Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 45 guests and 3 members online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Can the emails be tracked this way?
EH-Net
May 23, 2013, 12:50:26 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Can the emails be tracked this way?  (Read 11657 times)
0 Members and 1 Guest are viewing this topic.
ghosttrial
Newbie
*
Offline Offline

Posts: 4


View Profile
« on: September 17, 2009, 01:28:33 PM »

hello everyone, first i'm a noob here so correct me if I wrong and if I post this topic in wrong place correct it for me too Cheesy. I assumed that an email can be easily tracked down to find the computer that download it from the internet ( the way i see in film, novel etc). So I decide to play a small game with my friends (they are IT expert) to see if they can tracked down my computer by email (if you don't believe think whatever you want lol).
First I setup an email account that support POP3 service. Then I setup second email account that support download email from other POP3 email account (and let it download my mail here ofcourse). Now in the second account, I let it automatic forward all email to 3rd email account where I download email from to my computer (Gmail can do it if anyone have question).
Now can my friends track down my computer by sending me email to the first account? If he/she still can, how much does it cost he/she (time and event money) ?
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #1 on: September 17, 2009, 02:59:38 PM »

Welcome to the community.   

When you send an email message, it will likely travel through a server or two before it get to the recipient.   As the email goes from sender to server(s) to recipients, the header of the email gets updated with information containing dates, times, server addresses, etc.  Some email clients will track the user's computer that sent the email, some will not.  There is no standard.    Using this information, assuming the email headers were not forged, one can track who (IP Address) sent the email, what time it was sent, etc.   An IP address can be correlated to a physical address using information the ISP can provide.

Your question asks the reverse.  How can someone track you by sending you an email?   If you reply to the email address, your IP address is likely going to be in the header.   If you don't reply, there are tricks one can use to get your IP address.  For example, someone can send you an HTML email with a link to an image.   Once your email client views that image, the web server hosting the image will track it and record your IP address.   This can be further expanded by a simple PHP script that tracks quite a bit of information about your computer, much more than an IP address.   There are a few other ways, such as read and delivery receipts,  various online services, simple trojans, etc. 

I hope this answers your question.
Logged

~~~~~~~~~~~~~~
Ketchup
nebu10uz
Sr. Member
****
Offline Offline

Posts: 368



View Profile WWW
« Reply #2 on: September 17, 2009, 04:07:40 PM »


Example of an online email tracking service:

http://www.whoreadme.com/

Quote
You may send 5 free tracked emails per day to with up to 30 recipients for each.
Logged

Security+, OSCP, CEH
ghosttrial
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #3 on: September 18, 2009, 02:42:03 AM »

Thanks for your time Ketchup and blackazarro.
So, as I understand, the way I setup the first and second email as a ghost address to receive email for me didn't effect the way my friend will try to track me down right? That is so disappoint lol. Well I guest I need to read more and try to find another way to have fun Cheesy
Logged
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #4 on: September 18, 2009, 07:29:43 AM »

Ghost, unless one of those email services has some sort of anonyminity services, I don' think it will do much.   I believe that GMail will not record the sender's computer's IP address in the header, but I don't have an account to test this.   There are anonymity services that will help with what you are trying to accomplish.  I also would disable any sort of Rich Text / HTML in your email client and review all email in Plain Text.  This will minimize your exposure. 
Logged

~~~~~~~~~~~~~~
Ketchup
SynJunkie
Jr. Member
**
Offline Offline

Posts: 71


View Profile WWW
« Reply #5 on: September 19, 2009, 04:55:29 AM »

Hi Ghost

Not sure if your interested but I wrote a blog post on information disclosure in email headers a while back.  It only scratches the surface but it might be of interest to you still.

http://synjunkie.blogspot.com/2007/10/information-disclosure-from-email.html

Cheers

Syn
Logged

----------------------------------
http://synjunkie.blogspot.com
ghosttrial
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #6 on: September 21, 2009, 05:46:47 AM »

Thank you.
@Ketchup: I hope Gmail doesn't record my IP ether, but I rarely reply or send email, beside my IP is dynamic IP (I reset my modem once for a while) so hopefully it work. But one thing I forgot and you remind me is to read email in plain text Tongue. I used to read email like this but after reinstall my OS several time (Windows) I forgot about it.
@Synjunkie: I know a little about the header but not that much because in the past, I don't know if I messed up with yahoo web base client or it change that way but there was a time all my incoming email in Yahoo show all the header in web base client (not now). But ofcourse I didn't understand anything at all (that time I was a newbie to internet). Now thank to you I know a lot about this Cheesy
Logged
ghosttrial
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #7 on: September 21, 2009, 05:48:12 AM »

Sorry for my bad English grammar, hope it's still understandable
Logged
SynJunkie
Jr. Member
**
Offline Offline

Posts: 71


View Profile WWW
« Reply #8 on: September 21, 2009, 07:03:50 AM »

makes perfect sense.  Glad the blog post was useful.

Cheers

Syn
Logged

----------------------------------
http://synjunkie.blogspot.com
nebu10uz
Sr. Member
****
Offline Offline

Posts: 368



View Profile WWW
« Reply #9 on: September 21, 2009, 11:59:51 AM »

ghosttrial, here's a link of a Windows app that extracts IP addresses from the email header:

IPNetInfo v1.19

Enjoy!
Logged

Security+, OSCP, CEH
petergibons
Newbie
*
Offline Offline

Posts: 2


View Profile
« Reply #10 on: October 21, 2009, 09:56:36 AM »

A few years ago we used email tracker Pro. At the time they offered a trail version. Aside from any program, keep in mind there's ways to spoof headers an ips.

Regards,

Peter
Logged
binary
Newbie
*
Offline Offline

Posts: 5


View Profile
« Reply #11 on: October 26, 2009, 02:11:07 AM »

ghost, if you are looking to hide yourself Wink then remailers may be is what you are searching, did you try that out.. I believe it's pretty hard to track the source

Regards,
binary
« Last Edit: October 26, 2009, 02:13:03 AM by binary » Logged
sgt_mjc
Sr. Member
****
Offline Offline

Posts: 294


View Profile
« Reply #12 on: October 29, 2009, 08:59:38 AM »

You can also check out readnotify.  Your friends could use a service like this to track where the email goes.

http://readnotify.com/

Logged

Mike Conway
CISSP
CompTia Security +
C|EH
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.081 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.