390 --> 00:00:56,340 This may be done using digital certificates 25 25 00:00:56,340 --> 00:00:58,140 or using a username and password, 26 26 00:00:58,140 --> 00:00:59,610 which is much more common. 27 27 00:00:59,610 --> 00:01:02,040 Now, once that's done, the MDA is going to check and see 28 28 00:01:02,040 --> 00:01:05,010 if that email can be served locally from its server. 29 29 00:01:05,010 --> 00:01:06,720 For example, if I'm sending an email 30 30 00:01:06,720 --> 00:01:08,460 from myself to my video editor, 31 31 00:01:08,460 --> 00:01:11,820 we both use the same email server, diontraining.com, 32 32 00:01:11,820 --> 00:01:12,810 and so in that case, 33 33 00:01:12,810 --> 00:01:14,550 the MDA would simply take that message 34 34 00:01:14,550 --> 00:01:16,140 and put it in their mailbox. 35 35 00:01:16,140 --> 00:01:19,020 But if I'm sending something to you at Gmail.com, 36 36 00:01:19,020 --> 00:01:21,240 it now has to transfer that to Gmail servers, 37 37 00:01:21,240 --> 00:01:24,390 and so the MDA passes it over to an MTA, 38 38 00:01:24,390 --> 00:01:26,520 which is a message transfer agent. 39 39 00:01:26,520 --> 00:01:27,840 This message transfer agent 40 40 00:01:27,840 --> 00:01:30,060 is going to route the message to the recipient 41 41 00:01:30,060 --> 00:01:32,100 using DNS to locate the different recipient's 42 42 00:01:32,100 --> 00:01:34,950 mail transfer agent to accept that message. 43 43 00:01:34,950 --> 00:01:36,990 Once I get it over to Gmail servers, 44 44 00:01:36,990 --> 00:01:38,220 or Microsoft servers, 45 45 00:01:38,220 --> 00:01:39,960 or whoever it is I'm sending it to, 46 46 00:01:39,960 --> 00:01:42,060 the MTA collects that message. 47 47 00:01:42,060 --> 00:01:43,740 Now, a lot of times this doesn't go 48 48 00:01:43,740 --> 00:01:45,900 straight from my server to the destination, 49 49 00:01:45,900 --> 00:01:47,670 but it routes between multiple servers 50 50 00:01:47,670 --> 00:01:49,230 going across the internet. 51 51 00:01:49,230 --> 00:01:51,872 Every time it goes to a new message transfer agent, 52 52 00:01:51,872 --> 00:01:53,490 that message transfer agent 53 53 00:01:53,490 --> 00:01:56,310 is going to add information into the email's internet header 54 54 00:01:56,310 --> 00:01:57,690 and this way we have a log 55 55 00:01:57,690 --> 00:02:00,480 of every single place this message went. 56 56 00:02:00,480 --> 00:02:03,307 Once it gets to an MTA, that MTA finally looks and says, 57 57 00:02:03,307 --> 00:02:05,010 "Ah, this is on my server, 58 58 00:02:05,010 --> 00:02:06,840 I'm going to send this to my person." 59 59 00:02:06,840 --> 00:02:09,210 And so it will send it over to the MDA, 60 60 00:02:09,210 --> 00:02:11,700 the mail delivery agent for its server. 61 61 00:02:11,700 --> 00:02:12,870 Once it does that, 62 62 00:02:12,870 --> 00:02:15,180 the mail delivery agent puts it into the mailbox 63 63 00:02:15,180 --> 00:02:16,290 and then it sits there and waits 64 64 00:02:16,290 --> 00:02:19,230 until you connect using something like POP3 or IMAP 65 65 00:02:19,230 --> 00:02:21,720 to access that message from your mailbox 66 66 00:02:21,720 --> 00:02:24,120 into your desktop client, the MUA, 67 67 00:02:24,120 --> 00:02:26,490 which, again, is our mail user agent. 68 68 00:02:26,490 --> 00:02:29,400 And so again, this is a simple example of how mail goes 69 69 00:02:29,400 --> 00:02:31,290 from a mail user agent on one end 70 70 00:02:31,290 --> 00:02:33,155 through the different mail delivery agents, 71 71 00:02:33,155 --> 00:02:34,980 through the mail transfer agents, 72 72 00:02:34,980 --> 00:02:36,613 and eventually back through the mail delivery agents 73 73 00:02:36,613 --> 00:02:40,020 to the mailbox and over to the mail user agent once more, 74 74 00:02:40,020 --> 00:02:42,570 where it's going to get to its destination and be read. 75 75 00:02:42,570 --> 00:02:44,040 So now that we've talked about how email goes 76 76 00:02:44,040 --> 00:02:45,420 from one place to another, 77 77 00:02:45,420 --> 00:02:47,010 let's talk about some of the vulnerabilities 78 78 00:02:47,010 --> 00:02:48,870 that could be exploited by attackers. 79 79 00:02:48,870 --> 00:02:50,700 First, attackers can exploit the fact 80 80 00:02:50,700 --> 00:02:53,010 that there are actually three sender address fields 81 81 00:02:53,010 --> 00:02:55,110 inside of an email, and this is something 82 82 00:02:55,110 --> 00:02:57,030 that is going to be something that they can exploit. 83 83 00:02:57,030 --> 00:03:00,210 The first one is what's known as the Display From address. 84 84 00:03:00,210 --> 00:03:02,490 For instance, if you get an email from my support team, 85 85 00:03:02,490 --> 00:03:03,990 you're going to get an email that looks like this. 86 86 00:03:03,990 --> 00:03:08,790 It's going to say Support <support@diontraining.com>. 87 87 00:03:08,790 --> 00:03:10,410 That is the Display From. 88 88 00:03:10,410 --> 00:03:12,090 Now, that doesn't actually mean anything. 89 89 00:03:12,090 --> 00:03:14,730 We can make that say whatever it is we want it to say 90 90 00:03:14,730 --> 00:03:15,991 but that is what's going to be displayed 91 91 00:03:15,991 --> 00:03:18,150 and that's part of the three fields that we're going to have 92 92 00:03:18,150 --> 00:03:20,160 as part of this internet header. 93 93 00:03:20,160 --> 00:03:21,780 This is what's known as the From header 94 94 00:03:21,780 --> 00:03:24,510 or the Display From header, and this Display From 95 95 00:03:24,510 --> 00:03:26,790 is going to be basically just a pretty friendly name 96 96 00:03:26,790 --> 00:03:28,710 with anything we want to put in there. 97 97 00:03:28,710 --> 00:03:30,420 Now, what attackers will often do 98 98 00:03:30,420 --> 00:03:31,680 is they'll change it to make it look 99 99 00:03:31,680 --> 00:03:34,200 like it comes from Support at Dion Training, 100 100 00:03:34,200 --> 00:03:35,670 even though if you looked underneath, 101 101 00:03:35,670 --> 00:03:36,690 it might actually be something 102 102 00:03:36,690 --> 00:03:41,340 like Support@diontraining.com <theft@badguy.com>. 103 103 00:03:41,340 --> 00:03:42,173 If I had that 104 104 00:03:42,173 --> 00:03:44,174 and you only saw the Support@diontraining part, 105 105 00:03:44,174 --> 00:03:45,840 that's all you're going to be seeing, 106 106 00:03:45,840 --> 00:03:48,180 because a lot of our mail clients only show 107 107 00:03:48,180 --> 00:03:50,280 the friendly part outside of the brackets 108 108 00:03:50,280 --> 00:03:52,380 and not what's inside the brackets. 109 109 00:03:52,380 --> 00:03:54,534 So you might see support@diontraining in your Gmail client 110 110 00:03:54,534 --> 00:03:58,290 and not the theft@badguy.com, for example. 111 111 00:03:58,290 --> 00:03:59,136 Now the second thing they can exploit 112 112 00:03:59,136 --> 00:04:01,440 is what's called the Envelope From. 113 113 00:04:01,440 --> 00:04:03,090 This is another from field. 114 114 00:04:03,090 --> 00:04:04,470 Now, the Envelope From 115 115 00:04:04,470 --> 00:04:05,580 is going to have various labels 116 116 00:04:05,580 --> 00:04:07,410 that are actually hidden from your mail client. 117 117 00:04:07,410 --> 00:04:09,990 This is essentially your return address. 118 118 00:04:09,990 --> 00:04:11,820 And so if your email is actually rejected 119 119 00:04:11,820 --> 00:04:13,620 by the mail transfer agent, 120 120 00:04:13,620 --> 00:04:14,970 it's going to go and send it back 121 121 00:04:14,970 --> 00:04:17,130 to where the Envelope From is. 122 122 00:04:17,130 --> 00:04:18,230 So this field can be anything again. 123 123 00:04:18,230 --> 00:04:20,400 In this case we might have something 124 124 00:04:20,400 --> 00:04:22,530 like support@badguy.com, 125 125 00:04:22,530 --> 00:04:23,550 but you'd never see it 126 126 00:04:23,550 --> 00:04:24,840 because it's something that's hidden 127 127 00:04:24,840 --> 00:04:26,580 from your display client. 128 128 00:04:26,580 --> 00:04:27,540 And then the third thing we have 129 129 00:04:27,540 --> 00:04:30,030 is what's called to Receive From/By. 130 130 00:04:30,030 --> 00:04:32,520 And this is a list of all the different MTAs 131 131 00:04:32,520 --> 00:04:34,350 that have processed this email. 132 132 00:04:34,350 --> 00:04:37,860 Every time an MTA, a mail transfer agent, touches this email 133 133 00:04:37,860 --> 00:04:41,040 as it's going through these different servers along its way, 134 134 00:04:41,040 --> 00:04:44,130 there is a chance that this Received By could be changed. 135 135 00:04:44,130 --> 00:04:45,180 Now again, this is a field 136 136 00:04:45,180 --> 00:04:46,740 that's not displayed to your client, 137 137 00:04:46,740 --> 00:04:48,750 but it is in those internet headers. 138 138 00:04:48,750 --> 00:04:50,190 And so if you think you have a message 139 139 00:04:50,190 --> 00:04:51,240 that may have been spoofed, 140 140 00:04:51,240 --> 00:04:53,040 you can open up your internet headers 141 141 00:04:53,040 --> 00:04:55,950 and see all the different Received From/Bys 142 142 00:04:55,950 --> 00:04:57,330 and that would tell you exactly 143 143 00:04:57,330 --> 00:04:58,710 which servers it's gone through 144 144 00:04:58,710 --> 00:05:00,930 as it's passed along the internet. 145 145 00:05:00,930 --> 00:05:03,810 Now, as I said, most headers are not displayed 146 146 00:05:03,810 --> 00:05:06,000 by your email applications by default 147 147 00:05:06,000 --> 00:05:08,010 but, if you see something that looks suspicious, 148 148 00:05:08,010 --> 00:05:11,160 you can open up those headers and start doing some analysis, 149 149 00:05:11,160 --> 00:05:14,160 which is what we're going to do here on a sample email. 150 150 00:05:14,160 --> 00:05:16,170 Now, in the example I'm going to show you here 151 151 00:05:16,170 --> 00:05:17,730 we've actually removed some of the fields 152 152 00:05:17,730 --> 00:05:19,170 to make it a little easier to read 153 153 00:05:19,170 --> 00:05:21,330 and we've pulled out some of the original information 154 154 00:05:21,330 --> 00:05:23,130 and we've put in some placeholder information, 155 155 00:05:23,130 --> 00:05:25,860 things like spam.foo and things like that 156 156 00:05:25,860 --> 00:05:29,190 as opposed to using real IP addresses or real domain names. 157 157 00:05:29,190 --> 00:05:31,260 The reason we did this is because, on the exam, 158 158 00:05:31,260 --> 00:05:33,540 this is similar to what CompTIA will do for you 159 159 00:05:33,540 --> 00:05:35,670 because they don't want to have anybody's real IP addresses 160 160 00:05:35,670 --> 00:05:38,820 or domain names shown inside of an exam simulation, 161 161 00:05:38,820 --> 00:05:41,340 because those IP addresses change all the time 162 162 00:05:41,340 --> 00:05:43,260 and it may not be malicious anymore. 163 163 00:05:43,260 --> 00:05:45,330 So let's take a look at this email header. 164 164 00:05:45,330 --> 00:05:46,770 This is what it looks like. 165 165 00:05:46,770 --> 00:05:48,090 Now, this is a lot of text, 166 166 00:05:48,090 --> 00:05:49,560 so I'm going to give you a second to read through it. 167 167 00:05:49,560 --> 00:05:51,930 I'm not going to read through it all right this second 168 168 00:05:51,930 --> 00:05:54,270 because we're going to go through it step-by-step 169 169 00:05:54,270 --> 00:05:55,770 as we go through our analysis. 170 170 00:05:57,090 --> 00:05:58,950 Now, one of the first things I'm going to look for 171 171 00:05:58,950 --> 00:06:00,600 when I open up an email header is 172 172 00:06:00,600 --> 00:06:02,400 where is the authentication results 173 173 00:06:02,400 --> 00:06:03,840 and what do they look like? 174 174 00:06:03,840 --> 00:06:05,940 So if I skip down to the fourth paragraph here 175 175 00:06:05,940 --> 00:06:08,190 you'll see authentication results. 176 176 00:06:08,190 --> 00:06:10,490 In here you'll see the Header From, 177 177 00:06:10,490 --> 00:06:12,960 in this case it's spam.foo, 178 178 00:06:12,960 --> 00:06:17,190 and this came from smtp.mailfrom identified as spam.foo. 179 179 00:06:17,190 --> 00:06:18,600 So this was the spam server 180 180 00:06:18,600 --> 00:06:21,150 or the phishing server that sent that information. 181 181 00:06:21,150 --> 00:06:22,860 This is a clue that this is bad. 182 182 00:06:22,860 --> 00:06:25,260 Now, in the real world, it wouldn't be spam.foo, 183 183 00:06:25,260 --> 00:06:27,000 it might be a real domain name 184 184 00:06:27,000 --> 00:06:28,560 but this is the area that you'd be looking at 185 185 00:06:28,560 --> 00:06:30,660 to see where did that message actually come from 186 186 00:06:30,660 --> 00:06:32,340 and what was the IP address. 187 187 00:06:32,340 --> 00:06:36,150 In this case, it's been abbreviated as w.x.y.z, 188 188 00:06:36,150 --> 00:06:38,250 because again, we don't want to use a real IP address 189 189 00:06:38,250 --> 00:06:41,160 that's actually owned by some real server. 190 190 00:06:41,160 --> 00:06:43,800 After that, we are going to read from the bottom up. 191 191 00:06:43,800 --> 00:06:45,210 Now as we read from the bottom up 192 192 00:06:45,210 --> 00:06:46,530 going from that authentication, 193 193 00:06:46,530 --> 00:06:49,140 we are going to see all the servers it's gone through. 194 194 00:06:49,140 --> 00:06:50,370 Now the first one we see here 195 195 00:06:50,370 --> 00:06:52,260 is it went through openrelay.foo, 196 196 00:06:52,260 --> 00:06:53,910 which is our spam server here, 197 197 00:06:53,910 --> 00:06:57,960 and again, we have an IP address of w.x.y.z. 198 198 00:06:57,960 --> 00:06:59,250 Now as we look at this, 199 199 00:06:59,250 --> 00:07:01,740 we're going to be able to see exactly where it came from 200 200 00:07:01,740 --> 00:07:03,630 and that openrelay was somebody 201 201 00:07:03,630 --> 00:07:05,760 that was sending spam through that server. 202 202 00:07:05,760 --> 00:07:07,770 A server that's been taken over and used by a bad guy 203 203 00:07:07,770 --> 00:07:09,570 is what's known as an open relay, 204 204 00:07:09,570 --> 00:07:11,850 which is why we have that placeholder here. 205 205 00:07:11,850 --> 00:07:14,670 Now, this field is showing us the SMTP server 206 206 00:07:14,670 --> 00:07:16,560 where the message was actually originated from. 207 207 00:07:16,560 --> 00:07:19,560 In this case it came from openrelay.foo. 208 208 00:07:19,560 --> 00:07:21,900 Now, if I went and looked at openrelay.foo, 209 209 00:07:21,900 --> 00:07:23,557 I might look it up and get some information about it, 210 210 00:07:23,557 --> 00:07:26,250 do some open source intelligence and figure out, 211 211 00:07:26,250 --> 00:07:27,720 is this a known spam agent? 212 212 00:07:27,720 --> 00:07:29,867 And if it is, it may be found on some blacklist, 213 213 00:07:29,867 --> 00:07:32,670 and if so, we might want to add it to our blacklist as well, 214 214 00:07:32,670 --> 00:07:35,580 so we're not getting that spam inside our systems either. 215 215 00:07:35,580 --> 00:07:36,840 Now, the next thing I want to look at 216 216 00:07:36,840 --> 00:07:39,000 is how we can do a much cleaner and easier way 217 217 00:07:39,000 --> 00:07:40,740 of looking at this information. 218 218 00:07:40,740 --> 00:07:41,640 Well, one of the things 219 219 00:07:41,640 --> 00:07:43,980 is that this information is a lot of text 220 220 00:07:43,980 --> 00:07:45,480 and it's pretty heavy to look through, 221 221 00:07:45,480 --> 00:07:47,670 but there are some tools out there that you can use. 222 222 00:07:47,670 --> 00:07:51,540 One of them is called testconnectivity.microsoft.com, 223 223 00:07:51,540 --> 00:07:53,070 and if you go there, you'll find the tool 224 224 00:07:53,070 --> 00:07:55,440 called the Message Header Analysis. 225 225 00:07:55,440 --> 00:07:56,760 You can take your message header 226 226 00:07:56,760 --> 00:07:59,370 and paste it into the top block, like I've done here, 227 227 00:07:59,370 --> 00:08:01,860 hit Analyze headers, and it will actually break it down 228 228 00:08:01,860 --> 00:08:05,460 into areas for you to see in a much easier format. 229 229 00:08:05,460 --> 00:08:06,870 So for example, here you can see 230 230 00:08:06,870 --> 00:08:09,450 the first hop was openrelay.foo, 231 231 00:08:09,450 --> 00:08:11,130 and then at the bottom we can see 232 232 00:08:11,130 --> 00:08:13,170 that authentication results I showed you before, 233 233 00:08:13,170 --> 00:08:17,160 smtp.mailfrom=spam.foo 234 234 00:08:17,160 --> 00:08:20,310 and header.from=spam.foo. 235 235 00:08:20,310 --> 00:08:22,590 Both of those are the pieces of information we wanted 236 236 00:08:22,590 --> 00:08:24,180 as we started looking through the different headers 237 237 00:08:24,180 --> 00:08:26,130 and we wanted to see where it came from. 238 238 00:08:26,130 --> 00:08:27,210 By using something like this, 239 239 00:08:27,210 --> 00:08:28,530 it is a lot quicker and easier 240 240 00:08:28,530 --> 00:08:30,150 for you to identify things quickly 241 241 00:08:30,150 --> 00:08:31,470 as you're looking through them 242 242 00:08:31,470 --> 00:08:33,900 and identify exactly what the delays were in between 243 243 00:08:33,900 --> 00:08:35,490 and how long things sat. 244 244 00:08:35,490 --> 00:08:38,019 For instance, if a message sat someplace with a long delay 245 245 00:08:38,019 --> 00:08:40,440 that could have been time that an attacker was using 246 246 00:08:40,440 --> 00:08:41,670 to modify that message, 247 247 00:08:41,670 --> 00:08:44,280 and so it'd be something you'd want to look at as well. 248 248 00:08:44,280 --> 00:08:46,170 Now let's take a look at the actual message itself 249 249 00:08:46,170 --> 00:08:48,270 as we go through some of the rest of the headers here. 250 250 00:08:48,270 --> 00:08:49,380 As we continue down the header, 251 251 00:08:49,380 --> 00:08:50,400 we'll see some more information, 252 252 00:08:50,400 --> 00:08:52,357 for instance, the subject, in this case, 253 253 00:08:52,357 --> 00:08:54,330 "Your account is blocked by the administrator". 254 254 00:08:54,330 --> 00:08:56,040 That's a pretty alarming subject 255 255 00:08:56,040 --> 00:08:57,720 and it might get somebody's attention to open up 256 256 00:08:57,720 --> 00:09:00,450 and click that email and click a link inside of it. 257 257 00:09:00,450 --> 00:09:02,190 Then we can see the content inside of it. 258 258 00:09:02,190 --> 00:09:04,200 We can see different content type, the date, 259 259 00:09:04,200 --> 00:09:06,840 the MIME version, the From account, the To account, 260 260 00:09:06,840 --> 00:09:08,010 and the Return-Path. 261 261 00:09:08,010 --> 00:09:09,180 Let's take a look at that From account 262 262 00:09:09,180 --> 00:09:10,440 a little bit more in depth. 263 263 00:09:10,440 --> 00:09:11,520 Now look at that, it says: 264 264 00:09:11,520 --> 00:09:15,987 Gmail Accounts <spammer@spam.foo>. 265 265 00:09:16,830 --> 00:09:18,810 So again, remember that From header 266 266 00:09:18,810 --> 00:09:20,370 is just what we want it to display. 267 267 00:09:20,370 --> 00:09:22,170 I could type anything I want in there 268 268 00:09:22,170 --> 00:09:23,490 and so in this case, we're saying 269 269 00:09:23,490 --> 00:09:25,740 this is from Gmail Accounts, even though it's not. 270 270 00:09:25,740 --> 00:09:28,110 It's from spammer@spam.foo. 271 271 00:09:28,110 --> 00:09:29,310 And then we have the return path. 272 272 00:09:29,310 --> 00:09:31,470 This is where the email actually goes back to 273 273 00:09:31,470 --> 00:09:33,060 if there's a problem delivering it. 274 274 00:09:33,060 --> 00:09:35,790 And in this case you could see it's spammer@spam.foo, 275 275 00:09:35,790 --> 00:09:37,800 which is the real email address. 276 276 00:09:37,800 --> 00:09:39,600 Now, again, I can change that From account 277 277 00:09:39,600 --> 00:09:40,890 to anything I want, 278 278 00:09:40,890 --> 00:09:43,140 but the return path has to be the right one, 279 279 00:09:43,140 --> 00:09:45,810 otherwise the MTA will not deliver the messages. 280 280 00:09:45,810 --> 00:09:47,910 All right, let's look at the next part of the header. 281 281 00:09:47,910 --> 00:09:49,800 Here I have what are called the X headers 282 282 00:09:49,800 --> 00:09:51,700 and you'll see X-MS-Exchange, 283 283 00:09:51,700 --> 00:09:56,250 X-MS-Office, X-Sender, X-SID, 284 284 00:09:56,250 --> 00:09:57,780 bunch of different stuff here. 285 285 00:09:57,780 --> 00:10:00,090 Now, X headers indicate custom headers 286 286 00:10:00,090 --> 00:10:02,970 that are controlled by the SMTP server administrator. 287 287 00:10:02,970 --> 00:10:04,620 So you'll notice in my example here, 288 288 00:10:04,620 --> 00:10:07,830 we have things like MS Exchange, MS Office 365, 289 289 00:10:07,830 --> 00:10:09,480 Microsoft Anti-Spam. 290 290 00:10:09,480 --> 00:10:11,070 These are all things controlled by that server 291 291 00:10:11,070 --> 00:10:13,043 and, in the example I showed you earlier on the diagram, 292 292 00:10:13,043 --> 00:10:14,820 we were sending our information 293 293 00:10:14,820 --> 00:10:16,800 to a Microsoft Exchange server 294 294 00:10:16,800 --> 00:10:18,690 that was run by the Microsoft Corporation 295 295 00:10:18,690 --> 00:10:20,490 and that's who's controlling these headers. 296 296 00:10:20,490 --> 00:10:21,510 So if I look at that, 297 297 00:10:21,510 --> 00:10:25,170 you might see one here that has X-SID-PRA. 298 298 00:10:25,170 --> 00:10:29,550 Now, X-SID-PRA is giving me spammer@spam.foo again. 299 299 00:10:29,550 --> 00:10:31,590 Again, this is some information that helps us 300 300 00:10:31,590 --> 00:10:33,810 as we are going through and figuring out spam 301 301 00:10:33,810 --> 00:10:35,190 and it's something that we can actually use 302 302 00:10:35,190 --> 00:10:36,090 as part of our analysis 303 303 00:10:36,090 --> 00:10:37,396 by setting up these X headers 304 304 00:10:37,396 --> 00:10:40,260 to be able to document different pieces of information. 305 305 00:10:40,260 --> 00:10:43,170 This is one that is used by Microsoft 365 306 306 00:10:43,170 --> 00:10:45,540 as part of their anti-spam efforts. 307 307 00:10:45,540 --> 00:10:47,340 So I hope you enjoyed this quick walkthrough 308 308 00:10:47,340 --> 00:10:49,080 of the email's internet header 309 309 00:10:49,080 --> 00:10:51,420 as we looked at some of the basic information in it. 310 310 00:10:51,420 --> 00:10:52,770 For the exam, you should be able 311 311 00:10:52,770 --> 00:10:54,870 to read and pull out different pieces of information 312 312 00:10:54,870 --> 00:10:56,520 if you're given an email header. 313 313 00:10:56,520 --> 00:10:57,720 Now, later in this section 314 314 00:10:57,720 --> 00:10:59,280 we are going to go into our lab environment 315 315 00:10:59,280 --> 00:11:01,440 and I'm going to walk through some more headers with you 316 316 00:11:01,440 --> 00:11:03,120 so you can get comfortable with this concept. 317 317 00:11:03,120 --> 00:11:03,953 But in this lesson, 318 318 00:11:03,953 --> 00:11:05,183 I just wanted to give you the introduction 319 319 00:11:05,183 --> 00:11:06,360 and so you could understand 320 320 00:11:06,360 --> 00:11:08,260 how to read the different parts of it.