Yes my gmail spam has gone nuts!!!! Wtf has happened
My account is sending spam emails
51–60 of 154 posts
Re: My account is sending spam emails
#52Earlier quoted context omitted.
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…
Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send…
It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
Re: My account is sending spam emails
#53I’ve had similar problem a long time ago with my yahoo account. (Password change didn’t help)
So, I cleared my yahoo contact list and that stopped the spam.
Re: My account is sending spam emails
#54Earlier quoted context omitted.
This part is interesting: Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com I had thought that as of early 2017 that had changed the DMARC policy to p=REJECT which would basically reject any attempts at spoofing gmail.com in the From: field. I…
It appears to be validating the envelope sender (reply@telus.com) rather than the from address, per the spec. The thing is, telus.com doesn't have a DMARC record, and thier SPF record doesn't include 69.64.35.11. This header might be fake. Gmail does currently have a DMARC record that says p=none sp=quarantine. The 'sp' value only applies to subdomains, so the "none" (no action) policy should be used. Edit: I just ve…
[deleted]
Re: My account is sending spam emails
#55Earlier quoted context omitted.
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…
Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…
Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for SPF), or DKIM domain and From: header.
Re: My account is sending spam emails
#56Earlier quoted context omitted.
Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA : Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows…
The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?
No idea.
Apparently someone just found out about it and decided to try it out -- it's obviously "new" to a lot of HN'ers as well.
Re: My account is sending spam emails
#57This strategy seems odd. If they had simply omitted the spoofed sending email address from the To:/(B)cc lines, we'd never had seen them in our inboxes... right? Why call early attention to yourself? I had 24 in my Inbox starting as 6:13PM (GMT-7).
Maybe that’s part of the technique to trip up Google’s spam filters, as Google might have assumed that spammers would never bcc the sender and thus treat such mails as more likely to be legitimate.
Re: My account is sending spam emails
#58Just wanted to say, the top response on the google forum is exactly why google needs real support and not community members copy-pasting “solutions”.
Re: My account is sending spam emails
#59Earlier quoted context omitted.
Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…
Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for S…
You're right. I was thinking DMARC but wrote DKIM.
Re: My account is sending spam emails
#60Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…
Same too. The odd thing for me is that the client address (from the original text) was an AWS address. Only two appeared in the main inbox. More were sent straight to spam.
They appeared just after I turned on my AWS instance briefly. So I thought it was related.