<html><head></head><body><div class="ydpda56beeyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div dir="ltr" data-setdir="false">A bogus email is less annoying than spam phone calls. A week or two ago, I received 8 phone calls all from "unavailable". All left voice mail saying it was Amazon calling about an order for an iPhone. Press #1 to confirm; Press #2 if I didn't place the order.</div><div dir="ltr" data-setdir="false"><br></div><div><br></div>
</div><div id="ydp88648e7byahoo_quoted_1589948890" class="ydp88648e7byahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Thursday, August 18, 2022 at 12:25:27 PM PDT, Rick Moen <rick@linuxmafia.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div>Money-seeking ploy targeting mail admins.<br><br>----- Forwarded message from Sarmad Amin <<a href="mailto:aminsarmad719@gmail.com" rel="nofollow" target="_blank">aminsarmad719@gmail.com</a>> -----<br><br>Date: Wed, 17 Aug 2022 09:18:14 -0700<br>From: Sarmad Amin <<a href="mailto:aminsarmad719@gmail.com" rel="nofollow" target="_blank">aminsarmad719@gmail.com</a>><br>To: <a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a><br>Subject: Email( spoofing)<br><br>Hello Team,<br><br>I am a security researcher and I found some Vulnerabilities in your site<br>one of them is as following:<br><br>DESCRIPTION:<br><br>I just sent a forged email to my email address that appears to originate<br>from <a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a> I was able to do this because of the<br>following DMARC record:<br>DMARC record lookup and validation for:linuxmafia.com<br><br>"No DMARC Record found"<br>Or/And<br>"No DMARC Reject Policy"<br><br>FIX:<br>1) Publish DMARC Record. (If not already published)<br>2) Enable DMARC Quarantine/Reject policy<br>3) Your DMARC record should look like<br>"v=DMARC1; p=reject; sp=none; pct=100; ri=86400; rua=mailto:<a href="mailto:info@domain.com" rel="nofollow" target="_blank">info@domain.com</a>"<br><br>This can be done using any PHP mailer tool like this,<br><?php<br>$to = "<a href="mailto:VICTIM@example.com" rel="nofollow" target="_blank">VICTIM@example.com</a>";<br>$subject = "Password Change";<br>$txt = "Change your password by visiting here - [VIRUS LINK HERE]l";<br>$headers = "From:<a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a>"”<br>mail($to,$subject,$txt,$headers);?<br><br>You can check your DMARC record form here:<br><a href="https://mxtoolbox.com/SuperTool.aspx?action=mx%3alition.io&run=toolpage" rel="nofollow" target="_blank">https://mxtoolbox.com/SuperTool.aspx?action=mx%3alition.io&run=toolpage</a><br><br> Reference:<br><a href="https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkimdmarc_records" rel="nofollow" target="_blank">https://www.knownhost.com/wiki/email/troubleshooting/setting-up_spf-dkimdmarc_records</a><br><br>Let me know if you need me to send another forged email, or if you have any<br>other questions. I’m hoping to Receive a bounty reward for my current<br>finding.<br>I will be looking forward to hearing from you on this and Will be reporting<br>other vulnerabilities accordingly.<br><br>Stay Safe & Healthy.<br><br>Snapshots.<br>[image: image.png]<br><br><br><br>----- End forwarded message -----<br>----- Forwarded message from Rick Moen <<a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a>> -----<br><br>Date: Thu, 18 Aug 2022 12:21:25 -0700<br>From: Rick Moen <<a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a>><br>To: Sarmad Amin <<a href="mailto:aminsarmad719@gmail.com" rel="nofollow" target="_blank">aminsarmad719@gmail.com</a>><br>Subject: Re: Email( spoofing)<br>Organization: If you lived here, you'd be $HOME already.<br><br>Quoting Sarmad Amin (<a href="mailto:aminsarmad719@gmail.com" rel="nofollow" target="_blank">aminsarmad719@gmail.com</a>):<br><br>> Hello Team,<br>> <br>> I am a security researcher and I found some Vulnerabilities in your site<br>> one of them is as following:<br>> <br>> DESCRIPTION:<br>> <br>> I just sent a forged email to my email address that appears to originate<br>> from <a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a> I was able to do this because of the<br>> following DMARC record:<br>> DMARC record lookup and validation for:linuxmafia.com<br>> <br>> "No DMARC Record found"<br>> Or/And<br>> "No DMARC Reject Policy"<br><br>Bullshit.<br><br>One, DMARC incorporates SPF. Having a strongly asserted SPF record<br>suffices to achieve forgery protection. And all my domains have them.<br><br>:r! dig -t txt linuxmafia.com. +short<br>"v=spf1 ip4:96.95.217.99 -all"<br><br>Two, if you had _even_ actually checked _marc.linuxmafia.com, you would<br>have seen that the domain _does_ have a DMARC RR, that is deliberately <br>non-compliant with the DMARC spec, because I consider DMARC a botched <br>design, decline to participate, and declare publicly my<br>non-participation. Which you'd have noticed if you _actually_ looked.<br><br>:r! dig -t txt _dmarc.linuxmafia.com. +short<br>"DMARC: tragically misdesigned since 2012. Check our SPF RR, instead."<br><br>I deduce you are fibbing in claiming that you sent a (believable)<br>forged e-mail purporting to be from <a href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a>, because if your<br>MTA _actually_ implemented DMARC, which requires implementing SPF, then<br>your MTA would have refused the mail as forged. (If you are not<br>fibbing, the claim is incompetent. Either way, not a good look.)<br><br>To sum up, I conclude, therefore, that you are simply running an<br>automated DMARC record checking script against many domains, and sending<br>out automated messages _falsely_ claiming a (credible) mail forgery<br>of those domains _solely_ if they don't return positive from your <br>automated DNS-checking script.<br><br>You are, in brief, _not_ acting like a genuine security researcher. <br>You are just another grifter running scripts, making false claims, and<br>wanting money.<br><br>You should be ashamed of yourself. Get a real job.<br><br>And, please go away. <br><br><br>----- End forwarded message -----<br><br>_______________________________________________<br>conspire mailing list<br><a href="mailto:conspire@linuxmafia.com" rel="nofollow" target="_blank">conspire@linuxmafia.com</a><br><a href="http://linuxmafia.com/mailman/listinfo/conspire" rel="nofollow" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br></div>
</div>
</div></body></html>