> But, I don't think this is common behavior
It pretty much is. The actual settings vary between different mail providers and this is actually more complicated than checking header against sender IP. So everything is possible, but that mail-sending part needs more explanation anyway.
Re:How I Hacked a Router
by iambateman on Saturday April 05, 2014 @11:20PM
(#7539551)
If it's a corporate email account (as is mentioned), Microsoft is a much likelier candidate.
Sure - SPF may very well only check the envelope sender, but isn't that usually plenty? If you can't spoof the Linkedin envelope sender, and the mail goes to SPAM, who cares if the From: address is spoofed? The user likely won't see it anyway.
Re:How I Hacked a Router
by thaumaturgy on Saturday April 05, 2014 @08:57PM
(#7539145)
Anybody that can run sendmail as root (or use an alternate program, or compile their own) can spoof the envelope sender.
Ah, gotcha. You're saying that you sent an email with a valid envelope sender from your domain, with only a spoofed From: address, and gmail sent it back. If so, nice!
Re:How I Hacked a Router
by thaumaturgy on Saturday April 05, 2014 @09:51PM
(#7539315)
Yep, exactly.
Then I decided to test it, and in fact Gmail does seem to be doing more than that. I ran a two-line script as root from my mail server to send a message with an envelope-sender from my domain (which has a basic SPF txt record in its DNS) and a from: header from LinkedIn, and Gmail spit it back at my return address a moment later saying that it smelled like spam. So, good for Gmail!
But, I don't think this is common behavior, and the article doesn't actually say that the target has a Gmail account.