Slashdot Log In
Gmail As Open-Relay Spam Server
Posted by
kdawson
on Sat May 10, 2008 08:14 PM
from the if-you're-not-part-of-the-solution-you're-part-of-the-precipitate dept.
from the if-you're-not-part-of-the-solution-you're-part-of-the-precipitate dept.
sveard writes of a little problem Google is having that has Gmail acting like an open relay. Compounding the issue is the fact that services such as Hotmail and Yahoo trust Gmail as a source of mail. "A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
doesn't stop spam, (Score:2, Insightful)
You should have known (Score:4, Funny)
Parent
Wow, slashdot doesnt give a crap (Score:2, Informative)
But, on topic, this really isn't all the surprising. Pretty much any email server can be used as a relay in this manner, the only thing special here is that it avoids Google's current features. I expect Google will have this locked down very soon.
Re:Wow, slashdot doesnt give a crap (Score:4, Interesting)
Certainly, but this can be reduced by making sure that e-mail coming from the outside world can only be sent to gmail addresses and e-mail going to the outside world requires password authentication by the sender. One issue that we are starting to see it e-mail being bounced to a different part than the one that officially sent the e-mail. Other measures that can help is only accepting e-mail from external mail servers who's name can be resolved from its address.
The real problem is really deciding what is a legitimate source of e-mail, without requiring a central registry of e-mail servers or some other sort of bureaucratic process.
Parent
Re:Wow, slashdot doesnt give a crap (Score:5, Insightful)
The other problem is, Hotmail and Yahoo trusting Gmail. In the world of email, there is no such thing as a trustworthy server.
Parent
Re: (Score:3, Insightful)
Re:Wow, slashdot doesnt give a crap (Score:5, Insightful)
> source of e-mail, without requiring a central registry of
> e-mail servers or some other sort of bureaucratic process.
Well that's the problem that SPF solves. Each domain owner
creates a DNS entry that specifies which mail servers are
permitted to send mail for that domain. When an MX receives
a HELO it checks that the originating IP corresponds with
the DNS entry; if not, the mail can be rejected or subjected
to further inspection and scoring.
Simple to implement, I've done it in 20 minutes for my domain
( 20 minutes from ``What is this project?'' to submitting the
DNS change ).
http://www.openspf.org/ [openspf.org]
Parent
Re: (Score:3, Funny)
I'm guessing giving these guys a million dollars and saying 'make spam stop globally' might just work.
It's worth a try.
Idiots better get off their ass (Score:5, Informative)
I have already checked my server logs and the fun just started a little while ago. Yay!....
Interesting... (Score:5, Informative)
Because that's when the existence of the vulnerability was already known, at least. The people who figured it out aren't telling the world how to do it (I'm sure clever people can figure it out), and are / were waiting for Google to fix it first.
http://ece.uprm.edu/~andre/insert/gmail.html [uprm.edu]
You might be seeing plain ol' spam from gmail; it's been having its share of problems with spammers since both captcha crack -and- before that by manual sign-up, simply -because- everybody trusted gmail (what, with the forced SMS/Text Message sign-up, invite-only, etc. preceding).
Parent
Re:Idiots better get off their ass (Score:4, Interesting)
Unfortunately, this sort of thing will continue to crop up. E-mail is fundamentally broken, and it's too easy to take advantage of any e-mail system. To combat spam, mail admins have had to take many unorthodox and RFC-bending practices (if not out-right ignoring RFCs all together). Otherwise, users complain about too much spam. The down side, users then complain about e-mail delays or non-deliverables. So, you get systems setting up certain ways to bypass filters for hopefully trusted domains. And then this whole new problem comes up when people figure out new ways to abuse the system, its safeguards, and hidden/implicit trusts.
Ugh. At this point, I just want to turn SMTP off completely. This is a losing battle.
Parent
Re:Idiots better get off their ass (Score:5, Interesting)
I hear this being said over and over again. The problem is that no one has been able to provide a solution to resolved the problem. There have been suggestions, but doing so without penalizing the small guy is hard. Do we require certificates and if we do how can we ensure that it will be 100% fool proof? Do we only accept e-mail that hasn't been relayed or only accept mail from white listed relays, or create rules for them, if relays are to be tolerated in certain conditions?
Parent
Re:Idiots better get off their ass (Score:4, Interesting)
There are trivial technical solutions for the spam problem if only we could get rid of SMTP.
Ofcourse "we" can't but my hopes are that google may do it eventually. They could roll out a new system on a large enough scale to actually make it stick.
Parent
Re:Idiots better get off their ass (Score:5, Insightful)
Spam exists because there are sociopaths who want to steal resources from others. There is *NO* technical solution to this. If your SMTP replacement allows anyone to contact anyone else, it will allow spammers to contact anyone.
Spam is a social problem, not a technical one. There is no such thing as a technical solution to a social problem.
Parent
Re:Idiots better get off their ass (Score:5, Insightful)
That's generally true.
The problem is that SMTP makes it drastically worse than it needs to be with a push model. The spammer can send a million messages, and they've all already been accepted by the destination server before anyone has a chance to complain.
If it were a notification / pull model then when someone complained the ISP could pull the spammer's plug for a TOS violation before most of the messages in his first batch were delivered. Sure, that doesn't kill the spam problem utterly dead - but it does mean that current spam management resources could keep it down to well under 90% of all email.
Parent
Re:Idiots better get off their ass (Score:4, Insightful)
The thing is that we can already achieve the same effect through a combination of greylisting and a trustworthy blacklist: an unknown (non-whitelisted) sender cannot deliver messages immediately, and if they're one of the few spammers who will retry deliver after a temporary failure, then by that time odds are that they will have been blacklisted.
Sure, it's possible that a pull model might prove slightly more effective even so, but neither model will ever kill spam dead. And "possibly slightly better at dealing with spam, but probably just the same" isn't nearly enough to justify uprooting the world's entire email infrastructure.
Parent
Re: (Score:3, Insightful)
before anyone has a chance to complain.
Re:Idiots better get off their ass (Score:4, Insightful)
Cost, plain and simple. The fundamental way to reduce spam is to make it cost more to do. Of course actually figuring out a good way to do that is left as an exercise for the reader.
Parent
Re:Idiots better get off their ass (Score:4, Insightful)
Thank you for illustrating my point.
Parent
Re: (Score:3, Interesting)
Simply extending the junk fax law to cover email spam would be easy. The money saved in dealing with people's incoming spam would be more than enough to do the necessary enforcement of the laws, with such a cl
Re:Idiots better get off their ass (Score:4, Interesting)
C/R is annoying because people want their messages to be delivered, without additional work. It's not even that I have to scan a spambox, or that they look like any other e-mail. It's that I have do to ONE MORE THING to have the message delivered. If this had been the way e-mail worked originally, then people might accept it; but now, everyone is used to sending e-mail and having it arrive without interruption (generally speaking).
Respectfully, I'm pretty convinced that it will not work unless the spam problem becomes so excessively bad that people are willing to change their e-mail habits. We are not yet to that point, thanks to all the other half-baked anti-spam solutions out there.
Parent
Re:Idiots better get off their ass (Score:5, Interesting)
This is like complaining that wheels don't protect against being rained on, so cars should be redesigned from scratch.
Parent
Re: (Score:3, Interesting)
The problem is that no one has been able to provide a solution
E-mail is fundamentally broken
In other words, it is fundamentally broken, because it is fundamentally unfixable.
Interestingly however, I would like to argue for the exact opposite. The original intent and nature of email was to be completely open. The fact that it is so *perfect* at being open has made it *impossible* to close parts of it that are no longer desired.
As problem solvers we like to think we can solve problems with solutions, but this is a case where we are
Re: (Score:2, Funny)
Re:Idiots better get off their ass (Score:4, Informative)
Parent
Re:Idiots better get off their ass (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
Re:Idiots better get off their ass (Score:5, Informative)
The spammers don't care about what their FROM and REPLYTO fields actually say. Since this is a man-in-the-middle attack they could put practically anything with a @gmail.com in those fields and it will render your solution ineffective.
The real problem with this exploit is that it bypasses all of Google's security measures and anything I could do on my end would only verify that the email actually came from a real Google mail server and from a Google email user. So then I can only rely on SPAM filtering based on content which is not as effective as we would all like it to be.
Parent
Re: (Score:3, Informative)
Re:Idiots better get off their ass (Score:4, Informative)
Won't work.
There are boatloads of people and companies using Google with their own domains. Google Apps, Google Enterprise, etc.
Also, many of the spammers are using gmail addresses. Remember, they don't care about return emails, they just drive people to their websites.
Parent
Re:Idiots better get off their ass (Score:5, Insightful)
In practice, however, Google is likely to do just that anyway, and since there is no organized blacklisting going on, a sole action by the GP poster would most likely annoy his users while Google itself wouldn't even notice it.
(Unless, of course, the GP happens to be the sysadmin for Hotmail, Yahoo! Mail or something similar - in that case: Blacklist, baby!
Parent
Re:Idiots better get off their ass (Score:4, Insightful)
SpamCop and SpamHaus blocking Google? How do they say it... When Pigs Fly?
People that use both of those services, free and paying customers alike, rely on them automatically managing their lists. I am sure, and I am certainly adding myself to this, that "we" don't expect these services to add Hotmail, GMail, Yahoo, etc. You can also toss Comcast, AT&T, Time Warner's Roadrunner, Cox, etc. to the list too.
Unfortunately, there is such a thing as being too big to blacklist. I don't know how many millions of customers that it starts at, but GMail passed whatever mark that was a long time ago.
Organized blacklisting only applies to much much smaller entities.
Parent
Re: (Score:3, Interesting)
On a few mail installations I've done, it watches for abusers, and blocks them with firewall rules, based on other detections including SpamAssassin.
So even my own mail system would block gmail if it detects enough spam coming from them. The threshold is high enough to not false, and low enough to stop most of the badguys. On a typical server (~50k msg/day) something like 1500 get blocked daily, with no complaints th
Re: (Score:3, Insightful)
The customer does not care about Google and Relaying or any other techno gobbletly gook. They only care that email was being blocked. It is not even a GMail specific thing either. It can be ANYBODY not being able to communicate to them, real or imagined, a
Whitelists don't work. (Score:5, Insightful)
Re: (Score:3, Interesting)
A proper white list shouldn't include sites which are likely to be insecure, and it shouldn't grant a completely free pass either. Whitelisted domains do still get submitted to checks on well secured servers. DKIM and SPF being pretty much mandatory these days, as well as virus scanning and spam rating as well.
Really the po
Chronologically impaired? (Score:2, Informative)
They'll fix it if it gets enough bad publicity (Score:5, Insightful)
Bad publicity made Google fix their open redirector for URLs. Bad publicity will make them fix this.
GMail ought to go back to cell phone authentication for new accounts. Since their capcha was broken, they've become a favorite of spammers.
Blogspot is also a spam haven. Most blogspot blogs are spam, and they can be used as a form of open redirector. Look for spams like: "An IWC watch is a uniquely handcrafted time piece ... http://rexefute51720.blogspot.com/ [blogspot.com]"
Complain loudly, publicly, and often. Google needs to take stronger steps to avoid being a spam conduit.
Re: (Score:3, Insightful)
> URLs. Bad publicity will make them fix this
Your optimism is like a ray of Sunlight in a dark world, but I
fear it is misplaced.
Many USENET groups are virtually unreadable today because of the
torrent of spam posting originating from Google Groups accounts.
Thousands of users have submitted precise spam reports to Google,
quoting the article-IDs. Result? None. Consequence? USENETters
start to block any and all Google Groups postings
( thou
Ok, this is how it works.. (Score:3, Insightful)
"If you want everybody to to be able to contact you, then you will receive information you do not want."
Conversely, if you have a system where the recipient requests information ( such as for web-pages ) then you have the following problem:
"I you want everybody to be able to get information about yourself, then people you don't like could collect information about you."
There's no way around these very simple facts, the best you can do is to change what you expect from the service. As an example e-mail spam would be rapidly defeated if you limited yourself to only receive information from sources you have approved in advance, but that is to limited for most people. Because we want our friends to be able to give our e-mail addresses to their friends if they have something nice to tell us. Therefore we will get e-mails we don't want. If you want to change this you have to either change your expectations of what e-mail should do, or you have to change the behavior of people sending out spam. The easiest way to do the latter is to penalize business who do it.
Silly question (Score:4, Funny)
Re:DeBunking? (Score:5, Insightful)
i figure google will have this locked down soon enough though. It's not like they won't notice the sudden burst of traffic. Some guy is going to be working hard tonight.
Parent
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
Well, this ruins GMail's major argument. nNw all they have left is "You get 2 GB of storage".
Huh? What argument are you refering to, and how does this ruin it?
The only "argument" I can think you might be refering to is that, by using Gmail, you avoid having to see a lot of spam due to their excellent spam filterings. This doesn't ruin that argument in any way. In fact, since it primary impacts sites like Yahoo and Hotmail (who will see more spam if they continue to whitelist Gmail), it strengthens it. You're now see even less spam using Gmail, comparatively speaking.
Re:Blacklist gmail (Score:4, Funny)
Yes, who would do business with such an entity. Probably about as many as would trust their business hosting to a company who declares its home page to be XHTML 1.1 but then serves it as text/html. Not to mention the 88 validation errors.
The point is you can't jump straight for the "nuclear" option. Although to be honest I wouldn't use such a Web host.
Parent
Re:Blacklist gmail (Score:4, Funny)
http://validator.w3.org/check?verbose=1&uri=http://www.taylorbyrnes.org/ [w3.org]
Parent
Re: (Score:2, Insightful)
parent, INSIGHTFUL? (Score:3, Insightful)
You going to go an make some ideological bullshit point and piss all over your customers when it's not going to make the slightest difference to Google.
Go right ahead!
Re: (Score:3, Funny)