Your friendly spammers

Occasionally, you may get an email that appears to have been sent by someone you know, or someone who seems to know you rather well, judging from the familiarity of the way the person is coming across and their seeming friendliness. Unfortunately this is a tactic of malware distributors, who spoof a sender’s email address and send people an email as a spam that appears to come from someone close, or to be related to an important matter, in the hope that you’ll click the link provided and open the floodgates to any malware they’d like to infest your computer with.

Is that supposedly friendly email genuine, or a spoof? Other than intuition, there are a number of ways of finding out for sure: The most risky of which is to click the link in the email and download the “holiday video” or the “free idea”. – Of course that’s going to lead to you getting a box crawling with malware; so what’s the least risky way of finding out?

That would be to check the message’s source. It looks something like the one below, and you can normally view it by jumping through a series of hoops, depending upon which email client you use.

Trace the truth

To trace the email’s source you read backwards from above the message’s content notation: – So in this case I start above where it says “This is a multi-part message in MIME format”.

The first content you’ll see, reading upwards, is the destination address, which was my personal email, up through any number of stages where the message has been relayed via various servers, (In this case just the one.), and finally at the top, the sender’s information, name of their computer, etc.

psiorac2x is the name of one of my machines, I use BT as an ISP, and the IP pool they’re using at that time is synonymous with the set of IP addresses they sometimes commonly use for dynamic IP assignment; so in this case I can see that I sent this email to myself on Tuesday 29th September 2009, using Microsoft Outlook Express.

(You’ll note that it’s not always possible to trace the exact IP of the sender if their ISP is dynamically assigning the sender an IP address; but the ISP themselves will know exactly which IP address corresponded to which user at what time. – Therefore, unless the IP is spoofed, you should be able to complain to the sender’s ISP if need be.)

You scratch my back; I’ll claw repeatedly at yours.

(No that wasn’t a sensual come-on line. )

Now I’m told that what I’m about to tell you isn’t documented anywhere; which, if true, makes it a rather valuable piece of information. At kkomp.com I like providing value to my readers; as it provides good content, and has the readers coming back for more.

OK – Having got that covered, here is the information promised: –

As a shortcut to view the displayed email’s source, when displayed in either Microsoft Outlook Express in XP, or Windows Live Mail in XP, (Vista), or Windows 7, simply press left shift and F3 simultaneously on your keyboard.

Is that trick really totally undocumented? I’m sceptical; but once again please comment and let me know.

Enjoy the coming week; and beware of “friendly” emails.