Gmail accepts forged YouTube emails
john-millikin.com
Gmail accepts forged YouTube emails
1–10 of 101 posts
Re: Gmail accepts forged YouTube emails
#2Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.
Re: Gmail accepts forged YouTube emails
#3Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.
Phishing bored lawyers?
Re: Gmail accepts forged YouTube emails
#4This looks like a hint to why this message was accepted with failed dmarc: http://lists.dmarc.org/pipermail/dmarc-discuss/2013-April/00...
Re: Gmail accepts forged YouTube emails
#5Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.
An attempt at increasing reputation? Nobody is going to mark that as a spam.
Re: Gmail accepts forged YouTube emails
#6The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email.
Re: Gmail accepts forged YouTube emails
#7On one hand, they aren't special casing their own products, so good on them I guess? On the other hand, if they can't detect this, what point is their spam filtering even?
Public mail services can be surprisingly bad at what they decide not to catch. I love Fastmail but because some existing customers rely on it, the default behavior is not to block inbound emails with the same domain as you've delegated entirely to Fastmail.
One would expect a given provider should, unless instructed explicitly otherwise, block outside emails from domains it controls mail for.
Re: Gmail accepts forged YouTube emails
#8I'm not really an expert on this, so I don't know why someone is doing this here, but it sounds like a DKIM replay attack: https://proton.me/news/dkim-replay-attack-breakdown
Re: Gmail accepts forged YouTube emails
#9Any ideas for why that email appeared in your inbox? It doesn't look like it's a phishing attack - "Updates to YouTube's Terms of Service" is a subject line that guarantees that precisely zero people will even bother opening it.
Perhaps to check if the inbox is valid? Sending from some random domain you risk having your mail silently dropped. If the server thinks you're youtube, then you're going to get through.
Re: Gmail accepts forged YouTube emails
#10The reason for this is right in the headers. The message had a valid ARC headers used to preserve DKIM/SPF/DMARC checks when forwarding email. https://en.wikipedia.org/wiki/Authenticated_Received_Chain
Correct, this message isn't forged, it's authentic. You can check the signature yourself.