Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My account is sending spam emails

productforums.google.com

Post reply on HN
Print view View original

41–50 of 154 posts

Re: My account is sending spam emails

#41

Post by jlgaddis »

Don't freak out about them being in your Sent folder. Remember that Gmail doesn't have "traditional" mail folders -- just a huge pile of all your e-mail messages with "labels" attached to them. Apparently Google decides that if the From: address is yours, then you "sent" the message.

Note that in SMTP there are two "from addresses": the envelope sender (which you don't see) and the "From:" address/header (which you do see) that everyone is familiar with. In most (but not all) legitimate e-mail, they will be the same.

In these cases, your e-mail address is being used in the "From:" and "To:" headers but a different address is being used in the envelope sender (which is the one that the MTA uses).

Google does seem to be checking SPF correctly (i.e., according to RFC, which says to use the envelope sender) -- since (it seems that) the result of check_host should be "softfail" and the RFC says that one "SHOULD NOT" reject a message based on that... but Google apparently logged "pass". Odd.

---

ETA: See a comment from ryan-c below about the funky "exists:" mechanism in Telus' SPF record; it explains why check_host() passed.

Re: My account is sending spam emails

#43

Post by c3534l »

There was an attack going around many years ago that was basically a spam email that had code embedded in it, which would hack your browser, causing you to send out more spam email when you logged into your account. I assume this is the same sort of thing.

Re: My account is sending spam emails

#44

Post by ryan-c »

ryan-c wrote: post #23
ninjaranter wrote: post #16

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal:…

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…

Telus has this entry:

    exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com
Reading RFC 7208, that would be expanded to

    exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com
which means if that any record exists at that name, it will pass.

    dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com
    127.0.0.1
trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.

Re: My account is sending spam emails

#45

Post by antoncohen »

laurencei wrote: post #22
laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

There is something strange about those headers. Are they all from the same email?

There are two Received: with by mx.google.com, and they are nearly two days apart. And there are two Received-SPF: headers.

Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail.

Re: My account is sending spam emails

#46

Post by Operyl »

c3534l wrote: post #43

There was an attack going around many years ago that was basically a spam email that had code embedded in it, which would hack your browser, causing you to send out more spam email when you logged into your account. I assume this is the same sort of thing.

Nope. This is just Gmail appending the "Sent" label to an email that you received from "you". You didn't actually send it, it was just a spoofed From header.

Re: My account is sending spam emails

#47

Post by thaumaturgy »

laurencei wrote: post #22
laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources -- usually multiple received headers form a chain of custody for the email, and this looks like two different sources somehow both sent the same message ... maybe one of those is forged?).

The only part of this that looks like a Google-specific bug to me is that I'm not sure Gmail should be dropping messages into your Sent folder that did not originate from your authenticated account. If you send a message using some other mail client that logs in to your Gmail account, or an app, or the web app, sure, but if a message just pops into your account with your address as the "from:" header, it shouldn't show up in your Sent label.

The rest of this is just email being as broken as it usually is.

SPF only checks the envelope-from. It doesn't check the other "from:" header. Anybody can easily clone anybody else's SPF records, so any service that allows you to route mail through them and has already cloned Google's SPF records (so that users can send mail through Gmail's servers using their @telus.com address) is vulnerable to this.

If SPF were changed to also check the other from: header, then it would break every single domain that uses Google's mail hosting services but hasn't updated their SPF records. So that's never gonna happen.

This is maybe the biggest reason I wish people would stop using Gmail for any kind of important mail services. The moment you do that, mail from your domain can be spoofed by any other outfit that also uses Gmail, and it will pass SPF, which means it'll cruise right through most spam filters.

DKIM can resolve some of this, but it comes along with a suitcase full of its own nightmares.

Re: My account is sending spam emails

#48

Post by stephengillie »

laurencei wrote: post #39
jlgaddis wrote: post #38

Earlier quoted context omitted.

Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA : Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows…

The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?

Maybe some dark-hat's side project finally reached a major milestone and was released?

Re: My account is sending spam emails

#49

Post by spacehunt »

antoncohen wrote: post #45
laurencei wrote: post #22

Earlier quoted context omitted.

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

There is something strange about those headers. Are they all from the same email? There are two Received: with by mx.google.com , and they are nearly two days apart. And there are two Received-SPF: headers. Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sen…

The extra ones are probably made up by the spammer trying to trick Google's anti spam machinery.

When I was an anti-spam engineer 10 years ago, we saw this sort of tricks all the time. Basically the only headers you can trust are the ones inserted by your own infrastructure. DKIM does mitigate this somewhat, but of course has its own problems.

Re: My account is sending spam emails

#50

Post by jlgaddis »

antoncohen wrote: post #45
laurencei wrote: post #22

Earlier quoted context omitted.

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

There is something strange about those headers. Are they all from the same email? There are two Received: with by mx.google.com , and they are nearly two days apart. And there are two Received-SPF: headers. Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sen…

The last Received: and Received-SPF: headers are forged. It's pretty common for spammers to do that, apparently in an attempt to "trick" either spam filtering software or a person looking at the headers.
Post reply on HN