From field being changed - How?

Question

This is probably going to be a rather dumb question, but here it goes. My company's CEO received a SPAM message the other day. The concern he had was that the message was not only addressed from him, but it appeared as though the sender was him also.
I was able to find the message through Ironport Mailflow and saw that the message came into the Ironport device with a from field of ;
Sender: [email protected]
Recipient(s): [email protected]
Subject: Your Featured Products of the Week?
Message-ID Header: 20090318140646.3977.qmail@OMAR1
So how does a Spammer get the message to change the sender field information to reflect the same as the To field?
We are using Lotus Notes (Domino) for mail. They are only accepting messages from our Ironport devices.

Answer 1

It's because the envelope sender doesn't necessarily have to be the same as the header('From') email address. For legitimate mail, this doesn't come up, but spammers use this to try and bypass spam filters and such.
For example, here is what a potential smtp conversation between the Internet and the Ironport appliance:
(sender) helo
(receiver) 220 ok
(sender) mail-from: [email protected]
(receiver) 250 ok
(sender) rcpt-to: [email protected]
(receiver) 250 ok
(sender) data
(receiver) 334 go ahead, end with "." on it's own line
(sender) From: [email protected]
(sender) To: [email protected]
(sender) Subject: Do you want to buy a brand new Rolex watch?
(sender)
(sender) Go to this website to buy it, http://newrolex.com
(sender) .
(receiver) 250 message accepted
What happened above is perfectly legal. It is RFC compliant and it's not breaking any rules.
Now, what I would recommend to counter this is the following:
1. Would there be any scenario where both the header("From") and the header("To") would be the same domain, in this case, "ourcompany.org".
When two co-workers send mail to one another, should it stay on the mailserver and never hit the Ironport appliance.
If this is the case, we can implement an incoming content filter like the following:
Same_from_to_domain_in_headers_quarantine:
Conditions (All of the following must match):
header("From") == "ourcompany.com$"
header("To") == "ourcompany.com$"
Actions:
quarantine ("Policy")
This kb article may help you with content filters.
What conditions / actions are available to content filters?
http://tinyurl.com/jpqwl
This is probably going to be a rather dumb question, but here it goes. My company's CEO received a SPAM message the other day. The concern he had was that the message was not only addressed from him, but it appeared as though the sender was him also.
I was able to find the message through Ironport Mailflow and saw that the message came into the Ironport device with a from field of ;
Sender: [email protected]
Recipient(s): [email protected]
Subject: Your Featured Products of the Week?
Message-ID Header: 20090318140646.3977.qmail@OMAR1
So how does a Spammer get the message to change the sender field information to reflect the same as the To field?
We are using Lotus Notes (Domino) for mail. They are only accepting messages from our Ironport devices.