Slashdot Mirror
Gmail As Open-Relay Spam Server
sveard writes of a little problem Google is having that has Gmail acting like an open relay. Compounding the issue is the fact that services such as Hotmail and Yahoo trust Gmail as a source of mail. "A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail."
but is very effective against slashdot comments?
Apparently, no one here cares:P
But, on topic, this really isn't all the surprising. Pretty much any email server can be used as a relay in this manner, the only thing special here is that it avoids Google's current features. I expect Google will have this locked down very soon.
If sharing a song makes you a pirate, what do I have to share to be a ninja?
Speaking as a mail server administrator I sincerely hope that they fix this pronto. There is no way that I can just block gmail addresses from my mail server given how huge gmail already is. I literally have no choice but to ride this out and hope for the best.
I have already checked my server logs and the fun just started a little while ago. Yay!....
This flaw is valuable because it's clear proof that whitelists don't work. No domain is above suspicion when it comes to sending spam. About the only real use the domain can be is as an adjustment to your filters. Done properly, mail from gmail.com is marked as less likely to be spam than mail from cyberpromo.com, but it's still checked.
Good, inexpensive web hosting
Did anyone else notice that this story appeared AFTER the story above it? I almost missed the story entirely.
...was "a little while ago" on thursday?
Because that's when the existence of the vulnerability was already known, at least. The people who figured it out aren't telling the world how to do it (I'm sure clever people can figure it out), and are / were waiting for Google to fix it first.
http://ece.uprm.edu/~andre/insert/gmail.html
You might be seeing plain ol' spam from gmail; it's been having its share of problems with spammers since both captcha crack -and- before that by manual sign-up, simply -because- everybody trusted gmail (what, with the forced SMS/Text Message sign-up, invite-only, etc. preceding).
last I checked it was 6.5 gigs of storage.
i figure google will have this locked down soon enough though. It's not like they won't notice the sudden burst of traffic. Some guy is going to be working hard tonight.
i thought once I was found, but it was only a dream.
Huh? What argument are you refering to, and how does this ruin it?
The only "argument" I can think you might be refering to is that, by using Gmail, you avoid having to see a lot of spam due to their excellent spam filterings. This doesn't ruin that argument in any way. In fact, since it primary impacts sites like Yahoo and Hotmail (who will see more spam if they continue to whitelist Gmail), it strengthens it. You're now see even less spam using Gmail, comparatively speaking.
"Convictions are more dangerous enemies of truth than lies."
Yes, who would do business with such an entity. Probably about as many as would trust their business hosting to a company who declares its home page to be XHTML 1.1 but then serves it as text/html. Not to mention the 88 validation errors.
The point is you can't jump straight for the "nuclear" option. Although to be honest I wouldn't use such a Web host.
I think that the problem may be that there are still too many people who believe the jargon... "Do no evil." (Or something to that effect at any rate...)
"So long and thanks for all the fish."
Right, so why does that argument no longer apply? I just checked my gmail account and there is as little to no spam as always.
We hope your rules and wisdom choke you / Now we are one in everlasting peace
What planet are you from? No self respecting ISP in the world would try pull that.
You going to go an make some ideological bullshit point and piss all over your customers when it's not going to make the slightest difference to Google.
Go right ahead!
It's just a beta guys. There's going to be bugs in the system =)
You might wanna check this:Why are you blacklisting Gmail?
Google having an open security-breach doesn't make even to the hundrieth commentary after a few hours.. I wonder how much time it would take to break that mark if the service in question was, say, Microsoft's Hotmail.
Bad publicity made Google fix their open redirector for URLs. Bad publicity will make them fix this.
GMail ought to go back to cell phone authentication for new accounts. Since their capcha was broken, they've become a favorite of spammers.
Blogspot is also a spam haven. Most blogspot blogs are spam, and they can be used as a form of open redirector. Look for spams like: "An IWC watch is a uniquely handcrafted time piece ... http://rexefute51720.blogspot.com/"
Complain loudly, publicly, and often. Google needs to take stronger steps to avoid being a spam conduit.
How about 10 errors?
http://validator.w3.org/check?verbose=1&uri=http://www.taylorbyrnes.org/
-- Is "Sig" copyrighted by www.sig.com?
In a system where the sender initiates information transfer ( such as in e-mail) you have the following problem:
"If you want everybody to to be able to contact you, then you will receive information you do not want."
Conversely, if you have a system where the recipient requests information ( such as for web-pages ) then you have the following problem:
"I you want everybody to be able to get information about yourself, then people you don't like could collect information about you."
There's no way around these very simple facts, the best you can do is to change what you expect from the service. As an example e-mail spam would be rapidly defeated if you limited yourself to only receive information from sources you have approved in advance, but that is to limited for most people. Because we want our friends to be able to give our e-mail addresses to their friends if they have something nice to tell us. Therefore we will get e-mails we don't want. If you want to change this you have to either change your expectations of what e-mail should do, or you have to change the behavior of people sending out spam. The easiest way to do the latter is to penalize business who do it.
whitelisting a domain, email address or ip address means that you are trusting someone else to make sure their message server (and accompanying mail admin) is doing things right. There's also the possibility, due to pressure from your boss, you're allowing a known spam machine to send you mail and then it's up to you to regex out the spam. Whitelisting allows otherwise blockable items through. Email and webhosting rule #1: "You get what you pay for." If you're using something free to do business, you are sharing machines used by a thousand other computers. How many of those thousand other computers are running some form of a compromised/infected (read: microsoft) computer? Hotmail is a petri-dish. The pretty blue and green colors are symbolic. Yeah, you can quote that.
I say things which affects my Karma negatively. (and I don't care) For instance; All religion is false.
Does the Information Security Research Team make any memorabilia coins? I imagine an INSERT coin would be quite desirable.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?