Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gmail As Open-Relay Spam Server

Posted by kdawson on from the if-you're-not-part-of-the-solution-you're-part-of-the-precipitate dept.

sveard writes of a little problem Google is having that has Gmail acting like an open relay. Compounding the issue is the fact that services such as Hotmail and Yahoo trust Gmail as a source of mail. "A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail."

16 of 145 comments (clear)

  1. Idiots better get off their ass by EdIII · · Score: 5, Informative

    Speaking as a mail server administrator I sincerely hope that they fix this pronto. There is no way that I can just block gmail addresses from my mail server given how huge gmail already is. I literally have no choice but to ride this out and hope for the best.

    I have already checked my server logs and the fun just started a little while ago. Yay!....

    1. Re:Idiots better get off their ass by lambent · · Score: 4, Interesting

      I can second the above statement, since I've seen the exact same traffic.

      Unfortunately, this sort of thing will continue to crop up. E-mail is fundamentally broken, and it's too easy to take advantage of any e-mail system. To combat spam, mail admins have had to take many unorthodox and RFC-bending practices (if not out-right ignoring RFCs all together). Otherwise, users complain about too much spam. The down side, users then complain about e-mail delays or non-deliverables. So, you get systems setting up certain ways to bypass filters for hopefully trusted domains. And then this whole new problem comes up when people figure out new ways to abuse the system, its safeguards, and hidden/implicit trusts.

      Ugh. At this point, I just want to turn SMTP off completely. This is a losing battle.

    2. Re:Idiots better get off their ass by Baumi · · Score: 4, Insightful

      By riding this out, you give no incentive to actually fix anything. In theory, you're right: If all the server admins in the world united and blocked GMail, that'd send a message to Google to fix this ASAP.

      In practice, however, Google is likely to do just that anyway, and since there is no organized blacklisting going on, a sole action by the GP poster would most likely annoy his users while Google itself wouldn't even notice it.

      (Unless, of course, the GP happens to be the sysadmin for Hotmail, Yahoo! Mail or something similar - in that case: Blacklist, baby! ;-) )
    3. Re:Idiots better get off their ass by Midnight+Thunder · · Score: 4, Interesting

      E-mail is fundamentally broken, and it's too easy to take advantage of any e-mail system.

      I hear this being said over and over again. The problem is that no one has been able to provide a solution to resolved the problem. There have been suggestions, but doing so without penalizing the small guy is hard. Do we require certificates and if we do how can we ensure that it will be 100% fool proof? Do we only accept e-mail that hasn't been relayed or only accept mail from white listed relays, or create rules for them, if relays are to be tolerated in certain conditions?

      --
      Jumpstart the tartan drive.
    4. Re:Idiots better get off their ass by Robotech_Master · · Score: 4, Informative

      Problem with this is that a lot of people (myself included) use gmail for the ease of use, but prefer to keep their own email address as the return address for various reasons.

      --
      Editor Emeritus and Senior Writer, TeleRead.org
    5. Re:Idiots better get off their ass by schon · · Score: 5, Insightful

      There are trivial technical solutions for the spam problem if only we could get rid of SMTP. No, there aren't.

      Spam exists because there are sociopaths who want to steal resources from others. There is *NO* technical solution to this. If your SMTP replacement allows anyone to contact anyone else, it will allow spammers to contact anyone.

      Spam is a social problem, not a technical one. There is no such thing as a technical solution to a social problem.
    6. Re:Idiots better get off their ass by martin-boundary · · Score: 4, Interesting
      Why do people say this? SMTP is not broken. It's a low level protocol which works pretty damn well. What people should concentrate on is building higher layers on top of SMTP and RFC2822, rather than complaining about SMTP itself.

      This is like complaining that wheels don't protect against being rained on, so cars should be redesigned from scratch.

    7. Re:Idiots better get off their ass by EdIII · · Score: 4, Informative

      That sounds logical but it won't work.

      The spammers don't care about what their FROM and REPLYTO fields actually say. Since this is a man-in-the-middle attack they could put practically anything with a @gmail.com in those fields and it will render your solution ineffective.

      The real problem with this exploit is that it bypasses all of Google's security measures and anything I could do on my end would only verify that the email actually came from a real Google mail server and from a Google email user. So then I can only rely on SPAM filtering based on content which is not as effective as we would all like it to be.

    8. Re:Idiots better get off their ass by Paradise+Pete · · Score: 4, Insightful
      Then why is the spam problem so much bigger than the telemarketer or junk fax problem?

      Cost, plain and simple. The fundamental way to reduce spam is to make it cost more to do. Of course actually figuring out a good way to do that is left as an exercise for the reader.

    9. Re:Idiots better get off their ass by Chandon+Seldon · · Score: 4, Insightful

      Spam is a social problem, not a technical one. There is no such thing as a technical solution to a social problem.

      That's generally true.

      The problem is that SMTP makes it drastically worse than it needs to be with a push model. The spammer can send a million messages, and they've all already been accepted by the destination server before anyone has a chance to complain.

      If it were a notification / pull model then when someone complained the ISP could pull the spammer's plug for a TOS violation before most of the messages in his first batch were delivered. Sure, that doesn't kill the spam problem utterly dead - but it does mean that current spam management resources could keep it down to well under 90% of all email.

      --
      -- The act of censorship is always worse than whatever is being censored. Always.
  2. Whitelists don't work. by techno-vampire · · Score: 5, Insightful

    This flaw is valuable because it's clear proof that whitelists don't work. No domain is above suspicion when it comes to sending spam. About the only real use the domain can be is as an adjustment to your filters. Done properly, mail from gmail.com is marked as less likely to be spam than mail from cyberpromo.com, but it's still checked.

    --
    Good, inexpensive web hosting
  3. Interesting... by Animaether · · Score: 5, Informative

    ...was "a little while ago" on thursday?

    Because that's when the existence of the vulnerability was already known, at least. The people who figured it out aren't telling the world how to do it (I'm sure clever people can figure it out), and are / were waiting for Google to fix it first.

    http://ece.uprm.edu/~andre/insert/gmail.html

    You might be seeing plain ol' spam from gmail; it's been having its share of problems with spammers since both captcha crack -and- before that by manual sign-up, simply -because- everybody trusted gmail (what, with the forced SMS/Text Message sign-up, invite-only, etc. preceding).

  4. Re:DeBunking? by peragrin · · Score: 4, Insightful

    last I checked it was 6.5 gigs of storage.

    i figure google will have this locked down soon enough though. It's not like they won't notice the sudden burst of traffic. Some guy is going to be working hard tonight.

    --
    i thought once I was found, but it was only a dream.
  5. They'll fix it if it gets enough bad publicity by Animats · · Score: 5, Insightful

    Bad publicity made Google fix their open redirector for URLs. Bad publicity will make them fix this.

    GMail ought to go back to cell phone authentication for new accounts. Since their capcha was broken, they've become a favorite of spammers.

    Blogspot is also a spam haven. Most blogspot blogs are spam, and they can be used as a form of open redirector. Look for spams like: "An IWC watch is a uniquely handcrafted time piece ... http://rexefute51720.blogspot.com/"

    Complain loudly, publicly, and often. Google needs to take stronger steps to avoid being a spam conduit.

  6. Re:Wow, slashdot doesnt give a crap by Jurily · · Score: 4, Insightful

    The real problem is really deciding what is a legitimate source of e-mail, without requiring a central registry of e-mail servers or some other sort of bureaucratic process. Recently I've been getting spam that convinced them that I was the sender, and even "(unknown sender)" ones. One would think that's not that hard to decide.

    The other problem is, Hotmail and Yahoo trusting Gmail. In the world of email, there is no such thing as a trustworthy server.
  7. Re:Wow, slashdot doesnt give a crap by Lincolnshire+Poacher · · Score: 5, Insightful

    > The real problem is really deciding what is a legitimate
    > source of e-mail, without requiring a central registry of
    > e-mail servers or some other sort of bureaucratic process.

    Well that's the problem that SPF solves. Each domain owner
    creates a DNS entry that specifies which mail servers are
    permitted to send mail for that domain. When an MX receives
    a HELO it checks that the originating IP corresponds with
    the DNS entry; if not, the mail can be rejected or subjected
    to further inspection and scoring.

    Simple to implement, I've done it in 20 minutes for my domain
    ( 20 minutes from ``What is this project?'' to submitting the
    DNS change ).

    http://www.openspf.org/