Non sono un esperto di sicurezza.
Non ero sicuro di pubblicare questa domanda qui o in "exploit".
Ho cercato le risposte prima di pubblicare ....
Qualcuno potrebbe dirmi come posso determinare se le email vengono inviate da un determinato computer?
La situazione è questa. Un mio amico sta ricevendo scherzi o messaggi di posta elettronica "fasulli". Crede che sia stato inviato da uno dei suoi studenti come uno scherzo. Riceve email legittime dai genitori. Ma lui crede che il bambino stia usando l'account e-mail di sua madre.
Sembra che questo ragazzo punk abbia usato l'account e-mail di sua madre per creare e-mail. Inoltre, si è registrato per alcuni appuntamenti (o un sito porno?) Chiamato "myzamana.com" e ha firmato il nome di sua madre in modo che il mio amico ora stia ricevendo email di sollecito da quel sito web.
So che i router DHCP manterranno le assegnazioni degli indirizzi IP per un certo periodo di tempo come impostato nella configurazione del router. Tipicamente in una casa non ci sono troppi dispositivi che si connettono e il router può mantenere le assegnazioni di indirizzi IP di ogni dispositivo di connessione. Ma in primo luogo si dovrebbe conoscere l'assegnazione degli indirizzi per i dispositivi per determinare il dispositivo di origine che invia un indirizzo email. Corretta?
La mia prima risposta al mio amico è che non è possibile determinare il computer reale che è stato utilizzato (ad esempio il bambino ha usato il proprio computer ma ha effettuato l'accesso utilizzando l'account di sua madre) semplicemente guardando le intestazioni dei messaggi di posta elettronica, in parte per il sopra la ragione. Tutto quello che posso ricavare dall'intestazione dell'e-mail allegata è che ci sono alcuni indirizzi IP 10.x.x.x ma questi sono solo indirizzi IP LAN privati.
Sto includendo alcune intestazioni delle e-mail che il mio amico mi ha inoltrato (sotto). Ho modificato gli indirizzi email legittimi per considerazioni sulla privacy. Qualcuno mi può illuminare, anche se ciò significa indicarmi alcuni collegamenti educativi in cui posso leggere la tecnologia appropriata pertinente.
Grazie mille,
"punk kid name"
Delivered-To: [email protected]
Received: by 10.58.24.131 with SMTP id u3csp144140vef;
Fri, 30 May 2014 17:40:50 -0700 (PDT)
X-Received: by 10.42.244.201 with SMTP id lr9mr19465050icb.2.1401496850161;
Fri, 30 May 2014 17:40:50 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm49.bullet.mail.ne1.yahoo.com (nm49.bullet.mail.ne1.yahoo.com. [98.138.120.56])
by mx.google.com with ESMTPS id d9si11587227icm.107.2014.05.30.17.40.49
for <[email protected]>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Fri, 30 May 2014 17:4punk kid name0:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 98.138.120.56 as permitted sender) client-ip=98.138.120.56;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 98.138.120.56 as permitted sender) [email protected];
dkim=pass [email protected];
dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com
Received: from [127.0.0.1] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:40:49 -0000
Received: from [98.138.100.111] by nm49.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:37:49 -0000
Received: from [66.196.81.173] by tm100.bullet.mail.ne1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
Received: from [98.139.212.244] by tm19.bullet.mail.bf1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
Received: from [127.0.0.1] by omp1053.mail.bf1.yahoo.com with NNFMP; 31 May 2014 00:37:46 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 94636 invoked by uid 60001); 31 May 2014 00:37:46 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1401496666; bh=ZQq8j8cv0S/vLsuV2Vmu786k69/gyMEKBYaXT4My+6I=; h=Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=oU1u4UVl7cNrpXN9BdprnCIBkVmUnBeh7y3rC+YQMjvXoOc265CsjYfkzwpWv40CSnACtefYnJAE621Y63zS9aLJATta2d5VoiSiJN4TV1Z88cnIDLGBunEpxq9YjtUhbLWkqEtK4yoPbwiQ2lnbBEpgHxhMKVadD3i4NtW4Skw=
X-YMail-OSG: Tv93FNQVM1nHpslRrq38uX54Qs1mrXND6AGkLivh4iV67LF
lCGJX5KJXeoCJom2DvBuq80yRsnpHgFDFvRWGKiOQ8AgdnS7dB38VIFB0Glh
DC5Tsgn52YN4WelLywOQRkPRTKxrTIGotKWe8OAcWpcjMrELuo87QlgUEuWq
vxTRdiRIFGpWspv7pinbxDDrAMLLDKzY4rdHs6qQGMm7w.sQNit7WZaDkoKu
Ab5KJpg.gctZAcgpTiijQdNQY35v5H8YDQoKxpqpDdorOXbQrRIJrLBzZ6Yw
MCQMqFWnMydophCUClmzCjxuoClI5sdQie5c3aBQ8C92KjhraX4MdWYoO__u
co.BT4Nl9sM7bbm47S9CcOSIeMUdQhSufdZUBV2ac.ItfI516XK.R7iMrr8r
0L5XWGIjoLQWt1muuxXg_DqR7wSXJtqOKzJh7USPWNwAG13fUrSihEmUuSAz
iJOPoFPCk7b8q3QShmHXPvTbxtj5kHwIv4UPXSMyVv0qTVwGIzSj9zdKLFcu
4QMaqe0WlyJOi8Ac-
Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT
X-Rocket-MIMEInfo: 002.001,SGVsbG8gT1ZIUyB0ZW5uaXMgY29hY2guIE15IG5hbWUgaXMgUm9nZXIgV2lsc29uIGFuZCBJIGFtIGN1cnJlbnRseSBhbiA4dGggZ3JhZGVyIGF0dGVuZGluZyBNYXJpbmUgVmlldyBNaWRkbGUgU2Nob29sIGFuZCBhbSBpbnRlcmVzdGVkIGluIGNvbWluZyBvdXQgYW5kIHBsYXlpbmcgZm9yIE9WIG5leHQgeWVhci4gSSBoYXZlIGFwcHJveGltYXRlbHkgNyB5ZWFycyBvZiBleHBlcmllbmNlIGFuZCBoYXZlIHBhcnRpY2lwYXRlZCBpbiBzZXZlcmFsIGxvY2FsIHRvdXJuYW1lbnRzLiBJIGFtIGF3YXJlIHRoYXQBMAEBAQE-
X-Mailer: YahooMailWebService/0.8.188.663
Message-ID: <[email protected]>
Date: Fri, 30 May 2014 17:37:45 -0700 (PDT)
From: punk kid name <[email protected]>
Reply-To: punk kid name <[email protected]>
Subject: Freshmen Tennis
To: "[email protected]" <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1844268657-78743074-1401496665=:6237"
--1844268657-78743074-1401496665=:6237
Content-Type: text/plain; charset=us-ascii
Hello tennis coach. My name is punk kid name and I
**************************
Mom's name - myzamana ..."
Delivered-To: [email protected]
Received: by 10.58.73.99 with SMTP id k3csp8490vev;
Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
X-Received: by 10.68.253.73 with SMTP id zy9mr12854824pbc.114.1402416112032;
Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
Return-Path: <noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com>
Received: from m1.myzamanamail.com (m1.myzamanamail.com. [192.155.81.148])
by mx.google.com with ESMTP id bl3si34767769pbc.235.2014.06.10.09.01.51
for <[email protected]>;
Tue, 10 Jun 2014 09:01:52 -0700 (PDT)
Received-SPF: pass (google.com: domain of noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com designates 192.155.81.148 as permitted sender) client-ip=192.155.81.148;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com designates 192.155.81.148 as permitted sender) smtp.mail=noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com;
dkim=pass (test mode) [email protected]
To: [email protected]
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=myzamanamail.com;
s=230211; t=1402416111;
bh=vQNWAs+8XofFui2UBUGRZW3n9/OFpvkEbBi5fDLy1ew=;
h=From:Reply-To:Subject:Date:List-Unsubscribe;
b=RIXG4mCEH5JbLPw9iuVS9Sm0gn9BPuOgbM6hlB69As12LOG+QfiLUMwsABcDFuKlE
1sqXUm7f2rGkjGlaaEGH+cartvcwOAVBpxcZmptK0oy1jjOBI6IKDF5sx90pVQir7J
OdqDt4CSXoTQJW3+sHPF1tDKv8YmotltGkqKYF1M=
From: Mom's name <[email protected]>
Reply-To: noreply+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com
Subject: =?utf-8?B?4piFIE5pcywgTGluZGEncyBGYXZvcml0ZSBQaG90b3M=?=
Date: Tue, 10 Jun 2014 16:01:51 +0000
X-LibVersion: 3.3.2
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=_swift-121288024853972bef9e5808.62301993_=_"
Content-Transfer-Encoding: 7bit
X-Mailgun-Variables: {"email_id":"b-189953972bef97785214693711","hash":"48a8d467be3e320fd4c02dca0f600183"}
List-Unsubscribe: <mailto:abuse+b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183@m1.myzamanamail.com>
Precedence: bulk
Message-ID: <20140610160151.23826.1626722214.swift@dolores>
This is a message in multipart MIME format. Your mail client should not
be displaying this. Consider upgrading your mail client to view this
message correctly.
--_=_swift-121288024853972bef9e5808.62301993_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Hi there,
Nis, Follow my favorite photos on Picbum!
https://www.picbum.com/?secret=b-189953972bef97785214693711_48a8d467be3e320fd4c02dca0f600183
Mom's name
****************************
Delivered-To: [email protected]
Received: by 10.58.73.99 with SMTP id k3csp264709vev;
Fri, 13 Jun 2014 17:22:52 -0700 (PDT)
X-Received: by 10.68.190.74 with SMTP id go10mr7393567pbc.16.1402705371691;
Fri, 13 Jun 2014 17:22:51 -0700 (PDT)
Return-Path: <noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com>
Received: from m10.myzamanamail.com (m10.myzamanamail.com. [192.155.80.145])
by mx.google.com with ESMTP id rd13si6293369pac.216.2014.06.13.17.22.51
for <[email protected]>;
Fri, 13 Jun 2014 17:22:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com designates 192.155.80.145 as permitted sender) client-ip=192.155.80.145;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com designates 192.155.80.145 as permitted sender) smtp.mail=noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com
To: [email protected]
From: Mom's name <[email protected]>
Reply-To: noreply+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com
Subject: =?utf-8?B?4piFIE5pcywgTGluZGEncyBGYXZvcml0ZSBQaG90b3M=?=
Date: Sat, 14 Jun 2014 00:22:51 +0000
X-LibVersion: 3.3.2
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=_swift-1367413788539b95db4e1080.38411787_=_"
Content-Transfer-Encoding: 7bit
X-Mailgun-Variables: {"email_id":"b-3424539b95db08b54849462487","hash":"879174704e403edcc51d159cfdef9361"}
List-Unsubscribe: <mailto:abuse+b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361@m10.myzamanamail.com>
Precedence: bulk
Message-ID: <20140614002251.26711.117550881.swift@hulk>
This is a message in multipart MIME format. Your mail client should not
be displaying this. Consider upgrading your mail client to view this
message correctly.
--_=_swift-1367413788539b95db4e1080.38411787_=_
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Hi there,
Nis, Follow my favorite photos on Picbum!
https://www.picbum.com/?secret=b-3424539b95db08b54849462487_879174704e403edcc51d159cfdef9361
Mom's name