Slashdot Mirror
Gmail As Open-Relay Spam Server
sveard writes of a little problem Google is having that has Gmail acting like an open relay. Compounding the issue is the fact that services such as Hotmail and Yahoo trust Gmail as a source of mail. "A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail."
but is very effective against slashdot comments?
Apparently, no one here cares:P
But, on topic, this really isn't all the surprising. Pretty much any email server can be used as a relay in this manner, the only thing special here is that it avoids Google's current features. I expect Google will have this locked down very soon.
If sharing a song makes you a pirate, what do I have to share to be a ninja?
Speaking as a mail server administrator I sincerely hope that they fix this pronto. There is no way that I can just block gmail addresses from my mail server given how huge gmail already is. I literally have no choice but to ride this out and hope for the best.
I have already checked my server logs and the fun just started a little while ago. Yay!....
This flaw is valuable because it's clear proof that whitelists don't work. No domain is above suspicion when it comes to sending spam. About the only real use the domain can be is as an adjustment to your filters. Done properly, mail from gmail.com is marked as less likely to be spam than mail from cyberpromo.com, but it's still checked.
Good, inexpensive web hosting
Did anyone else notice that this story appeared AFTER the story above it? I almost missed the story entirely.
Well, this ruins GMail's major argument. nNw all they have left is "You get 2 GB of storage".
-- (this is a sig) My Computer Programming Forumhttp://www.programers.co.nr/
...was "a little while ago" on thursday?
Because that's when the existence of the vulnerability was already known, at least. The people who figured it out aren't telling the world how to do it (I'm sure clever people can figure it out), and are / were waiting for Google to fix it first.
http://ece.uprm.edu/~andre/insert/gmail.html
You might be seeing plain ol' spam from gmail; it's been having its share of problems with spammers since both captcha crack -and- before that by manual sign-up, simply -because- everybody trusted gmail (what, with the forced SMS/Text Message sign-up, invite-only, etc. preceding).
Yes, who would do business with such an entity. Probably about as many as would trust their business hosting to a company who declares its home page to be XHTML 1.1 but then serves it as text/html. Not to mention the 88 validation errors.
The point is you can't jump straight for the "nuclear" option. Although to be honest I wouldn't use such a Web host.
im not really surprised that you're not really surprised
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
I think that the problem may be that there are still too many people who believe the jargon... "Do no evil." (Or something to that effect at any rate...)
"So long and thanks for all the fish."
I don't know what company you work for that allows you to get away with this, but blaming other people is the last thing you do when you communicate to your users or customers. Even if it is Google's fault, blocking them is going to hurt your customers - and consequently yourself.
What planet are you from? No self respecting ISP in the world would try pull that.
You going to go an make some ideological bullshit point and piss all over your customers when it's not going to make the slightest difference to Google.
Go right ahead!
It's just a beta guys. There's going to be bugs in the system =)
I noticed that gmail load times increased significantly during a few periods yesterday afternoon. After the most recent gmail flaw, I wondered if it was something like this.
I hope they fix it soon, as some have already stated. Sheesh, and we just implemented the new SPAM filter...what am I going to do about gmail addys?
Why can't we go back to using jumpers to configure slot adapter cards? Why? I say!
Declaring XHTML and setting MIME-type to text/html is perfectly valid. As for 88 errors, just about any reasonably sized webpage will turn up plenty of errors, 88 sounds like a pretty small number compared to some webpages.
I may agree with what you say, but I will defend to the death your right to face the consequences of saying it.
On one hand, I feel the natural urge for a Nelson-like "Ha-ha" as the mighty Google monolith screws up. On the other hand, I ph33r mightily; my employer runs a lot of mail servers and this is the sort of thing that, if it happened to us, could really damage our company. Man, if I weren't up tinkering with code anyway, I'd be lying awake worrying that I've missed something that would enable the spammers to do the same to us...
Sorry, that's wrong: http://www.w3.org/TR/xhtml-media-types/#summary
The only time you should serve XHTML as text/html is when it's XHTML 1.0, with special care taken to keep backward compatibility in mind.
And as for 88 errors, well, if you're not going to be valid, why declare a document type? This isn't difficult stuff. That's 88 more errors than there should be.
You might wanna check this:Why are you blacklisting Gmail?
Fuck I should go work for INSERT...I knew about this "bug" "feature" "flaw" "exploit" or whatever you want to call it the dayum day they started allowing POP...I actually tested it then and it worked and it has worked almost every day since.
canna' beat-a beta
Has it ever occurred to anyone that there might be some sort of code buried in there, with the random capitalization being a marker of some sort?
/. Otherwise, I think there are at least 2 or 3 Slashdotters who are skipping their meds.
That's the only excuse I can think of for the unintelligible crap that's repeatedly getting posted to
Google having an open security-breach doesn't make even to the hundrieth commentary after a few hours.. I wonder how much time it would take to break that mark if the service in question was, say, Microsoft's Hotmail.
Well you've got me, although I still standby my opinion that 88 errors is acceptable especially given that todays browsers aren't even standards compliant and allowances must be made for misbehaviour.
I may agree with what you say, but I will defend to the death your right to face the consequences of saying it.
look kids, it's a frontpage developer!
Bad publicity made Google fix their open redirector for URLs. Bad publicity will make them fix this.
GMail ought to go back to cell phone authentication for new accounts. Since their capcha was broken, they've become a favorite of spammers.
Blogspot is also a spam haven. Most blogspot blogs are spam, and they can be used as a form of open redirector. Look for spams like: "An IWC watch is a uniquely handcrafted time piece ... http://rexefute51720.blogspot.com/"
Complain loudly, publicly, and often. Google needs to take stronger steps to avoid being a spam conduit.
kdawson, as open troll /. spamer
Modding Trolls +1 inciteful since 1999
Goddamned bastards have everything I send to my girlfriend from Google labeled as spam. The IT guy at her firm is a douche bag, but in this case it looks like he might be right.
Google needs to clean up its act.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Is this an advertised feature of Gmail?
I would disagree, 0 errors are acceptable. And I don't just do website design as a hobby, I run a business doing it.
Without standards you can't have real competition in the browser market, and it makes it harder to make websites. It's also not hard to write sites that have 0 errors.
just got one of the emails i think well s**t the spam freeness could only last so long i guess
This article doesn't say that Google *is* being used for massive Spam. It's just a proof of concept. Google is aware of this issue, and they may have this fixed before Monday. Then again, this could be something endemic to SMTP, and would happen with any server. It's just that an gmail address is considered free from spam, so it is completely trusted.
The major problem with spam is quite simple: Spam is dirt cheap. I can send out a million spam messages for nothing. As long as I can do that, almost nothing will stop spam. You put on a technical control, and I'll have incentive to break it. The only way to prevent spam is to go to a sender pays model. The amount can be trivial (a very small fraction of a cent), and could be covered as part of your standard ISP agreement, but becomes substantial when you send out a million messages.
That won't get rid of all unsolicited commercial email, but it will get rid of the bulk of the scum. Of course, I am not sure how you'd go from a SMTP model to a new pay-for-sending model. And, what if a spammer steals someone's account (by maybe planting some sort of malware on someone's PC)?
How about 10 errors?
http://validator.w3.org/check?verbose=1&uri=http://www.taylorbyrnes.org/
-- Is "Sig" copyrighted by www.sig.com?
Oh, my. Blaming other people is quite common: take a look at the SCO lawsuits blaming Linux for their losses in sales.
I've previously blocked aol.com and hotmail.com entirely from corporate mail servers, because for the amount of money wasted providing filtering servers and wasting technical person time explaining to users that it was spam or worms, we could hire a phone team to handle any irate clients who had trouble reaching us, and keep my users from having their time wasted indirectly.
The policy came up at review meetings, and was accepted company wide in several environments.
When we have a global Internet and free wireless.
> Yes, who would do business with such an entity. Probably about as many as would trust their business hosting to a company who declares its home page to be XHTML 1.1 but then serves it as text/html. Not to mention the 88 validation errors.
teknopurge, you just got served.
fnord.
In a system where the sender initiates information transfer ( such as in e-mail) you have the following problem:
"If you want everybody to to be able to contact you, then you will receive information you do not want."
Conversely, if you have a system where the recipient requests information ( such as for web-pages ) then you have the following problem:
"I you want everybody to be able to get information about yourself, then people you don't like could collect information about you."
There's no way around these very simple facts, the best you can do is to change what you expect from the service. As an example e-mail spam would be rapidly defeated if you limited yourself to only receive information from sources you have approved in advance, but that is to limited for most people. Because we want our friends to be able to give our e-mail addresses to their friends if they have something nice to tell us. Therefore we will get e-mails we don't want. If you want to change this you have to either change your expectations of what e-mail should do, or you have to change the behavior of people sending out spam. The easiest way to do the latter is to penalize business who do it.
to be fair, most of that is from two typos. if he fixes the h4 tags, everything is good.
<h4>Red is Nagivation</h3>
<h4>CISPCA</h3>
Your sig(k) has been stolen. There is a puff of smoke!
Are you sure your 'girlfriend' doesn't think it's 'unsolicited'? It might be a hint that your mail looks like fraudulent advertising.
All this will is show that the internet is insecure, no matter what company runs an app, it can always be exploited.
hxxp://nthegreat.co.nr
whitelisting a domain, email address or ip address means that you are trusting someone else to make sure their message server (and accompanying mail admin) is doing things right. There's also the possibility, due to pressure from your boss, you're allowing a known spam machine to send you mail and then it's up to you to regex out the spam. Whitelisting allows otherwise blockable items through. Email and webhosting rule #1: "You get what you pay for." If you're using something free to do business, you are sharing machines used by a thousand other computers. How many of those thousand other computers are running some form of a compromised/infected (read: microsoft) computer? Hotmail is a petri-dish. The pretty blue and green colors are symbolic. Yeah, you can quote that.
I say things which affects my Karma negatively. (and I don't care) For instance; All religion is false.
Unfortunately much of the code is autogenerated by a 3rd-party billing system that has invalid embedded HTML in their php variables and code. We don't have access to the source and have made due the best we can. Besides the invalid HTML, the system is good at what it does and is a mature application from a functional standpoint.
On our list of priorities the web-site w3 validation is right below our next marketing effort.
Regards,
Website Hosting
No, we checked all the obvious stuff. And her company isn't one of those that tries to stop employees from receiving personal e-mail, either.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
That doesn't make it any less funny.
People in glass houses shouldn't throw stones.
Self-righteous prick.
Does the Information Security Research Team make any memorabilia coins? I imagine an INSERT coin would be quite desirable.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
I stand by my point that 0 errors are acceptable, hence why it has been corrected. I'll admit you got me there, I made a typo on that one page and it wasn't valid. I actually wish browsers would follow the standard for XML and stop parsing once an error is encountered. I would have noticed without someone pointing it out or waiting until I re-checked it for standards compliance.
I don't think I'm a self righteous prick for making a mistake. I strive for 0 errors (all my other pages were valid), and I correct errors as soon as I'm aware of them. I will come out and state that my website had an unacceptable number of errors. I'd be a self righteous prick if I thought it was okay for my page to have the 2 typos (which produced 10 errors), but not for other people to have errors. Mistakes happen, it's the people that think they don't need to be fixed I disagree with.