Can I trace email origin locations to thwart email attachment viruses?

Can I trace email origin locations to thwart email attachment viruses?

What are the best methods for tracing the origins of malicious email, and can doing so help mitigate the threat of malware-laden messages?

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Tracing the source of a malicious email is difficult in most scenarios. First, to trace email origin locations, you can't trust the 'From' or the 'Reply-to' fields; you must look into the headers of the emails. (The methods for finding email headers will vary depending on the email clients, so check with your client vendor about how to view the headers.)

The headers will generally list the SMTP server where the email originated and the servers used to send the email to your server. Once you've traced the email in question back to its origins, you will most likely find a botnet or some other infected systems was used to send it, which makes identifying the origins less useful . Emails sent from botnets will show up as coming from compromised PCs as SMTP servers or relays, whereas legitimate users' emails will display their ISP or employer's servers. If you do identify the origin of the email as a botnet-infected system, you will have only opened the first layer in identifying the source of the malware; stopping the malware will require more effort. However, if you do to determine the origins, you may want to consider reporting the systems used to the organization or ISP responsible for those systems, so they can try to get the systems cleaned up.

However, identifying the source of a malicious email or email attachment viruses and individually blocking an SMTP server is not an effective way to block spam. There are blacklisting, whitelisting and antispam services that will essentially do this for you and save you the effort of doing it yourself. Some services or software allow you to upload suspected or confirmed malicious email, so it can be added to the block list; these services will check many factors to see if the email is malicious. Also, it's a good idea to configure your email system and clients securely. For example, blocking any executable files being sent via email is a common way to prevent the spread of malware.

This was first published in October 2010

Back to top