1 1 00:00:00,270 --> 00:00:02,520 Analyzing email headers. 2 2 00:00:02,520 --> 00:00:04,740 In this lesson, we're going to talk about email 3 3 00:00:04,740 --> 00:00:07,290 and we're going to dig into looking at some headers. 4 4 00:00:07,290 --> 00:00:09,240 Now, first, let's go in and look at 5 5 00:00:09,240 --> 00:00:10,920 a legitimate piece of email. 6 6 00:00:10,920 --> 00:00:12,840 This is one I've set up in my test environment 7 7 00:00:12,840 --> 00:00:16,260 and I'm sending just an email from myself to myself. 8 8 00:00:16,260 --> 00:00:17,850 Now here you're going to see that there's a test 9 9 00:00:17,850 --> 00:00:20,283 message that went to sam@515support.com. 10 10 00:00:21,570 --> 00:00:23,640 When we go in and look at the headers of this though 11 11 00:00:23,640 --> 00:00:25,410 we're going to be able to see all of the different pieces 12 12 00:00:25,410 --> 00:00:26,430 that are important to us. 13 13 00:00:26,430 --> 00:00:28,548 Things like the return path, received 14 14 00:00:28,548 --> 00:00:31,560 from, date and content type. 15 15 00:00:31,560 --> 00:00:33,810 Now, if we look at the return path this is the address 16 16 00:00:33,810 --> 00:00:35,850 that will normally receive the notifications when 17 17 00:00:35,850 --> 00:00:37,860 the email message is not deliverable. 18 18 00:00:37,860 --> 00:00:39,480 So it'll say, hey, I couldn't get there 19 19 00:00:39,480 --> 00:00:41,730 and it sends a message back to the server. 20 20 00:00:41,730 --> 00:00:44,400 Normally, this is going to be the same as your sender's email 21 21 00:00:44,400 --> 00:00:46,230 but it could be changed by a server. 22 22 00:00:46,230 --> 00:00:48,810 This doesn't necessarily mean that it's malicious. 23 23 00:00:48,810 --> 00:00:50,760 The next thing we want to look at is received. 24 24 00:00:50,760 --> 00:00:52,980 Now under received, you're going to see a list of all the hosts 25 25 00:00:52,980 --> 00:00:55,680 that have touched this message as it tried to deliver them. 26 26 00:00:55,680 --> 00:00:57,420 You're going to start out in descending order 27 27 00:00:57,420 --> 00:01:00,240 and going from the most recent to the least recent. 28 28 00:01:00,240 --> 00:01:03,030 This way you could see the entire path of where it's gone. 29 29 00:01:03,030 --> 00:01:05,670 Now, in my case, it really only went from one server 30 30 00:01:05,670 --> 00:01:08,010 because I'm running all this in a lab environment. 31 31 00:01:08,010 --> 00:01:09,750 But in the real world, you'll see this go from 32 32 00:01:09,750 --> 00:01:12,540 server to server to server until it finds its way 33 33 00:01:12,540 --> 00:01:15,030 from one ISP to the next. 34 34 00:01:15,030 --> 00:01:16,410 Then we're going to look at the from. 35 35 00:01:16,410 --> 00:01:18,390 Now this is your sender's address. 36 36 00:01:18,390 --> 00:01:20,310 Now, in this case, this is a genuine message 37 37 00:01:20,310 --> 00:01:23,130 but it is possible to actually spoof this from address. 38 38 00:01:23,130 --> 00:01:24,240 And we're going to look at some of that 39 39 00:01:24,240 --> 00:01:26,790 as we go through and analyze headers later on. 40 40 00:01:26,790 --> 00:01:28,380 The next thing we want to look at is date. 41 41 00:01:28,380 --> 00:01:30,720 And again, this is just the date that this was sent. 42 42 00:01:30,720 --> 00:01:33,390 And you are going to notice there is a time zone offset here 43 43 00:01:33,390 --> 00:01:35,670 based on where the sender sent the message from. 44 44 00:01:35,670 --> 00:01:37,650 And finally, we have content type. 45 45 00:01:37,650 --> 00:01:39,600 Now, if this is a plain text email it can't have 46 46 00:01:39,600 --> 00:01:42,450 any exploits, but if you're using something like HTML 47 47 00:01:42,450 --> 00:01:45,420 or Rich Text Formatted messages those can have attachments 48 48 00:01:45,420 --> 00:01:47,790 and embeds inside the message that could carry 49 49 00:01:47,790 --> 00:01:50,430 malicious links and malicious payloads. 50 50 00:01:50,430 --> 00:01:52,110 All right, now this time we're going to go ahead 51 51 00:01:52,110 --> 00:01:53,850 and send a phishing email. 52 52 00:01:53,850 --> 00:01:56,070 In this case, we're going to impersonate a local user 53 53 00:01:56,070 --> 00:01:59,070 because we think that this server has an open relay 54 54 00:01:59,070 --> 00:02:01,230 because they haven't secured their email server. 55 55 00:02:01,230 --> 00:02:03,810 So I can go in and change my email address. 56 56 00:02:03,810 --> 00:02:07,500 So instead of having it go from hostmaster@515.net 57 57 00:02:07,500 --> 00:02:11,700 I'm going to go ahead and change that to bobby@515support.com. 58 58 00:02:11,700 --> 00:02:14,640 Now, when I do that and I hit okay, this is going to allow me 59 59 00:02:14,640 --> 00:02:16,860 to now send messages as Bobby. 60 60 00:02:16,860 --> 00:02:20,910 Now I'm going to send a phishing email to sam@515support.com, 61 61 00:02:20,910 --> 00:02:24,090 posing as a legitimate employee of 515 Support. 62 62 00:02:24,090 --> 00:02:25,950 Now, Sam will think I'm Bobby. 63 63 00:02:25,950 --> 00:02:28,957 And when I send this message I'm going to attach 64 64 00:02:28,957 --> 00:02:31,470 evilputty.exe from my downloads folder. 65 65 00:02:31,470 --> 00:02:33,510 This way, he's going to have a malicious payload. 66 66 00:02:33,510 --> 00:02:36,240 So if he opens that email and runs that exe 67 67 00:02:36,240 --> 00:02:38,010 I'm going to have control of his system. 68 68 00:02:38,010 --> 00:02:40,410 Now, let's go back to my original machine and see 69 69 00:02:40,410 --> 00:02:42,710 what happens when Sam tries to get that email. 70 70 00:02:43,901 --> 00:02:46,020 Notice here, the email was not delivered. 71 71 00:02:46,020 --> 00:02:47,100 That's strange. 72 72 00:02:47,100 --> 00:02:48,240 Let's go ahead and take a look at our 73 73 00:02:48,240 --> 00:02:51,000 SMTP logs to figure out why. 74 74 00:02:51,000 --> 00:02:53,760 All right, here we are in our SMTP logs. 75 75 00:02:53,760 --> 00:02:55,260 We're going to go ahead and look at our mail 76 76 00:02:55,260 --> 00:02:57,420 server administration and go to settings. 77 77 00:02:57,420 --> 00:02:59,550 Then logging, then show logs. 78 78 00:02:59,550 --> 00:03:03,360 Here I can see the most recent log file as I open it up. 79 79 00:03:03,360 --> 00:03:05,610 Now towards the end of this file you're going to see 80 80 00:03:05,610 --> 00:03:09,420 530 SMTP authentication is required. 81 81 00:03:09,420 --> 00:03:10,680 Now what does that mean? 82 82 00:03:10,680 --> 00:03:13,140 Well, it means this local email server refused the 83 83 00:03:13,140 --> 00:03:16,290 connection when I tried to send that email as Bobby. 84 84 00:03:16,290 --> 00:03:17,400 Why did it do that? 85 85 00:03:17,400 --> 00:03:20,040 Well, because I never authenticated with the server. 86 86 00:03:20,040 --> 00:03:21,990 Because this server doesn't have an open relay 87 87 00:03:21,990 --> 00:03:25,620 it requires authentication by users and host IP ranges 88 88 00:03:25,620 --> 00:03:27,270 whenever they try to connect to it. 89 89 00:03:27,270 --> 00:03:31,590 So when I tried to send something as bobby@515support.com, 90 90 00:03:31,590 --> 00:03:34,080 it went ahead and stop me because I never logged in 91 91 00:03:34,080 --> 00:03:35,760 with Bobby's username and password. 92 92 00:03:35,760 --> 00:03:37,800 Now, just to show you what happens here 93 93 00:03:37,800 --> 00:03:40,770 I'm going to go ahead and log in as Bobby on his account. 94 94 00:03:40,770 --> 00:03:42,900 Now, when I log in as Bobby with his password 95 95 00:03:42,900 --> 00:03:45,060 and I open up his email account I can see 96 96 00:03:45,060 --> 00:03:46,710 there's a non delivery report. 97 97 00:03:46,710 --> 00:03:48,630 This is because that return path was set 98 98 00:03:48,630 --> 00:03:49,980 as his email address. 99 99 00:03:49,980 --> 00:03:52,590 So when the server wouldn't send my phishing email 100 100 00:03:52,590 --> 00:03:55,560 onto the next person Bobby got the kickback message 101 101 00:03:55,560 --> 00:03:58,290 going to him and so if he saw this, he could tell 102 102 00:03:58,290 --> 00:04:00,600 security folks and they could do some additional research 103 103 00:04:00,600 --> 00:04:02,760 to figure out why the delivery didn't happen. 104 104 00:04:02,760 --> 00:04:05,310 Or in this case, if it wasn't a message that he sent 105 105 00:04:05,310 --> 00:04:07,380 he should report to security that this is suspicious 106 106 00:04:07,380 --> 00:04:09,060 activity that someone's trying to create a 107 107 00:04:09,060 --> 00:04:10,983 phishing campaign using his email.