Email spoofing is a threat that involves sending email messages with a fake sender address. Email protocols cannot, on their own, authenticate the source of an email. Therefore, it is relatively easy for a spammer or other malicious actors to change the metadata of an email.

Ever received an email from…. Donal Trump or Christiano Ronaldo or Tom Cruise or some famous personality like that? Well, if you did receive such email, then its probably not from the person you think it can from. I’m not trying to offend you but common how Donald Trump doesn’t even know that you and me even exist. I’m from India BTW.

So obviously the email is not from Donal Trump, it is from a fake sender like a spammer or your friend whose only job is to try to fool you in some or the other way.Anyways but how did the fake sender send the email from Donald Trump? OMG did he hack Donald trump’s Email? OF COURSE NOT.

What he did is just modify the email header, and replaced his email address with Donald Trumps email address. Well, I’ll explain. Firstly, we call this Email Forging or Email Spoofing where a person can pretend to be some other person and send you an email. In simple words, a spammer can you send you an email from your friend’s email address and all this without gaining access to your friends email account. Let me explain how the spammer does this.

Email works on SMTP which stands from Simple Mail Transfer Protocol. Let’s learn how the SMTP works.

When you are writing an email, you put in the subject, the message, any attachments and the recipIent’s mail ID. BTW, A recipIent is the one who you want to send the email.
Once you click on send, the client which in my case is GMAIL is going to forward this email to the smtp server of Gmail. And obviously the email that you are sending needs to be converted to a particular format so that the SMTP server can understand where to forward this email.
So the email is converted into a header which looks something like this. Once the SMTP server receives the email header, it forwards this header to the respective SMTP server of the receiver. For example if the receiver’s email ID is a hotmail ID, then the SMTP server of gmail is going to forward this header to the smtp server of hotmail. Once the header is received by the receiver’s SMTP server, It is again forwarded to the POP3 server of the receiver. POP3 stands for Post Office Protocol and 3 here is the version number. POP3 servers receive emails from the SMTP servers and store them until needed.

So when the receiver opens his email client, ie., when he opens his hotmail account, his client is going to pull all the unread emails from the POP3 server. And if you can remember, the email that we sent has reached the POP3 server of the receiver and is stored there. So, the receiver will now retrieve the email that we sent.

So this is how email works in a nutshell.

But, if you can look closely here at the Email header you can notice that there is no authenticity. Which means there is no factor to ensure that the email is coming from a valid sender.
You can see that there is a from: line which holds the email ID of the sender. We can simply replace this From: line and insert any email ID we wish. And as I said earlier there is no factor to ensure that the email is truly coming from that particular sender. Like, for example if at all the email header also consist the password of the sender, then we can be sure that the sender is actually the sender if the password is correct, but if the password is included in the header, then the receiver will also get to know the password of the sender by just looking at the email header. SO obviously we cannot include the password in the email header.

So, this means that anyone can simply tamper the email header and insert any email address in the From: line. And thus, they can pretend to be someone else.

Obviously, this is a big threat because SMTP lacks authenticity.

So, some extra security standards are added. The From field of the Email is now digitally signed and this digital signature is added to the email header when the email is sent from the sender’s side. When received by the receiver, if the digital signature is valid, it means that no data inside the email header is tampered and hence the email is authentic and the sender is really the sender. If the digital signature is not valid, then the email ends up in your spam folder. This is known as DKIM. DKIM uses cryptographic functions to achieve this authenticity. We will learn about these cryptographic functions in some other video.


Follow us for more awesome content 👇👇👇

SUBSCRIBE: [ Ссылка ]
Facebook: [ Ссылка ]
Instagram: [ Ссылка ]
TikTok: [ Ссылка ]

свернуть