Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gmail As Open-Relay Spam Server

Posted by kdawson on from the if-you're-not-part-of-the-solution-you're-part-of-the-precipitate dept.

sveard writes of a little problem Google is having that has Gmail acting like an open relay. Compounding the issue is the fact that services such as Hotmail and Yahoo trust Gmail as a source of mail. "A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail."

3 of 145 comments (clear)

  1. Re:Idiots better get off their ass by lambent · · Score: 4, Interesting

    I can second the above statement, since I've seen the exact same traffic.

    Unfortunately, this sort of thing will continue to crop up. E-mail is fundamentally broken, and it's too easy to take advantage of any e-mail system. To combat spam, mail admins have had to take many unorthodox and RFC-bending practices (if not out-right ignoring RFCs all together). Otherwise, users complain about too much spam. The down side, users then complain about e-mail delays or non-deliverables. So, you get systems setting up certain ways to bypass filters for hopefully trusted domains. And then this whole new problem comes up when people figure out new ways to abuse the system, its safeguards, and hidden/implicit trusts.

    Ugh. At this point, I just want to turn SMTP off completely. This is a losing battle.

  2. Re:Idiots better get off their ass by Midnight+Thunder · · Score: 4, Interesting

    E-mail is fundamentally broken, and it's too easy to take advantage of any e-mail system.

    I hear this being said over and over again. The problem is that no one has been able to provide a solution to resolved the problem. There have been suggestions, but doing so without penalizing the small guy is hard. Do we require certificates and if we do how can we ensure that it will be 100% fool proof? Do we only accept e-mail that hasn't been relayed or only accept mail from white listed relays, or create rules for them, if relays are to be tolerated in certain conditions?

    --
    Jumpstart the tartan drive.
  3. Re:Idiots better get off their ass by martin-boundary · · Score: 4, Interesting
    Why do people say this? SMTP is not broken. It's a low level protocol which works pretty damn well. What people should concentrate on is building higher layers on top of SMTP and RFC2822, rather than complaining about SMTP itself.

    This is like complaining that wheels don't protect against being rained on, so cars should be redesigned from scratch.