Subject: [Asrg] Replay attack

From: Franck Martin <[email-masked]>
Date: Wed, 14 Jan 2009 13:05:35 +1200 (FJT)

Hi all, 

I received an error report that an email could not be delivered to [email-masked]. The email that was tried to be sent is below. 

What is interesting, the email seems to be geniune enough, with a DKIM and DomainKey signature. 

1) Do anyone knows where on the web I could paste this email and verify the DKIM ? A kind of web form. 
2) The return-path has been forged and it seems to me they proceeded this way, generate a legitimate DKIM signed email on legitimate MTA, strip a few headers and mass-mail directly to everyone? RCPT TO does not have to match the TO in the header. What gives me a hint is that the received headers do not follow each others. Any tips, info to prevents such problems? Or by doing only a DKIM verification, this would tell me this message is forged? 

Here are only the headers of the email I received in a NDR. 
------------------------------- 
Return-path: <[email-masked]> 
Received: from broadband-77-37-184-167.nationalcablenetworks.ru ([77.37.184.167] helo=list.mediresource.com) 
by direct.va.ru with smtp (Exim 4.53) 
id 1LMsMZ-0003zp-62 
for [email-masked]; Wed, 14 Jan 2009 02:07:59 +0300 
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws; 
s=v1; d=rodale.delivery.net; 
h=DKIM-Signature:Received:Date:From:Reply-to:To:Message-ID:Subject:Errors-to:MIME-Version:Content-Type:X-eid:X-pid; 
b=KxLNSrM9OzjsF/CMM45qFlc0DKKuizMQ2qWRehZCpFy02QKiFV77rJnRdPOL05om 
cV0wWuLpX1/TssBxGG61McgmU7b5wRtM3XUlZ0ox33uNNiFkl58VgHIIVXNDDwjc 
SltQL4r5m5CFxLxC5ifJyVJYw2s12bMZc62AVktX7V4= 
DKIM-Signature: v=1; a=rsa-sha1; d=rodale.delivery.net; s=v1; c=simple/simple; 
q=dns/txt; i=@rodale.delivery.net; t=1231488648; 
h=From; 
bh=F6VyhuMIBItRiT4Rd3AjarPIreY=; 
b=jU/ncyJ4g53pvr2on0cSjHW0pxtZqApuauJuTV9XlPVJXFY2vvS4zzs5eiJqpZ2i 
j56GjtfxU1pWScXrwstgIwm1vb4SxvpN2qhf4uMxeGpsZM3Z5lD9j9GuEMAUME+R 
oiXm9l4kbSw2zIJ7NP65e9dErI20MZRscu6F6u20dx8=; 
Received: from [192.168.138.141] ([192.168.138.141:53703] helo=fc14a2.dc1.prod) 
by oms2.dc1.prod (envelope-from <[email-masked]>) 
(ecelerity 2.2.2.36 r(26875/27517M)) with ESMTP 
id EF/26-77607-64778138; Wed, 14 Jan 2009 02:05:15 +0300 
From: Men's Health <[email-masked]> 
Reply-to: [email-masked] 
To: [email-masked] 
Message-ID: <[email-masked]> 
Subject: RE: Bigger snake for few days n few bucks 
Errors-to: [email-masked] 
MIME-Version: 1.0 
Content-Type: text/html; charset=UTF-8 
Content-Transfer-Encoding: 7bit 
X-eid: 2.5.3K5.2hv.12hk7c.CdQNXI..N..1TKO.CTbQEQf0 
X-pid: 962 

_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 13 Jan 2009 20:46:39 -0500

Franck Martin wrote:
> Hi all,
> 
> I received an error report that an email could not be delivered to
> [email-masked]. The email that was tried to be sent is below.
> 

It won't verify, because it's signing the To, I have a copy with a
different To, with the same signature.

There's at least one BOT going around inserting fixed DKIM signatures.

> 	for [email-masked]; Wed, 14 Jan 2009 02:07:59 +0300

It came from the above IP.  The rest is fakery.  I have quite a number
of these with radically different peer addresses.

Eg:

Received: from dsl15-117.express.oricom.ca (HELO list.mediresource.com)
(64.18.184.117)
    by ertps004.nortel.com (qpsmtpd/0.43rc1) with SMTP; Tue, 13 Jan 2009
20:41:0
1 -0500

---

From: Rich Kulawiec <[email-masked]>
Date: Tue, 13 Jan 2009 21:30:13 -0500

> different To, with the same signature.

Yep, same here.  My copy appears to have been deliberately backscattered
of an Exchange server (dsmail01.deansteel.com) -- unless, of course,
that server's been botted, in which case no backscatter necessary.
Most interesting; do either of you think this is a test run for
something more subtle?

---Rsk

---

From: Steve Atkins <[email-masked]>
Date: Tue, 13 Jan 2009 18:32:11 -0800

> Most interesting; do either of you think this is a test run for

More likely accidental. Creating boilerplates for spamware
by copying headers from a random legitimate message is
nothing new (e.g. TheBat).

Cheers,
   Steve

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 13 Jan 2009 22:04:18 -0500

> nothing new (e.g. TheBat).

I would suggest that this tidbit doesn't get spread beyond your own
filters: they _all_ HELO as list.mediresource.com...

[We've seen over 12,000 different IPs doing it in the past hour or
three.  This must be a "newish" template writer.  More likely never knew
that such a blatant giveaway would do him harm, as opposed to
forgetting.  This will probably be short-lived. But you never know -
I've seen a giveaway like this last for over a year.]

It's entirely normal for bot writers to build templates off of email
samples they've acquired.  In this particular case, it might even be
possible to track it back to _who_ actually had the email.

However, as this is the second instance of this (another set of DKIM
forgeries appeared about a week ago) I suspect one particular spammer
_thinks_ the DKIM signatures will improve his deliverability.  Whether
he understands that it won't verify OR he presumes (and he may be right)
that just mentioning DKIM in the headers might actually work more often
than not, I'm not going to guess.