Hmmm, you are right for at least OutlookXP & E2K (I just tested it), but I remember testing this on ol98/MSX5.5 and finding that the preview pane displayed verbatim whatever was in the double-quoted section of the RFC822 "From" header, irregardless of ResolveP2.
-----Original Message----- From: Chris Scharff [mailto:[EMAIL PROTECTED] Sent: Saturday, March 29, 2003 1:12 PM To: Exchange Discussions Subject: Re: Mailbox Hacked Whether that is the case or not depends on the server's ResolveP2 settings. On 3/28/03 12:28, "Ken Cornetet" <[EMAIL PROTECTED]> wrote: > They will get the SMTP address in the "From" field *if* they open the > message to read it. If they use the preview pane, they get no such > indication. > > -----Original Message----- > From: Etts, Russell [mailto:[EMAIL PROTECTED] > Sent: Friday, March 28, 2003 11:32 AM > To: Exchange Discussions > Subject: RE: Mailbox Hacked > > > Hi there > > Yes, this is possible. RFC2821 - SMTP does not require > authentication. However, here are some of the tip-offs: > > Every time I have seen this done, you get the SMTP address in the from > field rather than a name Check the header of the email. That will > tell you where everything came from > > HTH > > Russell > > > -----Original Message----- > From: Patrick Scribner [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 26, 2003 5:07 PM > To: Exchange Discussions > > Is it possible that someone Telneted into the IMC and sent the message > to the Sales Manager from his boss? It's really not that hard to > spoof like that from the inside. > > > > Thanks, > > Patrick Scribner, MCSE > DBA > Westwood College > 720-524-5137 > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > > > -----Original Message----- > From: Ed Crowley [mailto:[EMAIL PROTECTED] > Sent: Saturday, March 22, 2003 1:25 PM > To: Exchange Discussions > Subject: RE: Mailbox Hacked > > > Look at the message headers to be sure that it isn't from the > Internet. If it is from the Internet, search TechNet for "ResolveP2" > (without the > quotes) and you can make sure that mail from the Internet doesn't look > like mail from within. If you determine that the message was generated > internally, then you should strap every administrator who could grant > themselves permissions to send as the manager into a lie detector and > terminate the one who fails. If they all pass, then you should tighten > up your security by eliminating unnecessary administrative accounts and > changing passwords on the remaining ones. > > Ed Crowley MCSE+Internet MVP > Freelance E-Mail Philosopher > Protecting the world from PSTs and Bricked Backups!T > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Sanjeev > Sharma > Sent: Saturday, March 22, 2003 12:18 PM > To: Exchange Discussions > Subject: Mailbox Hacked > Importance: High > > > One of our sales managers received an email message from his boss > about a job opportunity in another company and the boss claiming that > his mailbox is hacked and he never sent that message which I believe > that because why would any manager do that. Now, the very first thing > came to mind that someone got into his mailbox and sent that message > but what's strange is that I got into his mailbox and browsed through > his sent items and I do not see that message in his sent items. I > can't think of anything else. Please help me understand that how can > it be possible? Thanks! > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
