Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My account is sending spam emails

productforums.google.com

Post reply on HN
Print view View original

71–80 of 154 posts

Re: My account is sending spam emails

#71

Post by logicallee »

antoncohen wrote: post #45
laurencei wrote: post #22

Earlier quoted context omitted.

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

There is something strange about those headers. Are they all from the same email? There are two Received: with by mx.google.com , and they are nearly two days apart. And there are two Received-SPF: headers. Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sen…

>Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail.

On the principle of least surprise, this would seem to be incomplete behavior. I bet every single person reading this was surprised.

It's not a bad place to put such mail, so I suggest that on its web and mobile interface, Gmail simply put some kind of badge for sent mail sent from outside Gmail or your devices. Example:

https://imgur.com/a/KEMf1HM

(Notice the ⓘ [circled i] in the first line.)

Source: I mocked above up from Google image search for "gmail sent folder" and an open clipart "information icon".

If you click on that i or hover it should mention that some of these messages were sent from outside Gmail or from your authorized devices but have been put in your Sent folder because your email address is in the from: field.

Re: My account is sending spam emails

#72

Post by sounds »

ahje wrote: post #69
mgcunha wrote: post #55

Earlier quoted context omitted.

Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for S…

DMARC could solve this problem, but it would break a lot of things reliant on forwards. When Yahoo set their DMARC policy to reject, there was quite a stir about it: https://www.ietf.org/mail-archive/web/ietf/current/msg87153.... In this particular case, it seems the major issue is that spammers got access to 69.64.35.11, which is included in telus.com's SPF record. In the end, this will hurt deliverability for legit…

ryan-c comments below that the 'exists:' config at Telus allows any IP to send mail.

Spammers seem to be abusing this hole.

Re: My account is sending spam emails

#73

Post by freeflight »

laurencei wrote: post #39
jlgaddis wrote: post #38

Earlier quoted context omitted.

Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA : Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows…

The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?

It's probably been exploited for quite a while already, takes a certain time and threshold until these kinds of things fully bubble up to the public.

People who've been affected might not have noticed or cared enough to say/do something.

Re: My account is sending spam emails

#74

Post by angry_octet »

logicallee wrote: post #71
antoncohen wrote: post #45

Earlier quoted context omitted.

There is something strange about those headers. Are they all from the same email? There are two Received: with by mx.google.com , and they are nearly two days apart. And there are two Received-SPF: headers. Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sen…

>Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail. On the principle of least surprise, this would seem to be incomplete behavior. I bet every single person reading this was surprised. It's not a bad place to put such mail, so I suggest that on its web and mobile interface, Gmail simply put some kind of badge for sent mail sent from outside Gmail or your devices. E…

People notoriously won't know what a new badge means, and this being an uncommon scenario, no one will, panic ensues.

It might be better if such email was automatically marked as spam until the user marks it as good. If they keep doing that, then that send path should gain elevated trust. (I mean, they are using some ML system here right?) I'm imagining an anti-spam-campaign supervisor system that also tracks spam with some sort of soft hash (or ML), running across many user's email.

Re: My account is sending spam emails

#75

Post by kome »

laurencei wrote: post #21

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my…

wow... reading this thread is scary. Google is a joke; my humble advice would be to close your accounts and pay for a better service, life Fastmail or Protonmail.

Re: My account is sending spam emails

#76

Post by obituary_latte »

thaumaturgy wrote: post #47
laurencei wrote: post #22

Earlier quoted context omitted.

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.152437…

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…

Gmail's sent folder isn't a sent folder in the traditional sense. It's a label that just filters mails based on the "from" address.

Re: My account is sending spam emails

#77

Post by Tepix »

obituary_latte wrote: post #76
thaumaturgy wrote: post #47

Earlier quoted context omitted.

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources…

Gmail's sent folder isn't a sent folder in the traditional sense. It's a label that just filters mails based on the "from" address.

That's a bug. Does anyone disagree?

Re: My account is sending spam emails

#78

Post by Spooky23 »

Keverw wrote: post #8

I got 2 of these a hour ago. "This may be a spoofed message" Google says, I clicked spam even though it's from myself. It was to me and a bunch of other emails. Wasn't in my sent folder though and no one else has accessed my account. "Sexy Girls Asian Girls Looking for US Men" is the subject and says it's sent from "----------------- via telus.com" Really odd, seems to be some ISP in Canada and I live in the USA... W…

Weird. My wife and I got the same email.

Re: My account is sending spam emails

#79

Post by admin1239 »

ryan-c wrote: post #44
ryan-c wrote: post #23

Earlier quoted context omitted.

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…

Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send…

asda

Re: My account is sending spam emails

#80

Post by admin1239 »

ryan-c wrote: post #44
ryan-c wrote: post #23

Earlier quoted context omitted.

Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results. The current SPF records for telus.com don't seem to allow sending by 69.64.35.11. Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed? Also, the timestamps on the received headers differ by a l…

Telus has this entry: exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com Reading RFC 7208, that would be expanded to exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com which means if that any record exists at that name, it will pass. dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com 127.0.0.1 trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send…

waaaaa
Post reply on HN