Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My account is sending spam emails

productforums.google.com

Post reply on HN
Print view View original

131–140 of 154 posts

Re: My account is sending spam emails

#131

Post by prepend »

obituary_latte wrote: post #76
thaumaturgy wrote: post #47

Earlier quoted context omitted.

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…

Gmail's sent folder isn't a sent folder in the traditional sense. It's a label that just filters mails based on the "from" address.

Then that is really stupid. I want an email client, not a gmail client.

Re: My account is sending spam emails

#132

Post by teddyh »

sethvargo wrote: post #129
smt88 wrote: post #123

Earlier quoted context omitted.

This is exactly the kind of non-human PR speak that saturates Google's response to customers in all forums. Promises are half-made and always broken. There doesn't seem to be a will or desire to aggregate and manager customers' concerns. I hope this time is different, and your team really does share more information as it becomes available and relevant. I doubt it, though, and will switch to a mail provider that I pa…

1. I am a human. I promise :) 2. I apologize if my response came off as “PR speak” as that was not my intention. 3. I am trying to manage customer concerns. It’s why I’m responding on HackerNews and similar sites.

> I am trying to manage customer concerns

You do that by providing actual information, not by corporate zero-information talk.

Re: My account is sending spam emails

#133

Post by jiveturkey »

criley2 wrote: post #130

I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases. But my gmail has zero new logins, my 2fa wasn't triggered, etc. How does a hacker create labels to delete my email but not register a login attempt or trigger my 2fa? I wish I was able to contact google. EDIT: my only guess was accessing my PC where logins are saved, but…

the login occurred awhile ago?

Re: My account is sending spam emails

#135

Post by jjhb94 »

laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

When you changed your password did you receive a google code from a 614 area code number?

Re: My account is sending spam emails

#136

Post by ladram »

oh wow i just searched google to see what was goin on cuz i am getting this shit too ... it also was in the MEssage ID

one of them, at least the one that i was still in my sent mail

Sent to random people, none of which whom i know

I'm not as technical as some of you guys here, but i saved the message headers and sent it to google, anything that I can provide to help? I didn't read this whole thread, just skimming it. I just spent 2 hours also freaking out that I was hacked, (I have 2fa, reviewed security, revoked access from all apps even tho was already limited, changed password, ran malware checks, etc), I Really don't want to have to factory reset my phone, but I'm considering it. ALthough after reading here it seems to be some perps who managed to find a flaw in the way google handles message headers(?, i'll read through more to understand just outta curiousity).

One thing I will mention, I accidentally clicked one of those redirected ads last night (and I use BRAVE Browser which blocks most all ads) on mobile, I was so mad at myself, it literally was a tap accident, I wasn't paying attention and talking to someone at the same time. It does seem like a weird coincidence that the same time I did that, this happened. But maybe it is just a coincidence. If it's not, I'm inclined to literally factory reset my phone. Would anyone here advise to do so? Or is this really not on my end of my device or anything (btw I also have complex passwords & the like - I am pretttty tech savy, just not on the level of some of the people here). Thanks for all the info though, and let me know how I can contribute, if at all.

oh also not sure if this is relevant, but I use PIA VPN ....

Re: My account is sending spam emails

#137

Post by berg01 »

jlgaddis wrote: post #41

Don't freak out about them being in your Sent folder. Remember that Gmail doesn't have "traditional" mail folders -- just a huge pile of all your e-mail messages with "labels" attached to them. Apparently Google decides that if the From: address is yours, then you "sent" the message. Note that in SMTP there are two "from addresses": the envelope sender (which you don't see) and the "From:" address/header (which you d…

> Apparently Google decides that if the From: address is yours, then you "sent" the message.

Bad design, period.

Re: My account is sending spam emails

#138

Post by massaman_yams »

ahje wrote: post #69
mgcunha wrote: post #55

Earlier quoted context omitted.

Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for S…

DMARC could solve this problem, but it would break a lot of things reliant on forwards. When Yahoo set their DMARC policy to reject, there was quite a stir about it: https://www.ietf.org/mail-archive/web/ietf/current/msg87153.... In this particular case, it seems the major issue is that spammers got access to 69.64.35.11, which is included in telus.com's SPF record. In the end, this will hurt deliverability for legit…

ARC is the new standard designed to fix the DMARC edge case with forwarding. It's relatively new, though, so adoption isn't nearly as widespread as SPF, DKIM, or DMARC.

Re: My account is sending spam emails

#139

Post by massaman_yams »

thaumaturgy wrote: post #47
laurencei wrote: post #22

Earlier quoted context omitted.

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…

Re: others forging your domain by using Gmail - this is only true in narrow edge cases like this one (which appears to have been relatively quickly fixed by Gmail).

In practice, the Gmail and G suite UIs provide enforcement mechanisms to ensure you own a domain/address before allowing you to send from it.

Does it potentially open you up to spoofing if another loophole/exploit like this is discovered? Sure. But as risk factors go, depending on who you are, that's probably relatively low on the list.

Re: My account is sending spam emails

#140

Post by DanielDent »

Probably unrelated, but telus.net's SPF record appears to authorize RFC6598 (https://tools.ietf.org/html/rfc6598) IP space:

"v=spf1 ip4:199.185.220.0/24 ip4:198.161.157.0/24 ip4:198.161.156.0/24 ip4:204.209.205.0/26 ip4:209.171.16.0/24 ip4:100.64.0.0/24 mx ?all"

100.64.0.0/24 is within 100.64.0.0/10

Either I'm missing something, or Telus appears quite confused about the purpose/nature of SPF.

Post reply on HN