Spinal
MB Enthusiast
- Joined
- Sep 14, 2004
- Messages
- 4,806
- Location
- between Uxbridge and the Alps
- Car
- x254, G350, Duster, S320, Mach1, 900ss and a few more
Yes and no... you're reducing the value of each email as there won't be a list of email addresses to be harvested. That said, if your contacts which you just emailed then forward your email to 10x people (without ammending the body to remove your address and so on), your email address will be included and thus be on a list somewhere.
As above; that said - you need to get to a limit. Too much paranoia and you wont leave the house!
Spoofing from addresses is almost as old as emails - it's spoofing addresses that are "trusted" from the recipients, and harvesting that level of detail that is very new. RBN are VERY organised and well funded, Viagra is just one of their exploits. We've seen (many) actual attacks on client infrastructure from who we believe is RBN. IN cases when they get in, they will tend to either steal data and offer not to spread it to the world for a fee; or encrypt data and offer to decrypt ti for a fee.
Forwarding to a "criminal" is easier than you think. Put it this way; you forward your letter to 20 people, that's 21 people who have seen it and 21 email addresses. Those 20 each do the same, so now we are at 421 (400 new). That's 2 forwards. again and it's 8,000 new people. Then 160,000. Then about 8 million, 64 million, 1.2billion, 24 billion new addresses -oops we are out of people on the planet. (yes, people have multiple accounts and so on, but it's exponential so you get the idea). All within 10 forwards of your original email. At some point, someone willing to make a quick buck will take the email, strip out the email addresses and sell them (they usually go for about $5 for 1mb of email addresses, more for valid email addresses with a referrer). Obviously this can be scripted so you don't need to do anything.
Another source is sniffing - email is NOT a confidential protocol. Everythign is sent in clear-text. This means that if I set up a mail relay, I can read all the emails that flow through my box. Or if I sniff all traffic on a backbone (RBN and Chinese are the only two organisations with the infrastructure to do this at a global level, that I know of, at the moment) and pull out what I need. Generally, when speaking, to larger clients, their comeback is "oh, but it's all fragmented into packets. So the chance that all packets travel through the same place is very low". Which is true- but I don't NEED the whole email. I just need the email addresses, which I can grab from individual packets without recompiling your original email.
CC vs BCC - very right.
Mail server could have been hacked, or, more likely, you had a server that allowed unauthenticated sending of emails. Most mail servers from that era wont request credentials to send emails - it was a trust-based infrastructure.
Email was never designed to be "secure". Authentication, authorization and encryption are all "add ons"
M.
(and if you want to hire me, drop me a pm - I do security consultancy. Used to work for the worlds largest Security firm, and we did an MBO of their consulting team
)
