bvstone

Email Address Spoofing with MAILTOOL

Posted:

Email Address Spoofing with MAILTOOL

Now that a lot of our IBM i customers are moving to the cloud for their email servers (ie, Google, Microsoft Office 365, Godaddy, etc) we are finding that some "tricks" have been played up until now that just won't cut the mustard with these new email services.

The main trick we're seeing is that of email address "spoofing".  This means the FROM address you are specifying doesn't match the Account (AUTHUSER) parameter on the MAILTOOL command.

When using a cloud service you're required, in most cases, to provide an account ID and password.  In most cases this should match the FROM address (ie, FROMADDR should be the same as AUTHUSER).  

Examine this scenario:

You just set up your new cloud server through GMail.  You supply an account id of joe@yourcompany.com along with the associated password.  But, for the "from" address you specify "replytome@yourcompany.com".  With most cloud providers one of two things will happen:

  1. The "from" address will automatically get changed to the account id, overriding the specified "from" address.
  2. The email will not be delivered because the "from" address and the account ID do not match.

I ran a couple of examples and am including the results of the SMTP debug file created by MAILTOOL to show exactly how this works:

Test 1: Using GMail

​The following command was run to perform this test:

MAILTOOL TOADDR(bvstone@yahoo.com) FROMADDR(notme@bvstools.com) 
SUBJECT(Test) MESSAGE('Test Email') CONFIG('/bvstools/bvstools_test2.json') 
DEBUG(*YES)

The following configuration file settings were used:

{
	"variables": [
	{
		"name":"send_with_server_type",
		"default":"*MAILTOOL"
	},
	{
		"name":"mail_router",
		"default":"smtp.gmail.com"
	},
	{
		"name":"use_mail_router",
		"default":"*ONLY"
	},
	{
		"name":"use_ssl",
		"default":"*YES"
	},
	{
		"name":"smtp_port",
		"default":"465"
	},
	{
		"name":"smtp_auth_user",
		"default":"bvstone@bvstools.com"
	},
	{
		"name":"smtp_auth_password",
		"default":"*********"
	}	]
}

The resulting email headers are as follows:

From: bvstone@bvstools.com
X-Google-Original-From: notme@bvstools.com
MIME-Version: 1.0
To: bvstone@yahoo.com
Subject: Test

  As you can see, in the case of GMail the From address is overridden.  Google does add it's own header showing what actually was used as the From address, though.

Test 2:  Using Outlook and Office 365

​The following command was run to perform this test:

MAILTOOL TOADDR(bvstone@yahoo.com) FROMADDR(notme@outlook.com) 
SUBJECT(Test) MESSAGE('Test Email') 
CONFIG('/bvstools/bvstone_outlook_test.json') DEBUG(*YES)

The following configuration file settings were used:

{
	"variables": [
	{
		"name":"send_with_server_type",
		"default":"*MAILTOOL"
	},
	{
		"name":"mail_router",
		"default":"smtp-mail.outlook.com"
	},
	{
		"name":"use_mail_router",
		"default":"*ONLY"
	},
	{
		"name":"perform_mx_lookup",
		"default":"*NO"
	},
	{
		"name":"use_ssl",
		"default":"*TLS"
	},
	{
		"name":"smtp_port",
		"default":"587"
	},
	{
		"name":"smtp_auth_user",
		"default":"bvstone@outlook.com"
	},
	{
		"name":"smtp_auth_password",
		"default":"*************"
	}	]
}

The resulting email headers are as follows:

From: Brad Stone <bvstone@outlook.com>
To: "bvstone@yahoo.com" <bvstone@yahoo.com>
Subject: Test

So, as you can see the outlook also does allow the email through but again it updates the From address to the same as the account used.

I have also run into the following error from a customer trying to use a different From address and Office 365:

03/16/2016 17:06:07 <SMTP.OFFICE365.COM says:> 550 5.7.60 SMTP; Client does not have permissions to send as this sender

In this case it is pretty obvious what the error is.  Either this can't be done or somewhere in Office 365 there are settings to allow different senders for different accounts.

UPDATE:  Here is another example from Office 365:

<SMTP.OFFICE365.COM says:> 554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException.MapiExceptionSendAsDenied; Failed to process message due to a permanent exception with message Cannot submit message. 

In the end, it's best to set up accounts for email and use the appropriately instead of trying to take the quick and easy way out.  Normally this just results in spending 3 or 4 times more resources on the project that just doing it right the first time.

Feel free to contact us with any questions regarding these issues.  Thanks!

Brad
www.bvstools.com


Last edited 02/21/2019 at 15:00:41



Latest Posts:

MAILTOOL Updated to Allow G4GSMAIL as Option in Routers File MAILTOOL Updated to Allow G4GSMAIL as Option in Routers File
Posted by 3 days ago
BVSTools >> BVSTools Announcements >> eMail Tool (MAILTOOL) Specific Announcements
BVSTools Now Offers Interface with Infor's ION APIs BVSTools Now Offers Interface with Infor's ION APIs
Posted by May 15, 2020
BVSTools >> BVSTools Announcements
More V7R4 IFS File CCSID Issues and The Fix More V7R4 IFS File CCSID Issues and The Fix
Posted by March 4, 2020
IBM Power Systems >> (QGPL) IBM i
Error Retrieving IP Address by Name Error Retrieving IP Address by Name
Posted by February 25, 2020
BVSTools >> BVSTools Software Discussion
Logging jobs that hit an outq Logging jobs that hit an outq
Posted by February 13, 2020
Programming >> CL Programming
GreenTools for Google Apps (G4G) v12.60 Released with Shared Drive Features and More... GreenTools for Google Apps (G4G) v12.60 Released with Shared Drive Features and More...
Posted by February 4, 2020
BVSTools >> BVSTools Announcements >> GreenTools for G Suite (Google Apps) (G4G) Specific Announcements
Allowing Requests over Port 80 For SSL Validation (ie, Namecheap, etc) Allowing Requests over Port 80 For SSL Validation (ie, Namecheap, etc)
Posted by January 31, 2020
Programming >> Web Programming
GreenTools for Slack (G4SLK) v3.00 Released GreenTools for Slack (G4SLK) v3.00 Released
Posted by January 17, 2020
BVSTools >> BVSTools Announcements >> GreenTools for Slack (G4SLK) Specific Announcements
Calling a QSH Command from RPG Calling a QSH Command from RPG
Posted by December 26, 2019
Programming >> RPG Programming
SPLTOOL Print Range (PRTRNG) Function Updated to Handle Spooled Files up to 999,999,999 Pages SPLTOOL Print Range (PRTRNG) Function Updated to Handle Spooled Files up to 999,999,999 Pages
Posted by December 14, 2019
BVSTools >> BVSTools Announcements >> Spooled File Tools (SPLTOOL) Specific Announcements
GreenTools for Microsoft Apps (G4MS) Updated to v6.00 - Now Uses Microsoft Graph APIs GreenTools for Microsoft Apps (G4MS) Updated to v6.00 - Now Uses Microsoft Graph APIs
Posted by November 24, 2019
BVSTools >> BVSTools Announcements >> GreenTools for Microsoft Apps (G4MS) Specific Announcements
V7R4 Changes CCSID of Compressed File Using PASE JAR Command - Here's The Fix V7R4 Changes CCSID of Compressed File Using PASE JAR Command - Here's The Fix
Posted by November 21, 2019
IBM Power Systems >> (QGPL) IBM i
Using GETURI to Make OAuth 2.0 Requests - Custom Headers for Access Tokens Using GETURI to Make OAuth 2.0 Requests - Custom Headers for Access Tokens
Posted by November 11, 2019
BVSTools >> BVSTools Software Discussion >> Get URI (GETURI) Specific Discussion
GreenTools for Microsoft Apps (G4MS) v5.00 Released with Updated OneDrive Support and 3rd Party Functionality GreenTools for Microsoft Apps (G4MS) v5.00 Released with Updated OneDrive Support and 3rd Party Functionality
Posted by October 20, 2019
BVSTools >> BVSTools Announcements >> GreenTools for Microsoft Apps (G4MS) Specific Announcements
BVSTools is Now Running V7R4M0 BVSTools is Now Running V7R4M0
Posted by September 28, 2019
BVSTools >> BVSTools Announcements

Reply




Copyright 1983-2020 BVSTools
GreenBoard(v3) Powered by the eRPG SDK, MAILTOOL Plus!, GreenTools for Google Apps, jQuery, jQuery UI, BlockUI, CKEditor and running on the IBM i (AKA AS/400, iSeries, System i).