SMTP Protocol question

[XA04]

See the new post below please
http://forums.hexus.net/1927990-post8.html






I'm revising for my exams at the moment and have a quick question regarding SMTP...

Here's the question:

A student is mystified why they are receiving emails addressed to another recipient, without their address in the “To:” field of the message header. Explain, with reference to the RFC821(SMTP) and RFC822 protocol show how this operates.

I know that you can connect to an SMTP server and fake who you say you are, but I wouldn't have thought it was possible to fake who it's going to as surely this would just end up going to the wrong person?

Any ideas?
Cheers

[BobF64]

The simplest answer, assuming nothing is forged, they are being BCC'd.

[XA04]

Hmm true that could be the answer actually. Feel a bit silly lol. Most of the questions have been about abuse really.. so kind of a trick question! Might just email my lecturer and see what he says.

Cheers!

Edit: Even if BCC'd though won't it then show in the To: part!?

[BobF64]

Dont believe so.

Ive yet to see any sort of reference to a BCC'd person in any email header, but I could be wrong.

It certainly wont be in the To field and its called "Blind Carbon Copy" for a reason

[peterb]

As the qustion referes to the RFC - I think the answer may lie here...


http://www.faqs.org/rfcs/rfc821.html

Para 3.6

[scaryjim]

RFC 2821 Appendix B paragraph 1 has this to say about generating SMTP commands from RFC822 headers: source

Each recipient address from a TO, CC, or BCC header field SHOULD be copied to a RCPT command (generating multiple message copies if that is required for queuing or delivery). This includes any addresses listed in a RFC 822 "group". Any BCC fields SHOULD then be removed from the headers.

Interesting to note: the RFC only states that BCC headers SHOULD be removed, so a complying mail transfer agent could actually send the message to the main recipients with full BCC information in the headers, defeating the object of BCC. As always, google is your friend - and while you probably can't memorise entire RFCs for your exams, it's probably worth trying to memorise the most slaient points of each of the main ones...


GAH! Apologies, I've quoted the above from RFC 2821, which provides consolidation and clarification to 821 without materially changing any of it. Might be worth a few extra marks if you can drop it in though

[XA04]

That's great thanks everyone

[XA04]

It says in RFC822 that:

     A.3.1.  Minimum required
     
     Date:     26 Aug 76 1429 EDT        Date:     26 Aug 76 1429 EDT
     From:     Jones@Registry.Org   or   From:     Jones@Registry.Org
     Bcc:                                To:       Smith@Registry.Org
     
        Note that the "Bcc" field may be empty, while the  "To"  field
        is required to have at least one address.

So if the minimum is that there doesn't need to be a To: but an empty Bcc: then surely nobody would receive the email?

[watercooled]

Bcc addresses are generally stripped from the email so they are not visible to recipients, hence blind CC.

Edit: Sorry that's basically been said above, I skipped to the last post after reading the OP. Try it for yourself, send an email to yourself in the To: field and add another address in the Bcc: field and look at the message source on the received messages - you should see no mention of the Bcc: address provided the email client handles Bcc: properly.

[XA04]

I understand that.. unless I'm missing something. Surely if you connect to an SMTP server and say, this is the date of the message, this is where it's been sent from, and this is who I want to BCC it too (but it's blank) then the message wouldn't arrive would it?

[watercooled]

Bcc: addresses are only stripped off at the recipient email server. Of course that means you can't rely on it for privacy - if the recipient server is misconfigured (is that a word? FF spellchecker doesn't like it) or owned by the recipient then they could see the Bcc: addresses.

[XA04]

I'm probably sounding stupid now. If I connect to an SMTP server and put this in:

Date: 26 Aug 76 1429 EDT
From: Jones@Registry.Org 
Bcc:

Through the necessary commands (using telnet), the email isn't going to reach anyone is it? or if it does, how when you don't specify a recipient?

[watercooled]

You do specify a recipient, you would send this to your smtp server:
Date: 26 Aug 76 1429 EDT
From: Jones@Registry.Org
To: bar@foo.com
Bcc: foo@bar.com

It would travel to the recipient server as usual then when it arrived the server would strip the Bcc list before dropping it in the user's mailbox.

[XA04]

You do specify a recipient, you would send this to your smtp server:
Date: 26 Aug 76 1429 EDT
From: Jones@Registry.Org
To: bar@foo.com
Bcc: foo@bar.com

It would travel to the recipient server as usual then when it arrived the server would strip the Bcc list before dropping it in the user's mailbox.

Yes but as a minimum you don't need to specify a "To:", you can supply a "Bcc:" that's empty..

[watercooled]

It depends, some service providers will refuse to send messages with an empty To: field.