Questions tagged [spoofing]
Spoofing is an activity when a person or program try to impersonates itself as another.
126
questions
1
vote
2
answers
10k
views
Exchange 2010 email spoofing prevention
Masters,
Unfortunately we got some spam mail which seems to be coming from our own domain.
I found some article which all says to remove Anonymous login from internet receive connector
(http://...
CommunityBot
- 1
3
votes
2
answers
3k
views
Stop spoof emails in Google Apps
Desperately need some help here. I've been using Google Apps for my domain (2qubed.co.uk) for over 2 years now with no problems at all until recently.
For the past few months I have been getting lots ...
- 723
0
votes
1
answer
1k
views
fatal error in master.cf when restart postfix
I follow a guide to prevent spoofed emails in my mail server
first I installed postfix-policyd-spf-perl
apt-get install postfix-policyd-spf-perl
second I added this lines to the ...
- 189
-1
votes
1
answer
657
views
How to prevent an openly recursive DNS server from being abused for DNS amplification [closed]
I have a business need to provide an open and recursive DNS. This DNS has of course been heavily abused by DNS amplification attacks, resulting in 5-10 Mbps sustained outbound load only caused by ...
- 33.1k
5
votes
4
answers
2k
views
MAC address spoofing - why doesn't this work? [closed]
So I'm in a new job, and they're pretty draconian about their network, hardware, and OS security. :-( I'm a web developer, but am forced to use IE7 for development simply because they don't want ...
CommunityBot
- 1
1
vote
1
answer
1k
views
Practical way to implement prevention of IP Spoofing
I am an undergraduate Computer Science student and was hoping to gain some knowledge of ways to help prevent IP spoofing but all the resources I have tried out elaborate this concept in a theoretical ...
CommunityBot
- 1
0
votes
2
answers
715
views
Change the domain in the 'via' that Gmail shows as the result of a wrong SPF record
So I have a small Linux webserver, it is running the Direct Admin control panel and everything is working fine. For each domain, SPF and DKIM records are present in the DNS and mail is (as far as I ...
- 101
-3
votes
1
answer
363
views
TLS auth issue: '[email protected] "via" SendGrid.me' email is dropped by Exchange [closed]
Looking for clarification about what this Exchange 2007 Management Shell (Powershell) command does and how it affects TLS at the Receive Connector: ms-exch-smtp-accept-authoritative-domain-sender
...
- 294
1
vote
1
answer
1k
views
ARP spoofing on switch across subnets
Consider a switch without any VLAN's defined with 2 subnets configured. Is it possible to ARP spoof from one subnet to another?
According to Evans reply in What are the implications of having two ...
CommunityBot
- 1
0
votes
0
answers
801
views
Exchange 2013 -Prevent Spam emails from outside but with my internal domain name
my apologies if this question was asked and answered previously.
we have Exchange 2013 email server. We have been seeing some of the emails are coming from outside but using our own domain name which ...
CommunityBot
- 1
5
votes
1
answer
18k
views
How can I prevent spoofed emails from outside thats using my internal accepted domain
I'm receiving spam emails sent from my own domain to my own domain. I'm using Exchange 2013.
Example:
[email protected] is being used to send spam to [email protected].
I can successfully ...
- 41
2
votes
1
answer
3k
views
Checking SMTP headers for spoofed email (did client authenticate?)
I have been using rackspace email service, and I am finding that rogue emails are seemingly coming from [email protected] to [email protected] but were never actually sent by that user.
As per ...
- 541
3
votes
1
answer
2k
views
"From:" e-mail header spoofing - how to verify such mail?
I'm facing a problem of verifying a "From:" message field in e-mail messages, in terms of e-mail spoofing. I am currently using SPF and DKIM to verify the origin and integrity of messages, but as far ...
- 134k
0
votes
3
answers
4k
views
Exchange and SPF Records
I've created an SPF record on 123-Reg, which is working great. But my question is how Exchange servers know that an SPF record exists when they receive mail from a domain. How does Exchange know it ...
- 149
3
votes
1
answer
1k
views
Exchange not checking SPF record for own domain
I have an interesting issue with Exchange where it appears to check and stamp spoofed messages from external domains but not ones it has setup to send from. For example I can spoof a message from 1@...
- 53
0
votes
1
answer
705
views
Spoofing a duplicate MAC address on an interface not connecting to the network where the original MAC is
I'm trying to run a PHP project on a test server.
The project uses an internal framework that has been modified so it will only run on the production server by checking the MAC address in eth0, and ...
1
vote
1
answer
151
views
Using SPF for spoof protection
I'm trying to work through properly configuring SPF for my domain. We have two MX servers that only receive mail, and two outbound relay servers which we expect to list in our SPF record.
We also ...
- 18.4k
0
votes
1
answer
2k
views
What will happen in a network if multiple devices have the same MAC address? [closed]
What will happen in something like a wifi connection where different laptops are set with the same MAC address .
To make it more interesting what will happen if there are multiple devices with same ...
- 141
1
vote
0
answers
114
views
How can I reject mails coming from a fake domain or a fake user in a real domain?
I have an exchange server 2010 recently installed and I receive a test with 3 step to check the security of my server. below the test
Check if my server receive from fake domain.
Check if my server ...
- 25.3k
1
vote
1
answer
1k
views
Prevent IP Spoofing on OpenVPN tun
I have a question regarding IP Spoofing and authentication. I have an OpenVPN server in TUN mode with many untrusted clients in the same VPN network, and I was wondering if one client is able to spoof ...
- 201
-2
votes
1
answer
77
views
Is it possible to make me send an email by opening a malicious email? [closed]
I know I don't have much info on this problem/question so I will delete if everyone downvotes or votes to close/delete.
Is it possible for someone to make an email look like I sent it simply by me ...
- 462
1
vote
0
answers
301
views
Email Spoofed From Exchange Server
One of my exchange users got an email that bounced back to them. They did not send the email and I'm a little confused at how they got it. I looked through the logs and do not see the email leaving ...
- 5,726
-1
votes
2
answers
64
views
Can a DNS server (specified by its IP address) be spoofed?
When a DNS server is specified (in my case in OS X, in the Network Preferences), can it be spoofed (for instance by an organization with the power of a government)?
I am asking the question because ...
- 80.6k
1
vote
1
answer
3k
views
Any way to block IP address host header spoofing?
I have already added the following the following to my nginx config to deal with spoofed domains:
if ($host !~* ^(.*example.org|\d+\.\d+\.\d+\.\d+)$ ) {
return 444;
}
Right now ...
- 18.4k
-2
votes
1
answer
400
views
Can I use ASA5505 to spoof the reply to a heartbeat request?
I have a CISCO ASA 5505 in a home office. It has two subnet, public and private. There is a wifi belkin router on the private net, which provides wifi for some users. That belkin router sends out ...
- 54k
32
votes
4
answers
78k
views
Can the IP address for an HTTP request be spoofed?
On a website I am building, I plan to log the IP addresses of submissions, just in case it's necessary. I don't mind proxies, but outright spoofing your IP address would defeat the purpose.
To ...
- 54k
3
votes
1
answer
2k
views
Dovecot Sieve allows spoofing through LMTP
I have set up Postfix to block spoofing your email (you can only send emails as yourself):
smtpd_sender_restrictions =
reject_authenticated_sender_login_mismatch
I have set up Sieve and ...
CommunityBot
- 1
7
votes
1
answer
8k
views
Does postfix reject spoofed senders?
Is there a reliable way to reject incoming mails with a spoofed e-mail address?
What kind of checks does postfix run normally on incoming mails?
does postfix check the reverse dns by default?
does ...
CommunityBot
- 1
-1
votes
1
answer
134
views
What use are systems that ban IP addresses if all the evildoers spoof them anyways
Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
- 142k
0
votes
0
answers
2k
views
How To Stop Cisco ASA Spoof Attack
I have thousands of "Deny TCP reverse path check from 10.60.60.X to 10.60.6X.X on interface outside"
The IP addresses for the source and destination hosts are all over the board, and the interface is ...
0
votes
1
answer
477
views
Brute force attacks with server's IP
I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
- 430
4
votes
2
answers
7k
views
Wrong DNS answer with CNAME and A Record at the same time
We had a customer which has set a CNAME Record for his domain. Somehow he managed it to set an A Record too, which should be not possible and is forbidden by DNS. But the result was:
$ dig @ns1.your-...
CommunityBot
- 1
0
votes
2
answers
6k
views
oidentd properly configured yet not properly working on CentOS 6
I've been experiencing this problem with oidentd for a couple of days and I can't seem to be able to find a solution to this yet.
oidentd seems to give me headaches every time I want to get it work on ...
- 80.3k
0
votes
1
answer
44
views
how to discourage email spoofing
One of my production server emails look like to be spoofed from another network.
The team (group or individual or professional company) is sending mass mails out to their list of users, using our ...
- 2,635
-2
votes
1
answer
157
views
Security against IP spoofing without consulting network administrator [duplicate]
I was wondering that if there is a Local Area Network and one public IP,through which various clients connect(which have been allocated private IP's).Suppose one of the clients spoofs his IP to try to ...
- 30.7k
0
votes
2
answers
833
views
Protecting my Bind dns server from slow kaminsky-style cache poisoning attacks
Dan Kaminsky described how DNS servers could be poisoned with spoofed DNS responses [1]. As I understand it, the problem was that Kaminsky found a way to account for most other sources of randomness ...
0
votes
1
answer
202
views
DNS request anomaly
Experts, i have some problem in DNS servers configuration, network diagram is shown in figure:
The problem is manifesting as follows:
There're 2 DNS servers servicing both internal and external ...
- 477
1
vote
0
answers
1k
views
Woes with named/bind and forwarding zones
I'm sadly restricted to a very old version of bind (9.4.2)
This is the think. If I setup bind with a named.conf and only forwarding it works perfect.
acl clients {
any ;
};
options {
...
- 11
0
votes
2
answers
908
views
Spoofing NS records for pre-transfer DNS testing
I'm about to transfer a domain from one registrar and DNS provider to another, and I want to test the new DNS host before starting the transfer. The new host provides plain DNS service beforehand, so ...
- 8,141
1
vote
1
answer
400
views
Bingbot spoof localhost ip
So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request:
127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" "...
- 25.3k
0
votes
1
answer
86
views
Should I move servers and change email address after email spoofing? [duplicate]
I'm hoping the community can help me shed some light on a recent email spoof. Yesterday my client woke up to find hundreds of bounced failure notices.
The client did not personally send any of these ...
- 430
10
votes
6
answers
11k
views
How reliable are IP address-based firewall restrictions?
On some of my production systems that need to be accessible outside of the LAN I will sometimes add a firewall restriction at the edge to only permit traffic on, say, RDP from a specific origin IP ...
- 161
3
votes
2
answers
221
views
If I use iptables to allow TCP connections only from a specific IP, can it be faked?
An iptables rule on my database server is:
-A INPUT -p tcp --dport 6432 -s 10.115.0.150 -j ACCEPT
I have other rules (loopback, etc.), but I'm wondering if that specific rule can be "hacked". Can ...
CommunityBot
- 1
0
votes
1
answer
632
views
Counter MAC Spoofing with Cisco
I was wondering if someone could help me with the needed cisco commands to configure a switch to only allow certain mac addresses on certain ports. So that one mac adres can only connect to the ...
CommunityBot
- 1
0
votes
1
answer
971
views
Tracking anonymous e-mail threat
A user spoofed/sent an email from http://emkei.cz/ with a very serious threat. Is it possible to trace this back or are we SOL?
There wasn't much in the email headers other than that it came from ...
- 78.2k
0
votes
1
answer
836
views
Can a machine(physical or virtual) accept and process UDP packets with a different IP address coming from a known device?
Before everything, thanks for reading the next question.
I have script,(ipUDPspoof.rb), which is a client/server script in Ruby (you choose the parameter 1 to be server and 0 to be client, at ...
- 6,883
0
votes
2
answers
692
views
SSH:using single public key on multiple remote machines and spoofing-by-known-server
Lyrics
Usually, people say, that using single public key on several servers is just as secure as using unique public keys on each of them. (If we're not talking about possibility of private key being ...
CommunityBot
- 1
2
votes
2
answers
8k
views
Different Mac address to virtual interface and primary interface
I am developing a system, where I need virtual interface to have different mac address for my primary and virtual interface
lets say my mac for eth0 is 00:11:00:11:00:11
and my virtual interface is ...
- 21
1
vote
1
answer
768
views
Finding spoofed IP address on network
I have a few IP spoof dropped messages coming out of my Sonicwall firewall, we'll call them Source A and Source B. Both of these sources have the same mac address indicating they're coming from the ...
- 345
3
votes
1
answer
2k
views
How did this email bypass my SPF settings?
I received a phishing email this morning that appeared to come from one of my addresses to itself.
Looking at the headers, I found something interesting.
DomainKey-Status: no signature
X-Spam-...
- 54k