Waldvogel & Aschwanden
Funny SMTP
These are a few real SMTP conversations. Unfortunately, all these machines do either no longer exist or no longer react like that. As you can see, the system administrators of the respective systems had once had too much time at their hands (or just needed to blow some steam). They also knew that some people were really using the text interface, e.g., for debugging.You can also see the use of continuation lines, which haven't been discussed in class, such as the
220-
lines preceding the final
220
line.
Hitchhiker's Guide to SMTP
Last known to work in April of 1996:% telnet mail.germany.eu.net smtp Trying 192.76.144.65 ... Connected to mail.germany.eu.net. Escape character is '^]'. 220-mail.Germany.EU.net - EUnet gateway to Germany 220 ESMTP spoken here EHLO nice.ethz.ch 250-mail.Germany.EU.net Hiya nice.ethz.ch [129.132.66.13], long time no see 250-SIZE 20000000 250 HELP MAIL from: waldvogel@nice.ch SIZE=335 250 waldvogel@nice.ch... A real hoopy frood. [...] . 250 QAA01569 Message accepted for delivery RSET 250 Reset state: 38911 BASIC BYTES FREE. QUIT 221 So long, and thanks for all the fish.
Hacker-friendly SMTP server
Again the same machine (this part is thanks to Daniel "Clüsch" Kluge). To understand the humor behind this, you should be aware that many of the break-ins into computers occured by taking advantage of bugs in sendmail, the most popular mail transfer agent (MTA). Probably the most prominent example is the so-called Morris Worm of 1988, but there have been many more security incidents relying on sendmail. Also, several of the commands have been documented in the HELP text for ages, but never worked.% telnet mail.germany.eu.net smtp Trying 192.76.144.11... Connected to mail.germany.eu.net. Escape character is '^]'. 220-mail.Germany.EU.net - EUnet gateway to Germany 220 ESMTP spoken here help 214-Commands: 214- HELO EHLO MAIL RCPT DATA RSET 214- NOOP QUIT HELP VRFY EXPN VERB 214-Not implemented: TURN SOML SAML SEND 214-Non standard: SHEL WIZ DEBUG KILL TTY PTY 214- 214-For more info use "HELP <topic>". Bug reports to mail@Germany.EU.net. 214- 214-Whence camest thou, Worthy Thane ? 214-From Fife, Great King, where the Norwayan banners flout the skye 214-and fanne oure people colde. 214 End of HELP info help wiz 214-WIZ <password> 214- Pretend to be a wizzard. 214 End of HELP info help kill 214-KILL 214- Nuke the initiator of this command. 214 End of HELP info help tty 214-TTY 214- Become attached to a terminal. Useful in preparation for a 214- subsequent SHEL command. Same as PTY in this implementation. 214 End of HELP info help pty 214-PTY 214- Become attached to a terminal. Useful in preparation for a 214- subsequent SHEL command. Same as TTY in this implementation. 214- Note: 214- ===== Becoming attached to a terminal (as opposed to another 214- human being) may be dangerous to your health. 214- Consult your shrink. 214 End of HELP info help shel 214-SHEL 214- Same as SHEL in this implementation. 214 End of HELP info help soml 214-SOML FROM: <sender> 214- Specifies the sender. Send to terminal of a user or mail. 214- Never was, nor ever will be, implemented. 214 End of HELP info help saml 214-SAML FROM: <sender> 214- Specifies the sender. Send to terminal of a user and mail. 214- Never was, nor ever will be, implemented. 214 End of HELP info help send 214-SEND FROM: <sender> 214- Specifies the sender. Send to terminal of a user, do not mail. 214- Never was, nor ever will be, implemented. 214 End of HELP info quit 221 So long, and thanks for all the fish.
Forging "Prevention"
Many people used the direct text interface to fake senders (nowadays, there are simpler options; anyway, someone knowledgeable looking at the mail headers can typically find many clues to who sent or didn't send the mail). The following dialog refers to that. Thanks to Thomas Andres, we know that even the reputable Swiss bankers do sometimes show a sense of (sometimes rather weird) humor.
Update (2005-03-01): I received an email from that bank's security incident response team manager requesting me to remove the bank's name from this URL. (The IP address no longer belongs to them, so it does not leave any identifying marks.) It seems that current management no longer approves the former sysadmins' humor. I am not sure how this relates to security incidents, however...
% telnet mail.<major-swiss-bank>.com 25 Trying 194.209.128.98... Connected to mail.<major-swiss-bank>.com. Escape character is '^]'. 220 unigate1 SMTP ready, Who are you gonna pretend to be today? HELO blabla.microsoft 250 unigate1 Is thrilled beyond bladder control to meet blabla.microsoft MAIL FROM: sten@ergon.ch 250 sender is sten@ergon.ch, (yeah sure, it's probably forged) RCPT TO: gunterberg@ergon.ch 250 recipient bounce.me@<major-swiss-bank>.ch, I know them! they'll just *LOVE* to hear from you! DATA 354 OK, fire away. End with <CRLF>.<CRLF> From: sten@ergon.ch To: bounce.me@<major-swiss-bank>.ch Subject: mail test bla bla . 250 Whew! Done! Was it as good for you as it was for me? quit 221 It's been real. Take off Eh!