8 replies to this topic

[ph0b1a]

hey guys i was bord a couple of nights ago and i had an idea while watching a movie on netflix, phishing emails have become a bit of a normal thing, but alot of them are either traceable to an account or they are just thrown into the spam folder of the victim, anyway i thought about sending the phishing emails via telnet, smtp servers, if said person was to run a trace on the phishing email all they would get is the address of the smtp server that we telnet'd in to and if the email was send using the same smtp server as the victim then it would not be thrown into the spam folder and there would be a higher chance of the email actually being opened. this is just an idea but i would love to here any feedback on the idea.

Edited by ph0b1a, 19 May 2011 - 01:50 AM.

[nyphonejacks]

hey guys i was bord a couple of nights ago and i had an idea while watching a movie on netflix, phishing emails have become a bit of a normal thing, but alot of them are either traceable to an account or they are just thrown into the spam folder of the victim, anyway i thought about sending the phishing emails via telnet, smtp servers, if said person was to run a trace on the phishing email all they would get is the address of the smtp server that we telnet'd in to and if the email was send using the same smtp server as the victim then it would not be thrown into the spam folder and there would be a higher chance of the email actually being opened. this is just an idea but i would love to here any feedback on the idea.

i hate spammers

[sarcasm]
EDIT - thank you for the minus rep.. this post really deserved that.
[/sarcasm]

Edited by nyphonejacks, 08 July 2011 - 03:54 PM.

[ph0b1a]

as do i but im not talking about spamming, im talking about using it for phishing and SE to get access to someones accounts

[nyphonejacks]

oh you mean topics that are not discussed on this board?

[TheIllusiveMan]

Phishing is just a media buzzword. And only a complete idiot would bother.

You can steal someone's identity with nothing but a web browser.

I'd perform SQL injection on a completely random site. Then check if the password for their account is also used for things like their email. Once that's logged into I can almost deal with everything directly.... even update their facebook status to "going on a shoping spree".

[impulse_87]

Phishing is just a media buzzword. And only a complete idiot would bother.

You can steal someone's identity with nothing but a web browser.

I'd perform SQL injection on a completely random site. Then check if the password for their account is also used for things like their email. Once that's logged into I can almost deal with everything directly.... even update their facebook status to "going on a shoping spree".

i agree SQL is alot better but phobias idea isnt a bad one

[woodys_world69]

Most ISP's SMTP server has authentication turned on for an IP address outside of there range

[serrath]

Most ISP's SMTP server has authentication turned on for an IP address outside of there range

Sounds like this hypothetical plan just got fun.

[phaedrus]

Completely untraceable. Unless they log incoming connections to port 25, and then slurps the logs off to a central logging store where its slurped off via snmp traps for attacks by the ids in real time and kept on backup disks for a year or however long legal says is needed. Which almost everybody does. Please don't rely on this as your way to stay invisible unless you like getting in legal trouble.

Plus the days of open mail server relays allowing this ended about 10 years ago, as above.
You could spoof it, but then you run into problems if the admin is awake at the keyboard. Usually the filter box is a couple of relays in, and looks at the originating headers to check its taken the path it should before scoring.
Throw in SPF and a load of other tools to stop spam, and it becomes a awkward difficult exercise. Mail server admins usually really have seen it all over the past few years of the spam deluge...

I think your aiming for what the media are calling spearphising, in which I would install spamassasin etc, and work out a mail which doesnt score highly but lets you send a link to a webserver via email with your payload to download instead. Like the bottom feeding spammers...