How Email Headers Expose Attacker Infrastructure Hidden in Plain Text

·1 views

Email headers contain a complete map of sender infrastructure, including relay hops, server versions, authentication results, and originating IPs, yet most analysts only check SPF status and the From address. The forensically reliable anchor is the chain of Received headers, which are inserted by mail relays in bottom-up order and cannot be removed without breaking delivery validation. Authentication fields like SPF, DKIM, and DMARC reveal not just pass/fail verdicts but also authorized IP ranges, signing providers, and whether enforcement was deliberately disabled. A real-world example from the SLOW#TEMPEST campaign in August 2024 showed that attackers' geographic infrastructure was fully visible via ASN signatures in Received headers, requiring no active probing. Research from Red Sift in December 2024 found that 83.9% of domains globally lack a DMARC record, a gap that was exploited in a 2024 IronScales-documented case where a malicious email passed SPF and DKIM checks and was delivered by Microsoft despite missing DMARC enforcement.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

LLM Load Testing Can Cost Thousands With No Native Test Mode From Providers

Engineering teams building on LLM APIs face steep costs when running load tests, as every call to a live endpoint consumes real compute and burns real budget. A scenario with 1,000 concurrent users making three LLM calls each can generate 1.8 million API calls in just 10 minutes, resulting in bills that are hard to justify internally. The problem worsens with tool-augmented calls — web search tools can inject 30,000 to 40,000 extra tokens per call, often doubling actual costs versus initial estimates. No major LLM provider currently offers a native test mode that exercises the HTTP stack without running inference, leaving teams to rely on imperfect workarounds. Common alternatives include local proxy stubs and recorded traffic replay, each offering cost savings but failing to fully replicate real provider behavior such as rate limiting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Agents Scale from $5.70 Prototypes to Production-Grade Systems

Building reliable AI agents requires architectural decisions that hold up under real-world load, not just weekend hackathon demos. Engineers working under tight cost constraints — as low as $5.70 per month — are often forced to adopt disciplined patterns early, such as stateless design and aggressive caching. Stateless agents, where all context is passed per request, scale linearly and limit failure to individual requests rather than entire sessions. Intelligent caching of queries and tool results can cut API costs by 70–90%, making it a core architectural choice rather than an afterthought. As usage grows from dozens to millions of requests, systematic error handling, observability, and circuit breakers become essential to prevent cascading failures across dependent services.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Expo Router Auth Guards That Handle Expired Sessions and Deep Links

Many Expo apps implement basic sign-in correctly but fail to handle edge cases like expired sessions, deep links, and cold-start token refresh in production. A common mistake is placing authentication checks inside individual screens, which risks unprotected routes and brief flashes of incorrect UI before redirects fire. Expo Router's layout-level protected routes offer a more reliable approach, wrapping entire route groups under a single guard that re-evaluates whenever the session state changes. Because session restoration from secure storage is asynchronous, developers must track a loading state and keep the splash screen visible until the storage read completes, preventing premature redirects to sign-in. Handling these four production scenarios — group-level guarding, pre-render session restore, deep-link redirection, and token-refresh races — can significantly improve authentication reliability in Expo apps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS IAM Explained: How Users, Groups, Roles and Policies Control Access

AWS Identity and Access Management (IAM) is a core AWS service that controls who can access cloud resources and what actions they are permitted to perform. IAM addresses two fundamental questions: authentication (verifying identity) and authorization (defining allowed actions). The service organizes access through four key building blocks — Users, Groups, Roles, and Policies — each serving a distinct purpose in managing permissions. Groups simplify administration by letting teams bundle permissions together, so developers or database admins inherit the right access without individual configuration. Policies are JSON-based rules that explicitly allow or deny specific actions on AWS resources, forming the foundation of the entire permission system.

0 comments Read more at DEV Community