IP Spoofing

[osucowgirl]

I am about to be charged with invasion of privacy b/c a girl I know had an email sent from her own hotmail account to everyone in her address book that she apparently didn't write. She said they traced the IP address to my computer. Our ISP is SBC Yahoo DSL and our OS is win2000. I am a h/s teacher and this sounds like something my students would know how to do. Obviously I didn't write the email or I wouldn't be posting here, but I am being called in for questioning and I would like to have some knowledge of IP spoofing before making accusations I can't back up. I read a past post, but your IP spoofing was talking about when a website reads it. What about when an email was sent with an IP attached from a service like hotmail? I know that you aren't legal advice, but I doubt lawyers can answer the questions I have. I know little about computers, but my students know plenty. Could this be possible or would it be discovered in the trace?

[vkaryl]

Is your computer a multi-user one? In other words, do other people BESIDES you logon and use it? Is it completely secure whether you are the only user or there are others who logon? Do you have a firewall operational? Do you use hotmail? Do you regularly use windows update to patch security holes? Is there other evidence out there that your students may have set you up for this? Do you know anyone who is "outside" the scope of this problem who knows more about this sort of thing than you do? Onsite help is better than offsite....

There has been a HUGE amount of IP spoofing going on lately, most of which I don't know much about, isn't a problem for me. THAT sort of thing others here will know much more about.

Retain an attorney, preferably one versed in technology if one is available in your area.

[idoc]

I would want to know *who* traced the i.p back to you and how.

Did the header of the email show an i.p. address that is your providers i.p. address? Forging email headers is very easily done. Do you have a static i.p. address that is *dedicated* to your internet connection alone? On many isp's hundreds of people may share an i.p. address. Has your i.s.p. confirmed that the mail was in fact sent from your i.p. address? Most i.s.p.'s will keep your personal information private unless there is a court order for the records or unless asked by law enforcement to cooperate. Finally, yes forging i.p.'s can be done, your i.s.p. should be able to check to see whether the traffic *did* come from your service line or not.

I know little to nothing about criminal law... personally, I would not talk to law enforcement people *at all* without counsel. Best of luck.

[jdMorgan]

osucowgirl,

Welcome to WebmasterWorld [webmasterworld.com]!

This sounds like a typical trojan that harvests e-mail addresses and files from the victim's computer, and then sends itself to all those email addreses by hiding itself inside one of the files. Since the recipient knows the sender, and the text of the message seems to be from/by/about that sender, the message seems to be legitimate, even if unexpected or inappropriate. But of course, by the time the next victim sees that e-mail message, the trojan has already installed itself on the victim's machine, and is repeating the process.

This case is pretty silly, in that thousands of people with unprotected high-speed internet connections have been infected and affected by these trojans, and almost none of them have been prosecuted. If you do not have an anti-virus program and a firewall, get them now. Also run Ad-Aware and SpyBot Search and Destroy (both freeware -- do a search) and test, but do not clean out your machine(s) (To be specific, "quarantine" any malware you find with these tools, and keep the reports as proof that *you* did not intentionally do anything wrong, but that your computer was infected by software that did it).

While we're on the anti-virus subject, you or your attorney may be able to turn up some useful information about exactly how common this is by looking through Symantec's Norton Anti-Virus web site and other sites concerned with IT and internet security. Hire an expert witness, and you can easily blow these charges out of the water (assuming you get one who can explain things simply).

Just because e-mail is sent from your computer using your e-mail account does not mean that you (or any human) did it. It could have been a trojan. There is no law about being careless or uninformed about firewalls, anti-virus programs and the danger of using insecure e-mail clients like Outlook or Outlook Express and their highly-risky "preview panels."

Another angle is "How did you get the file that she claims is private?" If she sent it to you via e-mail, she made it public, because e-mail is not encrypted or sent via secure channels. If her computer sent it to your computer becuase her computer was infected by a trojan, and your computer sent it on to others, then she is just as much to blame for not having taken any steps to secure her computer.

The problem is that most people simply do not understand all the technology, and don't realize that it is dangerous to put a computer on-line that does not have a firewall and anti-virus measures already in-place and running.

I'm not a lawyer, and these are just a few thoughts...

Good luck from a neighbor to the south (Tx),
Jim

[anallawalla]

"Charged" sounds ominous. Who is doing this "charging"?

Apart from the trojan/worm theory, something else doesn't jell. One assumes that osucowgirl is in a high school environment and like most networked places, her PC has an internal IP address, e.g. 192.168.0.99.

Someone she knows has allegedly sent a Hotmail message. Take a look at your typical Hotmail email. One I forwarded to my real address from hotmail has this line identifying not my PC's 192.168.x.x address but that of my ADSL gateway:

X-Originating-IP: [203.11x.20x.19x]

Any number of PCs in my network could have sent that email if they knew my Hotmail password but none of them can be singled out.

Therefore, the only IP address on her friend's Hotmail email will be the one allocated by SBC Yahoo to her school. And if her school gateway was disconnected and reconnected, this IP address could have been allocated to someone else before.

IMHO, the "charger" is on very thin ice to make such an allegation.