Lluis Mora: SMTP Information gathering

Black Hat Briefings, Europe 2007 [Audio] Presentations from the security conference.

"The SMTP protocol, used in the transport and delivery of e-mail messages, includes control headers along with the body of messages which, as opposed tother protocols, are not stripped after the message is delivered, leaving a detailed record of e-mail transactions in the recipient mailbox.
Detailed analysis of SMTP headers can be used tmap the networks traversed by messages, including information on the messaging software of clients and gateways. Furthermore, analysis of messages over time can reveal organization patching policies and trends in user location and movements - making headers a very valuable resource during the target selection phase of targeted attacks."
"Lluis Mora is a researcher at Neutralbit, a research and development provider for information security vendors, where he specializes in vulnerability assessments and penetration testing of products, applications and products.
Lluis has worked in the information security field for over a decade, consulting for various service providers and corporations throughout Spain and South America. He has published various papers on vulnerability research in IT and SCADA systems and won the openhack competition back in 1999 and 2000. "