Person X has a high speed cable ISP. IP address of X's home PC on Jan
1 , 2005 is 11.22.33.44 (automatically obtained from ISP). X has
access to his company email by using Outlook web access from home PC.
The company's mail server is hosted by an ASP Y. Can the following be
achieved? Can ASP Y server logs show that an email was sent from a
user Y (who works in the same company as X) from 11.22.33.44?
Basically is it possible that someone can set up X in this way for
some malicious deeds? If yes, how? |
Clarification of Question by
nick1971-ga
on
14 May 2005 20:05 PDT
Amended question:
Person X has a high speed cable ISP. IP address of X's home PC on Jan
1 , 2005 is 11.22.33.44 (automatically obtained from ISP). X has
access to his company email by using Outlook web access from home PC.
The company's mail server is hosted by an ASP Y. Can the following be
achieved? Can ASP Y server logs show that an email was sent from a
user Z (who works in the same company as X) from 11.22.33.44?
Basically is it possible that someone can set up X in this way for
some malicious deeds? If yes, how? Please answer for two circumstances
- a) Z's password is compromised b_ Z's password is not compromised.
|
Request for Question Clarification by
sublime1-ga
on
14 May 2005 22:39 PDT
nick...
The discussion by galaxyhead-ga is pertinent if your premise
is that someone is able to access X's home machine, but it's
not clear to me if that's what you mean, or if you're asking
if Z can create an email from their common worksite which
would show up in the ASP Y logs as having been originated from
X's ISP address. This latter possibility is very unlikely, as
spoofed headers can be detected fairly easily.
|
Clarification of Question by
nick1971-ga
on
15 May 2005 06:26 PDT
Clarification:
1. Not sure if X's home machine is accessible - X has an open wireless
LAN set up at home. Could someone hijack his PC and do this from X's
PC at home?
2. Can Z or anyone else create an email from their common worksite (or
even anywhere in the world) which
would show up in the ASP Y logs as having been originated from
X's ISP address?
The thing is: X has been set up by someone - I need to figure out how
this was achieved. It is not important to determine who did it - but
if I can - that's would be awesome.
|
Request for Question Clarification by
sublime1-ga
on
15 May 2005 13:00 PDT
nick...
If you have access to a copy of the implicating email,
you can use the information in the following article to
analyze the headers and find out more about its origins:
http://www.usus.org/elements/tracing.htm
If you have access to the server logs, it would certainly
help to clarify things as well. While it might be possible
to create a spoofed email at the common worksite that would
appear, at first glance, to have been sent from X's home PC,
the analysis above would quickly detect this, and the server
logs should only confirm the spoof.
As for hijacking the home PC, certainly it's possible that
someone broke into the home. Most people have much less
security than they think. And it's theoretically possible
for someone to access the internet through an open wireless
LAN, but to access X's computer via that route, if it's
possible, would be the work of a professional hacker vs
the typical skills of an office co-worker. A lot would
depend on the level of security on that PC, such as the
existence of a firewall. I don't see where we can do
anything but speculate, in this regard.
sublime1-ga
|
