TechNet (and MSDN) Flash Newsletter Validity

[David A. Lessnau]

I'm not sure if this is the right place to post this since I'm not even sure
anyone from Microsoft (TechNet or otherwise) ever reads the forum (I have
posts going back to early December 2006 and none of the senders' names leap
off the page as being from officialdom). Anyway, I've signed up for
TechNet's (and MSDN's) Flash newsletter. The first one I received had a
sender of ***@newsletters.microsoft.com . However, the second one
(which, I believe was the 21 Feb 2007 issue), had a different sender. I no
longer have the issue, but the sender was a random-looking string of
alphanumerics prepended to the @newsletters.microsoft.com domain and was
followed by the words "on behalf of ***@newsletters.microsoft.com "
(again, this is from memory, so it might not be exact). I had no idea what
to do with that issue. Was it a valid issue? Was it a phishing attempt
using a copy of the newsletter with subtly altered URLs embedded in it to
send me to spoofed web sites? I don't know. So, assuming the newsletter
was valid, a couple of things:

1) Microsoft shouldn't send out newsletters with different senders "on
behalf" of itself.
2) Regardless, Microsoft should sign those newsletters with some form of
certificate. That way, no matter what the sender line says, we'll have some
kind of warm-fuzzy that it actually came from Microsoft.

[David A. Lessnau]

Another example. Today, I received what purports to be the Volume 9, Issue
3 (dated 15 March 2007) TechNet Newsflash. Instead of coming from
***@newsletters.microsoft.com, it comes from "Colm Torris
[***@microsoft.com]". Why? Again, assuming this is not a phishing
attempt, why does it have an individual's email address as the Sender
instead of the appropriate part of the Microsoft organization and isn't
signed with a certificate. The newsletter is filled with links. How is
anyone supposed to know this is a legitimate email and that those links
aren't forged to send us to bad places?

Post by David A. Lessnau
I'm not sure if this is the right place to post this since I'm not even
sure anyone from Microsoft (TechNet or otherwise) ever reads the forum (I
have posts going back to early December 2006 and none of the senders'
names leap off the page as being from officialdom). Anyway, I've signed
up for TechNet's (and MSDN's) Flash newsletter. The first one I received
one (which, I believe was the 21 Feb 2007 issue), had a different sender.
I no longer have the issue, but the sender was a random-looking string of
(again, this is from memory, so it might not be exact). I had no idea
what to do with that issue. Was it a valid issue? Was it a phishing
attempt using a copy of the newsletter with subtly altered URLs embedded
in it to send me to spoofed web sites? I don't know. So, assuming the
1) Microsoft shouldn't send out newsletters with different senders "on
behalf" of itself.
2) Regardless, Microsoft should sign those newsletters with some form of
certificate. That way, no matter what the sender line says, we'll have
some kind of warm-fuzzy that it actually came from Microsoft.

[Adam Leinss]

Post by David A. Lessnau
Another example. Today, I received what purports to be the Volume 9,
Issue 3 (dated 15 March 2007) TechNet Newsflash. Instead of coming
attempt, why does it have an individual's email address as the Sender
instead of the appropriate part of the Microsoft organization and
isn't signed with a certificate. The newsletter is filled with links.
How is anyone supposed to know this is a legitimate email and that
those links aren't forged to send us to bad places?

If you check the headers, you should be able to trace where it came from.
The From: field can be easily spoofed, so I wouldn't personally trust
something just because the From looks valid. I have all my Technet
newsletters going to an alias setup just for Technet. Someone would have
to be very smart to know:

1. I signed up for the Technet news letter
2. Setup a specific alias just for the Technet newsletters
3. Redirect all the links embedded in the hopes I might click on one of
them

Very doubtful.

Adam