From the way the emails are sent, I bet it's an Android security hole.
My account is sending spam emails
31–40 of 154 posts
Re: My account is sending spam emails
#32Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…
You could make a filter like this:
The email is spam if FROM and TO address = my.email.fake@gmail.com AND Return-Path is not = my.email.fake@gmail.com
So you could still send emails to your self and they would not get flagged as spam.
Re: My account is sending spam emails
#33Relevant security issue Gmail declined to fix over a year ago: https://www.zdnet.com/article/spammers-delight-gmail-weirdly...
Re: My account is sending spam emails
#34This strategy seems odd. If they had simply omitted the spoofed sending email address from the To:/(B)cc lines, we'd never had seen them in our inboxes... right? Why call early attention to yourself?
I had 24 in my Inbox starting as 6:13PM (GMT-7).
Re: My account is sending spam emails
#35Earlier quoted context omitted.
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…
You could make a filter like this: The email is spam if FROM and TO address = my.email.fake@gmail.com AND Return-Path is not = my.email.fake@gmail.com So you could still send emails to your self and they would not get flagged as spam.
The thing is I've used Gmail for nearly 10 years (give or take) - and I've never once had a spoofed email reach my inbox. Ever.
Something must have changed, most likely in the past 24 hours (give or take) to allow this to suddenly occur? Or someone's worked out a way passed the gmail spam filters or something.
Either way - this is clearly "new".
Re: My account is sending spam emails
#36I had the same issue tonight. It did not appear in my sent folder, however, and was sent from the same “reply@telus.com” account that everyone else reports. The most recent one (of 5 sent so far) was sent 2 minutes ago. I changed my password an hour ago - but as I suspected that didn’t help because these aren’t being sent via compromised accounts. Someone is using an SMTP server and just spoofing the sent from address.
Re: My account is sending spam emails
#37I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender.
That's why the SPF check doesn't fail.
However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.
Re: My account is sending spam emails
#38Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…
Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles.
----
ETA: Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows up under "Sent" as well.
After opening up "Show Original" in a new tab and then returning to the message, there's now a small banner (with a yellow background) at the top that reads:
> This may be a spoofed message. Gmail couldn't verify that it was actually sent from your account. Learn more.
Re: My account is sending spam emails
#39Earlier quoted context omitted.
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…
Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA : Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows…
The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?
Re: My account is sending spam emails
#40Earlier quoted context omitted.
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender. That's why the SPF check doesn't fail. However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.
It's not being sent from any of the IPs listed under _spf.google.com, though.