Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

daedal.io

Post reply on HN
Print view View original

201–210 of 242 posts

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#201

Post by delfinom »

LiamPowell wrote: post #110
alpaca128 wrote: post #97

Earlier quoted context omitted.

On YouTube I reported bot accounts for a couple days, the only reaction I got was that at some point it showed a popup that told me too many false reports would lead to a ban. Not sure what Google gets out of it, but there is no way they could be that bad at fighting bots unless they're not even trying. Even trivial tricks like copy-pasted texts keep working.

They're not trying. I've seen an advertiser remain active for months with literally tens of thousands of ads where clicking them directly downloads a malicious exe file that most antivirus scanners flag.

We had that issue of someone advertising fake clones of our sites specifically to push fake malware ridden payloads. We only got it handled by bugging internal contacts at Google. It sucked and worse we had to bug them for weeks because the attacker was churning through multiple domains and probably over 100 breached Ad accounts by the time they stopped

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#202

Post by cucumber3732842 »

ilamont wrote: post #171
eblume wrote: post #168

Earlier quoted context omitted.

Having worked in compliance engineering I have also reported through the IC3 portal, and spoken with lawyers and analysts who register with FinCEN (which, to be clear, is maybe just a step beyond "My Uncle works at Nintendo...") and I have heard that those reports do get reviewed and often acted on, but yes, you will typically never hear back from them. (FinCEN has its own reporting structure, but we also submitted c…

Honestly, the "acted upon" part needs to be highlighted in tangible ways, otherwise people will be suspicious that nothing ever happens to our reports, leading to fewer reports being submitted. During the IC3 reporting process I was asked to submit the name of people behind the scam, if known. I knew one of them because the scammer asked for a wire transfer to a named account at a bank in Oregon. Probably a mule. Doe…

"Acted upon" in these sorts of bulk data contexts typically means "charge them for an extra count when we pick them up for something else".

It's like the internet crimes version of putting the serial number of stolen property in a police report. They ain't looking for it, but they'll tack the charge when they inventory a crackhouse bust and that number pops up stolen.

They aren't dedicating serious resources to speculatively looking at the reports and trying to assess patterns like some TV cop looking at a series of dead hookers and saying "aha we have a serial killer on the loose".

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#203

Post by mattbee »

pessimizer wrote: post #160
tag2103 wrote: post #140

Rhetorical question- but what is it going to take for the IT Community to start treating Gmail and the rest of the "too big to block" as adversarial entities and actually block them for their bad behavior. Pie in the sky I know.

> IT Community No such thing. And if you just want to assign anybody who works in IT to it in order to create the concept of such of a thing, a large percentage of this community would work at Google, a company that depends on Google, or a company that has the same attitude as google. So it's less pie in the sky than nonsense. People don't talk about things changing in the physical world without talking about force,…

There was a time before Google when various mailing lists of grumpy sysadmins in key institutions could decide the fate of a new mail sender, internet-wide. But yes that "internet community" is small fry now, and can only cut off their own noses if they don't like Google's mail policies.

Before Google, AOL were the previous big-beast mail host, and they did provide some tools to help diagnose why you couldn't get through to their users. It still felt like there was more of a balance of power towards the grumpy sysadmins.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#204

Post by advisedwang »

ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

Did the letter identify you as a lawyer? I wonder if Google handles it differently if it has a law office letterhead etc.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#205

Post by [deleted] »

unmole wrote: post #19
bmandale wrote: post #18

Earlier quoted context omitted.

>How do they get money for free? market power >What is stopping everyone else from doing the same? see above

Nice circular reasoning you got there. How do they have market power? Did they get it for free?

[deleted]

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#206

Post by eudamoniac »

canadapups wrote: post #177
LiamPowell wrote: post #110

Earlier quoted context omitted.

They're not trying. I've seen an advertiser remain active for months with literally tens of thousands of ads where clicking them directly downloads a malicious exe file that most antivirus scanners flag.

They're definitely not trying - in any form. I run a marketplace for dogs (i.e. craigslist for puppies & dogs) and scammers are always trying to post fakes ads. They always use Gmail accounts. Every time I ban a gmail address, they scammers will just get a new one. Same scammer/person has created thousands of gmail accounts and Google doesn't care. I have reported this to Google. For the amount of info Google has on…

Shadowbans work much better for this purpose

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#207

Post by tiberious726 »

mschuster91 wrote: post #165
mixologic wrote: post #157

Earlier quoted context omitted.

DMARC isn't really that big of an issue to wrestle with, and I don't see how it gives anybody influence or power.

The thing is, it's a mess to set up if you are not doing it correctly - which is all too easy if you are not doing this day-to-day. Spammers however, they have an economic incentive to have experts set up SPF, DMARC and all the other crap to appear legitimate.

I set up my orgs SPF/DKIM/DMARC (we self host, they have feelings about corporate data sovereignity...) it look about 30 min having never touched them before, and maybe another 15 to write an ansible playbook to rotate the keys.

We do have a _tremendous_ amount of spam fail these checks, as well as a few legitimate organizations.... Some of our peer companies have sent out notices that they will bounce anything that fail these checks in the coming years, and we're probably going to to do the same before too long.

It's trivially easy, and absolutely valuable

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#208

Post by ilamont »

advisedwang wrote: post #204
ilamont wrote: post #105

I got a human being at Google to look into my problem and take action after sending a police report to Google‘s legal department certified mail return receipt along with a letter describing how someone was impersonating me and my business using a Gmail address in an attempt to commit fraud. Yes, it was a pain to take all of these steps and it probably took about 3 hours but it was absolutely necessary considering the…

Did the letter identify you as a lawyer? I wonder if Google handles it differently if it has a law office letterhead etc.

No, I did not identify myself as a lawyer. I just wrote the letter as a victim of a scammer using Google services to impersonate me.

But I was careful to use certified mail return receipt as google’s legal office knows that this can be used for documentation and proof if the case ever goes further.

In other words, having a paper trail is more likely to get acted upon.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#209

Post by avian »

ethan_smith wrote: post #183
avian wrote: post #144

Somewhat related to spam coming from Google servers, maybe someone can shed some light on what could be the motivation behind this activity: In recent months I'm seeing instances where random personal mail accounts on a server I run would receive a barrage of mail in a short amount of time. Mail seems to be bounced via Google Groups - they are sent from Google's IPs and have headers like X-Google-Group-Id, List-*, et…

This is almost certainly subscription bombing / email bombing. The goal is to flood someone's inbox with hundreds of legitimate-looking automated emails so they miss a real one - typically a password reset confirmation, a purchase receipt, or a "new device login" alert. The actual attack is happening on some other service where the victim has an account. The fact that you don't see it on your server doesn't mean much…

Thanks. It might still turn out to be this.

My thinking so far against was 1) after a few months I'm pretty sure I would hear about the real attack 2) Repeating too frequently. People aren't getting hacked all the time (I hope).

But who knows? Now I'm thinking that maybe some other step in the attack is failing and maybe the attackers just trigger the email bomb part pre-emptively in case they actually succeed in resetting the password/purchasing/whatever.

Re: FSF trying to contact Google about spammer sending 10k+ mails from Gmail account

#210

Post by sowbug »

miroljub wrote: post #101
noobermin wrote: post #96

Earlier quoted context omitted.

I hope you realise, it does sound like you are suggesting that salespeople in your company are essentially spammers.

Most of the salespeople in any company are spammers.

No, you don't understand. The people at my company are auto-opt-in premium-communication value-add customer-relationship-establishment specialists. But otherwise, I agree with you: everyone else is a spammer.
Post reply on HN