Sending GMAIL via NTL - Page 2

Chrysalis · 29-04-2005, 18:27

The reason is you cannot send an email from gmail using ntlworld smtp mail server.

If you could do that then there would be all kinds of spoofing going on thats simply not how email works. You can change the reply to address(different thing) but the email will be sent from username@ntlworld.com.

The only 2 ways to send from gmail is on the web mail interface or with the gmail smtp server.

To send mail you have to authenticate to the server etc. Ntl authentication I believe is just needing the user to match to a valid ip range and be recently have logged into pop. Gmail will need a valid user/pass and of course this is authenticated on the actual gmail mail server.

29-04-2005, 18:42

So all the 'from' addresses in spam are NOT spoofed?

Chrysalis · 29-04-2005, 18:59

The spam you get is done in different methods, viagra emails etc.

Return-Path: <kvn6hb@mchsi.com>
Received: from aamta07-winn.mailhost.ntl.com ([212.250.162.8])
by mta05-winn.mailhost.ntl.com with ESMTP
id <20050425060218.DSFP29397.mta05-winn.mailhost.ntl.com@aamta07-winn.mailhost.ntl.com>
for <xxxxxx@ntlworld.com>; Mon, 25 Apr 2005 07:02:18 +0100
Received: from adsl-2-26-49.mia.bellsouth.net ([65.2.26.49])
by aamta07-winn.mailhost.ntl.com with SMTP
id <20050425060217.WVZE10174.aamta07-winn.mailhost.ntl.com@adsl-2-26-49.mia.bellsouth.net>
for <xxxxxx@ntlworld.com>; Mon, 25 Apr 2005 07:02:17 +0100
To: xxxxxx@ntlworld.com
From: "Janna Bettye" <kvn6hb@mchsi.com>
Reply-To: "Janna Bettye" <kvn6hb@mchsi.com>
Date: Mon, 25 Apr 2005 01:05:55 -0600
Subject: \/ALl1UM, AMBlEEN, \/lAGGRRA; ClAALL1S. XAANAX, ATlVAN, TRAMAD00L, ALPRAAZ0LAM being anything
Message-ID: <zt4p513wgn85l19omgfekvn6hb@mchsi.com>
MIME-Version: 1.0
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.4981.5075
Content-Type: multipart/related;
boundary="--GHOVCIGQTWL-WHWGWQRHXMAI"

The line in bold is the server that sent it, or I should say relayed it, quite often spam relays through various servers so it harder to track back to the source.

But back on topic, I think the original poster was misunderstood. I think he was sending through gmail to not use ntl mail server. I do the same I dont use ntl for any email I consider important since from my own experience I have found email to get lost and delayed, and my own email servers have spam and virus filters as well. Obviously if he then used ntl smtp server to send his mail he would be defeating the purpose of wanting to send thru his specific smtp server, and the reciever of the email would know it came from ntl which he might not want them to see.

nffc · 29-04-2005, 21:04

Quote:

Originally Posted by Chrysalis

The reason is you cannot send an email from gmail using ntlworld smtp mail server.

If you could do that then there would be all kinds of spoofing going on thats simply not how email works. You can change the reply to address(different thing) but the email will be sent from username@ntlworld.com.

The only 2 ways to send from gmail is on the web mail interface or with the gmail smtp server.

To send mail you have to authenticate to the server etc. Ntl authentication I believe is just needing the user to match to a valid ip range and be recently have logged into pop. Gmail will need a valid user/pass and of course this is authenticated on the actual gmail mail server.

Eh? My Thunderbird is set up for about 7 emails sent through 1 SMTP. This set-up works at uni (via uni's SMTP because they block access to others) and at home on ntl (all through ntl). So I kinda think I know what I'm talking about

As for SMTP you don't even need to be able to access the account you're sending from. I sent meself an email from an address I just made up on the spot and didn't own, again, via NTL SMTP, not using an ntl address at either end... and guess what, it worked. [Didn't bother replying though.] This is how email addresses are spoofed

And while I'm at it I may as well go for the hat-trick. To use NTL's SMTP, all you need to be is on the NTL network. You can send addresses from any account via SMTP because it needs naff-all authentication, not even a user name and password in some cases, in the cases it does, it doesn't suddenly divert it as though it's sent from that address. Trust me, I've done it.

3-0, nffc walks off with the match ball. Forest win for a change

Chrysalis · 29-04-2005, 21:21

What you are doing is actually just sending them all through your uni account using a different reply to address.

In case of authentication, you will find most isps only dont use user/pass auth because they instead restrict via ip ranges, when using 3rd party smtp you will need authentication.

I just sent my self an email from my ntl smtp server, I tried to change the email address in the account otions in outlook but it got rejected by the smtp server, so I then just changed the from field which I have been trying to explain throughout this thread and it worked. Here is the headers.

Return-path: <realuser@ntlworld.com>
Envelope-to: chrysalis@chrysalisnet.org
Delivery-date: Fri, 29 Apr 2005 20:19:15 +0000
Received: from mail by web1.hostingfreak.net with spam-scanned (Exim 4.50)
id 1DRbx2-000Ozg-Kj
for chrysalis@chrysalisnet.org; Fri, 29 Apr 2005 20:19:15 +0000
Received: from smtpout17.mailhost.ntl.com ([212.250.162.17] helo=mta09-winn.mailhost.ntl.com)
by web1.hostingfreak.net with esmtp (Exim 4.50)
id 1DRbx2-000Ozd-Hj
for chrysalis@chrysalisnet.org; Fri, 29 Apr 2005 20:19:04 +0000
Received: from aamta06-winn.mailhost.ntl.com ([212.250.162.8])
by mta09-winn.mailhost.ntl.com with ESMTP
id <20050429201859.JHQA28254.mta09-winn.mailhost.ntl.com@aamta06-winn.mailhost.ntl.com>
for <chrysalis@chrysalisnet.org>; Fri, 29 Apr 2005 21:18:59 +0100
Received: from homeamd2200 ([82.21.26.x])
by aamta06-winn.mailhost.ntl.com with ESMTP
id <20050429201859.SILX5678.aamta06-winn.mailhost.ntl.com@homeamd2200>
for <chrysalis@chrysalisnet.org>; Fri, 29 Apr 2005 21:18:59 +0100
From: <spoofed@ntlworld.com>
Sender: "Chris" <realaddress@ntlworld.com>
To: <chrysalis@chrysalisnet.org>
Subject: 111
Date: Fri, 29 Apr 2005 21:27:49 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_001D_01C54D02.4C47E2A0"
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Thread-Index: AcVM+ebrZwsJkCIXSEu1/sTiHn2f2Q==
X-MS-TNEF-Correlator: 0000000074FC67B5865BC244AE0A93B4F54BA94224EC2200
Message-Id: <20050429201859.SILX5678.aamta06-winn.mailhost.ntl.com@homeamd2200>
X-Antivirus-Scanner: Scanned with Exiscan. You should still use an antivirus.
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
web1.hostingfreak.net
X-Spam-Level:
X-Spam-Status: No, score=0.2 required=5.0 tests=NO_REAL_NAME autolearn=no
version=3.0.2

Try sending me an email from your ntl account and spoof it, I will reply to your actual ntl account.

nffc · 29-04-2005, 21:27

Ich don't think so... I've filtered some of the more, shall we say, identifiable info...

From - Fri Apr 29 21:26:17 2005
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from server
([other ip])
by sdf; Fri, 29 Apr 2005 21:25:37 +0100
Received: from asd ([ip] helo=[127.0.0.1])
by dsf with esmtp (Exim 3.36 #2)
id 1DRc3D-00052f-00
for dgdf; Fri, 29 Apr 2005 21:25:27 +0100
Message-ID: <4272984C.8090207@domain>
Disposition-Notification-To: email
Date: Fri, 29 Apr 2005 21:25:48 +0100
From: me
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: <mail>
Subject: Re: woot
References: <4272980E.9030804@domain>
In-Reply-To: <4272980E.9030804@domain>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 0517-5, 29/04/2005), Outbound message
X-Antivirus-Status: Clean
X-MailScanner-Information: Please contact x@y.com for more information
X-MailScanner: Found to be clean No hint of changing any reply-tos there. I rest my case.

Chrysalis · 29-04-2005, 23:25

Still waiting an email from you to chrysalis@chrysalisnet.org

on your ntl account.

the headers you posted look incomplete to me. Was that from your uni or ntl?

To repeat I tried this test a few more times, ntl's smtp server rejects me sending if I change my email address in the outlook properties, I can only change the [from] (reply to) address.

nffc · 30-04-2005, 00:49

Quote:

Originally Posted by Chrysalis

Still waiting an email from you to chrysalis@chrysalisnet.org

on your ntl account.

the headers you posted look incomplete to me. Was that from your uni or ntl?

To repeat I tried this test a few more times, ntl's smtp server rejects me sending if I change my email address in the outlook properties, I can only change the [from] (reply to) address.

Not gonna email... and it was from uni. I don't have an ntl email.

I've fabricated addresses and sent messages via ntl smtp before though.

They may have changed it

30-04-2005, 08:41

Quote:

Originally Posted by Chrysalis

Try sending me an email from your ntl account and spoof it, I will reply to your actual ntl account.

Tried it, out of interest. Awaiting reply.

obvious · 30-04-2005, 10:21

Quote:

Originally Posted by Chrysalis

Still waiting an email from you to chrysalis@chrysalisnet.org

on your ntl account.

the headers you posted look incomplete to me. Was that from your uni or ntl?

To repeat I tried this test a few more times, ntl's smtp server rejects me sending if I change my email address in the outlook properties, I can only change the [from] (reply to) address.

Code:

telnet smtp.ntlworld.com 25
helo it's me
250 aamta03-winn.mailhost.ntl.com
mail from:spoof@spoof.net
250 Sender <spoof"@spoof.net> Ok
rcpt to:chrysalis@chrysalisnet.org
250 Recipient <chrysalis@chrysalisnet.org> Ok
data
354 Ok Send data ending with <CRLF>.<CRLF>
test spoof message really from
??
.
quit

simbr · 30-04-2005, 14:56

Quote:

Originally Posted by nffc

BS.

I could swear the last time I checked the server was only allowing ntlworld.com sending addresses. It is still blocking null or invalid format email addresses (which causes problems with read receipts in outlook) and non-existant ntlworld.com addresses.

test1:
220 ESMTP server ready
helo
250 aamta01-winn.mailhost.ntl.com
mail from:<postmaster@ntlworld.com>
250 Sender <postmaster@ntlworld.com> Ok
rcpt to:<test@test.com>
250 Recipient <test@test.com> Ok

test2:
220 ESMTP server ready
helo
250 aamta08-winn.mailhost.ntl.com
mail from:<test@gmail.com>
250 Sender <test@gmail.com> Ok
rcpt to:<test@test.com>
250 Recipient <test@test.com> Ok

test3:
220 ESMTP server ready
helo
250 aamta01-winn.mailhost.ntl.com
mail from:<madeupaddress554@ntlworld.com>
250 Sender <madeupaddress554@ntlworld.com> Ok
rcpt to:<test@test.com>
550 you are not allowed to send mail to <test@test.com>

test4:
220 ESMTP server ready
helo
250 aamta08-winn.mailhost.ntl.com
mail from:<postmaster@ntlworld.com>
250 Sender <postmaster@ntlworld.com> Ok
rcpt to:<madeupaddress544@ntlworld.com>
550 Invalid recipient: <madeupaddress544@ntlworld.com>

test5:
220 ESMTP server ready
helo
250 aamta04-winn.mailhost.ntl.com
mail from:<>
250 Sender <> Ok
rcpt to:<test@test.com>
550 relaying mail to test.com is not allowed

test6:
220 ESMTP server ready
helo
250 aamta08-winn.mailhost.ntl.com
mail from:<test>
250 Sender <test> Ok
rcpt to:<test@test.com>
550 you are not allowed to send mail to <test@test.com>

**Paul** · 30-04-2005, 15:26

Quote:

Originally Posted by simbr

It is still blocking null or invalid format email addresses (which causes problems with read receipts in outlook) and non-existant ntlworld.com addresses.

Yep, invalid format addresses will be rejected by most smtp servers, however, the additional check [only] if you use an @ntlworld.com addresses in the from address seems to be an extra check added in the last few months.

Chrysalis · 01-05-2005, 01:12

I got an email from a ntl address but some non standard method must have been used since the from address is Return-path: <", From: ".

In normal circumstances you will not be able to spoof your from path, although I think there was a misunderstanding in this whole discussion. Yes you can post from ntl smtp and make the reply goto gmail.

--edit--

I see its from obvious

01-05-2005, 08:45

No reply to email from 'Tester'[test.com] yet....

Chrysalis · 02-05-2005, 16:08

yeah you wont get one, as I couldnt find it.

NTL email servers to be honest are setup quite poorly not needing authentication, and I am shocked you was able to do a full spoof like that.