DNS Prank, cont.

Here is a sample SMTP session, almost suitable for cutting and pasting:

HELO someplace.com
MAIL FROM: evilgenius@someplace.com
RCPT TO: somewienervictim@somplace.com
DATA
Mime-Version: 1.0
Content-Type: text/html; charset="us-ascii"
<HTML>
<CENTER><H1>Hi! This is you:</H1></CENTER>
<P>
<IMG SRC="http://www.somethingawful.com/truthmedia/ffx-flames/jerk-02.jpg">
<P>
</HTML>
.

What's the point?

You can hoodwink corporate spyware policies by sending e-mail (the spyware is based on a bogus premise: names of things are different from the things themselves)
You can do the same with NIDS, even on internal networks (involuntary execution of certain commands comes bundled with some mail readers)
You can use your web server logs to snoop on recipients of your e-mail (go ahead! issue cookies; embed JavaScript)

Navigational Aids
Next	Previous
Start	End

This page is maintained by Foofus.
Send comments or questions to foofus@foofus.net.

DNS Prank, cont.

Here is a sample SMTP session, almost suitable for cutting and pasting:

What's the point?

You can hoodwink corporate spyware policies by sending e-mail (the spyware is based on a bogus premise: names of things are different from the things themselves)

You can do the same with NIDS, even on internal networks (involuntary execution of certain commands comes bundled with some mail readers)

You can use your web server logs to snoop on recipients of your e-mail (go ahead! issue cookies; embed JavaScript)