Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My account is sending spam emails

productforums.google.com

Post reply on HN
Print view View original

21–30 of 154 posts

Re: My account is sending spam emails

#21

Post by laurencei »

Exact same thing for me.

Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder.

But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case".

However one interesting part is after about 4 hours the emails automatically became marked as "spam" - and they disappeared from my "sent" folder simulatenously.

So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels.

Seems this was flagged as a security risk over a year ago - and Google declined to fix? https://www.zdnet.com/article/spammers-delight-gmail-weirdly...

Re: My account is sending spam emails

#22

Post by laurencei »

laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com":

    Delivered-To: my.email.fake@gmail.com
    Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH
    X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none;
            d=google.com; s=arc-20160816;
            b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU
             +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ
             0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX
             jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN
             A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI
             ziIw==
    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
            h=date:message-id:subject:to:from:arc-authentication-results;
            bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=;
            b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB
             Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB
             69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG
             Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B
             xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM
             cc6Q==
    ARC-Authentication-Results: i=1; mx.google.com;
           spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com;
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Return-Path: 
    Received: from rine.play-wto.com ([91.203.70.10])
            by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19
            for ;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10;
    Authentication-Results: mx.google.com;
           spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com;
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for ;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
    Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245;
    from: Bitcoin Loophole 
    To: ,,,,,,,,
    Subject: Are you still alone?
    Message-ID: 
    Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
    X-EMMAIL: 
    Date: Sun, 22 Apr 2018 01:54:19 -0400

Re: My account is sending spam emails

#23

Post by ryan-c »

ninjaranter wrote: post #16

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results.

The current SPF records for telus.com don't seem to allow sending by 69.64.35.11.

Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed?

Also, the timestamps on the received headers differ by a lot. This one:

    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for ;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
appears to be identical (except for the email address) for the two sample sets of headers in the thread.

Re: My account is sending spam emails

#24

Post by zephharben »

ninjaranter wrote: post #16

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…

Yep - I received precisely the same message, among 3 others. They all had the same "Message-ID" header as your example.

Re: My account is sending spam emails

#25

Post by bertjk »

ninjaranter wrote: post #16

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…

This part is interesting:

  Authentication-Results: mx.google.com;
         spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com;
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
I had thought that as of early 2017 that had changed the DMARC policy to p=REJECT which would basically reject any attempts at spoofing gmail.com in the From: field. It seems as if someone suddenly (maybe accidentally) reverted that change?

Re: My account is sending spam emails

#26

Post by [deleted] »

laurencei wrote: post #22
laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

[deleted]

Re: My account is sending spam emails

#28

Post by FuckOffNeemo »

foota wrote: post #19
FuckOffNeemo wrote: post #6

My house mate has had the same issue today on both of his Google accounts. He is both the sender and recipient and there were several other nonsensical email addresses being CC'd in. SMTP headers show the emails are relayed from Telus. I'll provide the SMTP headers when I get home. = = = No unauthorised attempts to log in from third party sources, seperate passwords and MFA on both services. It doesn't seem to me tha…

What do the DKIM and SPF checks say?

Same as the others that have been posted.

DMARC failed and SPF shows that Telus.com was an approved SMTP relay for Google.com

Edit: posted into my original comment.

Re: My account is sending spam emails

#29

Post by wincy »

laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

Crazy, I'm glad it's not just me. Looking in my spam and there's dozens of them.

Re: My account is sending spam emails

#30

Post by ryan-c »

bertjk wrote: post #25
ninjaranter wrote: post #16

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…

This part is interesting: Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com I had thought that as of early 2017 that had changed the DMARC policy to p=REJECT which would basically reject any attempts at spoofing gmail.com in the From: field. I…

It appears to be validating the envelope sender (reply@telus.com) rather than the from address, per the spec.

The thing is, telus.com doesn't have a DMARC record, and thier SPF record doesn't include 69.64.35.11. This header might be fake. Gmail does currently have a DMARC record that says p=none sp=quarantine. The 'sp' value only applies to subdomains, so the "none" (no action) policy should be used.

Edit: I just verified that gmail's dmarc has had p=none for a long time.

Post reply on HN