Slashdot Mirror
Google Mail Servers Enable Backscatter Spam
Mike Morris writes "Google email servers are responsible for a large volume of backscatter spam. No recipient validation is being performed for the domains googlegroups.com and blogger.com — possibly for other Google domains as well, but these two have been confirmed. (You can test this by sending an email to a bogus address in either of the domains; you'll quickly get a Google-generated bounce message.) Consequently spammers are able to launch dictionary attacks against these domains using forged envelope sender addresses. The owners of these forged addresses are then inundated with the bounce messages generated by the Google mail servers. The proper behavior would be for the mail servers to reject email traffic to non-existent users during the initial SMTP transaction. Attempts at contacting them via abuse@google.com and postmaster@google.com have gone unanswered for quite some time. Only automated responses are received which say Google isn't doing anything wrong."
They are getting tagged with the moniker "the new evil".
I wonder how much of this has to do with the Microsoft to Google employee migration bringing the corporate culture with the people?
Work bio at MMWD
Ummm, how about the only behavior
It never ceases to amaze me how some mail server administrators setup policies on their networks. If you are running a mail server you are THE POSTMASTER. If you don't know where it should go, or who it is supposed to be going to, how can you accept it?
Refusing email and stopping the transaction when you do not control the domain, service the domain, or even know the mailbox user is about as obvious a policy as not relaying for domains outside of your control.
If it is an honest mistake on the part of the sending server, acting as an agent for the user, then a simple message informing the sender that the account does not exist is a trivial matter.
To do anything else just amazes me.
Didn't anyone notice that Gmail is still in beta?
FWIW, I use Google Apps to host my e-mail, and I have found Google to have horrible support.
Instead of fixing the problem, they'll just point you to a loosely moderated Google Groups newsgroup for Google apps, and you'll rarely receive a response, let alone a workable fix for an issue.
Do no evil? Or do nothing at all?
Brent Jones
We're writing to let you know that the group that you tried to contact (example12345) doesn't exist. There are a few possible reasons why this happened:
* You might have spelled or formatted the group name incorrectly.
* The owner of the group removed this group, so there's nobody there to contact.
If you have questions about this or any other group, please visit the Google Groups Help Center at http://groups.google.com/support.
Thanks, and we hope you'll continue to enjoy Google Groups.
The Google Groups Team
In other words, while this causes backscatter, this is not an avenue for "backscatter spam", since Google isn't delivering the contents of arbitrary messages to arbitrary users.
It sounds like the submitter wants to blow this out of proportion by equating general backscatter (which nearly all mailing list managers on the Internet generate with their "confirmation" messages) with backscatter spam.
http://outcampaign.org/
I'm not trying to belittle your effort in any way but, after reading over your page I have to ask, what exactly does tarmail do that postfix, or any other SMTP server commonly used these days doesn't?
Quite familiar with it, and it doesn't really apply to this suggestion, though I could shoehorn it into several categories. The form is broad enough that it will absorb anything, including your lunch. If you think it does apply without the big shoehorn, then please say why.
That form was a funny joke the first few times it was used. Since thing it has simply become a generic excuse for "No, we cannot."
Actually, I don't think there is any way to truly address the spam problem without dealing with the TANSTAAFL problem. The creators of email pretended that it would be mutually beneficial, so they did not need to design any accounting into it. While I actually admire Al Gore, I feel like I have to blame him as the root of the spam problem. He kept telling them 'Don't worry about the money--I'll get it for you.'
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
I guess that's the thing that most amazes me about the spam problem... Many of the big-time spammers are clearly large-scale criminals advertising their criminal wares, and apparently we are unable to do anything about it?
Just this week they apparently discovered a botnet larger than Storm. (http://www.theregister.co.uk/2008/04/07/kraken_botnet_menace/) The report says that the botnet was spewing out vast quantities of spam for the usual quasi-legal scams. So how the heck could they miss it? Possible answer: Because the filtering approach was mostly working.
Remember that the spammers are dividing by zero. At least that's how they think about it. If another million spams finds one more sucker to send them $39, then they think the RoI was $39/0 = infinity. They aren't concerned with your spam filters. If you're smart enough to filter their spam, then you probably aren't dumb enough to send them the money--but they're still hoping to catch you with their next scam.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Recommended solution: learn to type URLs more quickly.
This "story" is idiotic. What google is doing is not only not wrong, but about as "right" as it's possible to be.
1. Giving an immediate "yey" or "nay" to every "Is this a valid email address?" is a terrible idea. This would allow anyone to trivially dictionary attach google for valid email addresses. Having a valid from address and checking responses is MUCH more difficult for spammers.
2. Google doesn't include the message on the bounce! THERE IS NO SPAM INVOLVED WHATSOEVER.
So the hypothetical abuse this whiner is complaining about is that a spammer could "hypothetically" indirectly flood a mail account with Google bounce messages. Ok, great. So why not send 1000 messages straight into your mail account, instead of sending 1000 messages indirectly through Google into your mail account? In the latter scenario you can actually deliver spam in those 1000 messages, in the former they're getting a Google form letter.
This makes no sense at all. There is no "abuse" and no "evil", and not even any "spam" here. Whoever wrote this story, and whoever OKed it at Slashdot (*cough*kdawson*cough*) are clueless about how e-mail works.
The sites that you guys are talking about explicitly ask your *gmail/yahoo/aol* password before they go and query for your buddy list.
Follow usual security guidelines-
1> Read before you enter
2> Use different passwords for different sites
3> Never give password of site A to site B.
FYI, the sites also have a microscopic "skip" link present on the *send invitation* page.
What? Some site asked for your email password, and you gave it to them? Shouldn't people reading Slashdot know better than this?
Maybe not
Is what I know this as. I used to get so much spam it drove me crazy. I set up filter rule after rule, used RBLs and everything but it only helped partially. I could still live with it. But eventually, I was hit by huge waves of collateral spam and eventually got more of that then the real thing*, and that was when I decided email was either going to be entirely useless to me or I had to do something very drastic.
I opted for something drastic. I still have a large number of filter rules, but in addition to that, I use a whitelist instead of a blacklist to filter email, and everything not on my whitelist that survives the spam filter rules ends up in a bulk mail folder I check about once a week. Now if someone I don't know emails me, that stinks, and I constantly have to adjust my whitelist to allow for more addresses, but at least I barely see any spam - real or collateral - anymore. Without that I'd have given up on spam altogether.
*) In the order of several 1000 a day
If a train station is a place where a train stops, what's a workstation?
There is a simple solution to forged DSNs (bounces). Sign the MAIL FROM of your outgoing mail with something like SRS or BATV: SRS0=keTrY=UY==user@example.com All bounces (MAIL FROM is empty) must be directed to a signed localpart with a valid hash key. If not, the bounce is immediately rejected, with a snooty message if so desired.
"Now gluttony and exploitation serves eight!" - TV's Frank