Tracking Email Communications

 

Email tracking monitors the email messages of a particular user. This kind of tracking is possible through digitally time-stamped records that reveal the time and date when the target receives and opens a specific email. Email tracking tools allow an attacker to collect information such as IP addresses, mail servers, and service providers involved in sending the email. Attackers can use this information to build a hacking strategy and to perform social engineering and other attacks. Examples of email tracking tools include eMailTrackerPro, Infoga, and Mailtrack.

Information about the victim gathered using email tracking tools includes:

• Recipient's System IP address: Allows tracking of the recipient's IP address
• Geolocation: Estimates and displays the location of the recipient on the map and may even calculate the distance from the attacker's location
• Email Received and Read: Notifies the attacker when the email is received and read by the recipient
• Read Duration: The time spent by the recipient in reading the email sent by the sender
• Proxy Detection: Provides information about the type of server used by the recipient.
• Links: Checks whether the links sent to the recipient through email have been checked
• Operating System and Browser information: Reveals information about the operating system and the browser used by the recipient. The attacker can use this information to find loopholes in that version of the operating system and browser to launch further attacks
• Forward Email: Determines whether the email sent to the user is forwarded to another person
• Device Type: Provides information about the type of device used to open and read the email, e.g., desktop computer, mobile device, or laptop
• Path Travelled: Tracks the path through which the email traveled via email transfer agents from source to destination system

Collecting Information from Email Header

An email header contains the details of the sender, routing information, addressing scheme, date, subject, and recipient. Email headers also help attackers to trace the routing path taken by an email before it is delivered to the recipient. Each email header is a useful source of information for an attacker to launch attacks against the target. The process of viewing the email header varies with different email programs.

Commonly used email programs:

• eM Client
• Mailbird
• Hiri
• Mozilla Thunderbird
• Claws Mail
• SmarterMail Webmail

The email header contains the following information:

• Sender's mail server
• Date and time of receipt by the originator's email servers
• Authentication system used by the sender's mail server
• Data and time of sending the message
• A unique number assigned by mx.google.com to identify the message
• Sender's full name
• Sender's IP address and address from which the message was sent