Science Around Us Module 2 Matter Around Us

ws

1. 070153604
Cybersecurity for Digital Economy
Assist.Prof.Dr.NathapornUtakrit
Faculty of Information Technology and Digital Innovation
King Mongkut's University of Technology North Bangkok
[email protected]
1
Chap 13 Email Tracking and Forensics

2. 2
http://write.flossmanuals.net/thunderbird/how-email-works/
1. Mail Box
2. Local Post Office
1.1 Mail man/postman
3. Distribution Center
2.1 Mail man/postman/post truck
3.1 Mail man/postman/post truck
4. Distribution Center
4.1 Mail man/postman/post truck
5. Local Post Office
5.1 Mail
man/postman/post
truck
6. Home Delivery

3. 3

4. https://www.oasis-open.org/khelp/kmlm/user_help/html/how_email_works.html

5. 5
1. MUA (Mail User Agent)
Client application that allows receiving and sending
emails. It can be a desktop application such as Microsoft
Outlook/Thunderbird/… or web-based such as
Gmail/Hotmail/… (the latter is also called Webmail).

6. 6
2. Mail Server
A mail server (e-mail server) is a server that handles
and delivers e-mail over a network, usually over the
Internet.
A mail server can receive e-mails from client computers
and deliver them to other mail servers. A mail server can
also deliver e-mails to client computers/ mobiles.

7. 7
3. MTA (Mail Transfer Agent)
Inside the mail server there will be an application that
receives mail from the MSA, or from another MTA. It will
find (through name servers and the DNS) the MX record
from the recipient domain's DNS zone in order to know
how to transfer the mail. It then transfers the mail (with
SMTP) to another MTA (which is known as SMTP
relaying) or, if the recipient’s server has been reached,
to the MDA.
Examples of MTAs are Postfix, Exim, Sendmail, qmail,
Microsoft Exchange Server, IBM Lotus Domino,
HMailServer

8. 8
4. MDA (Mail Delivery Agent)
A server program that receives mail from the server’s
MTA, and stores it into the mailbox. MDA is also known
as LDA (Local Delivery Agent).
An example is Dovecot, which is mainly a POP3 and
IMAP server allowing an MUA to retrieve mail, but also
includes an MDA which takes mail from an MTA and
delivers it to the server’s mailbox.

9. 9
5. SMTP
Simple Mail Transfer Protocol used by MUAs to send
emails to an MSA. The recommended SMTP port for
sending mail (from an MUA to an MSA) is the port 587,
which uses TLS encryption.

10. 10

11. 11
6. Internet Message Transfer Protocol (IMAP)/
Post Office Transfer Protocol (POP3)
Protocols used by MUAs to retrieve emails from a server
mailbox. POP3 deletes the email messages from the
server after they have been downloaded. IMAP is usually
preferable as it maintains all email messages on the
server, permitting management of a mailbox by multiple
email clients.

12. 12

13. 13

14. 14
Yahoo Mail! -Use full headers to find delivery delays or a forged
email’s true address in Yahoo Mail
Gmail -Trace email with its full header
SolarwindsWorldwide

15. 15
G Suite Toolbox MessageHeader
Microsoft Message Header Analyzer
MXtoolbox
ipTrackeronline
DNSchecker
DNSStuff
EmailTrackerPro

16. 16
Whatismyip
WhoisIP Lookup
CMD command line >> nslookup

17. 17
1.Outlook:“Sender IP is …”
2.Gmail:Received-SPF: pass (google.com: domain of …
designates …IP… as permitted sender) client-ip= …IP
3.Yahoo Mail!:
X-Originating-Ip: [IP]
Received-SPF: pass (domain of yahoo.co.th
designates IP as permitted sender)
Activity 1: Check and record your email header
from the inbox and identify the sender
ISP/ Mail Server name/ host’s location

18. 18
1.Outlook:“Sender IP is …”
2.Gmail:Received-SPF: pass (google.com: domain of …
designates …IP… as permitted sender) client-ip= …IP
3.Yahoo Mail!:
X-Originating-Ip: [IP]
Received-SPF: pass (domain of yahoo.co.th
designates IP as permitted sender)
Activity 2: Use KMUTNB proxy to send whitelist
mail to yourself, record IP , identify the sender ISP
/ Mail Server name / host’s location

19. 19
1.Outlook:“Sender IP is …”
2.Gmail:Received-SPF: pass (google.com: domain of …
designates …IP… as permitted sender) client-ip= …IP
3.Yahoo Mail!:
X-Originating-Ip: [IP]
Received-SPF: pass (domain of yahoo.co.th
designates IP as permitted sender)
Activity 3: Check and record either whitelist or
blacklist email header from the inbox, identify the
sender ISP/ Mail Server name/ host’s location

20. 20
1.Outlook:“Sender IP is …”
2.Gmail:Received-SPF: pass (google.com: domain of …
designates …IP… as permitted sender) client-ip= …IP
3.Yahoo Mail!:
X-Originating-Ip: [IP]
Received-SPF: pass (domain of yahoo.co.th
designates IP as permitted sender)
Activity 4: Find a disposable or an anonymous
email and send a testing mail to your whitelist
email, check email header from the inbox, identify
the sender ISP/, ail Server name/ host’s location

21. 21

22. 22

23. 23

24. 24
Yahoo Mail! -Use full headers to find delivery delays or a forged
email’s true address in Yahoo Mail
Gmail -Trace email with its full header
Solarwinds Worldwide

25. 25
Advik Email Backup Wizard
MailXaminer Forensic Email Analysis Software
Aid4Mail Fookes Software
MxToolBox Email Software
Emailtrackerpro.com

26. 26
Whatismyip
Whois IP Lookup
CMD command line >> nslookup
CISCO Talos Lookup