"Serious security flaw" turns Gmail into spamming machine

[Amerigo Vespucci]

http://www.news.com/8301-10784_3-9941156-7.html?tag=ne.fd.mnbc

Flaw turns Gmail into spamming machine
Posted by Steven Musil

A "serious security flaw" in Gmail turns Google's e-mail service into a spamming machine, according to a recent security report.

INSERT, the Information Security Research Team, has created a proof of concept that exploits the "trust hierarchy" that exists between mail service providers. By exploiting a flaw in the way Google forwards messages, a spammer can send thousands of bulk e-mails through Google's SMTP service, bypassing Google's 500-address bulk e-mail limit and identity fraud protections.

The report notes that with the rising volume of spam, e-mail providers have turned to whitelists and blacklists to help root out IP addresses of known spammers. Because, Gmail falls into the trusted whitelist category, messages are allowed "carte blanche" to bypass spam filtering.

INSERT's report notes that no extraordinary Internet expertise is necessary to exploit the flaw:

In this regard, this document presents a vulnerability report and a proof of concept attack that demonstrate how anyone with no special internet access privileges other than being able to connect to SMTP (TCP port 25) and HTTP (TCP port 80) servers is able to exploit a single Gmail Account in order to be granted nearly unrestricted access to Google's massive white-listed SMTP relay infrastructure.

Google has offered no official comment on the report.

This isn't the first Google tool to appeal to spammers. In April, my colleague Elinor Mills reported that spammers were now using Google Calendar.

[havocmom]

1. Is this something new? Cuz I have 2 gmail accounts and no spam for months in either

My regular email... hundreds of spam per week.

[ljm2002]

2. Backwards...

...they're saying a GMail security flaw can be exploited to *send* spam -- nothing to do with incoming.

[havocmom]

8. Thanks, did not have time to read article as we are a bit busy here today.

Appreciate your explanation.

[Amerigo Vespucci]

3. Yes, the story was published today...

I have a GMail account which I use only on rare occasions, which may be one of the reasons why I also have no spam.

[ellaydubya]

4. G-mail Spam

I have been using G-mail for about 6 months- until about 2 weeks ago, only a couple. Now I am receiving up to 20 a day- I thought,"how odd", and wondered what had changed.

Very interesting!

[MADem]

5. And there could well be thousands of people who hate YOU, and you don't know it.

Because some spammer is using YOUR address to send spam.....capisce?

It's not the receiving, it's the SENDING that the article discusses.

[havocmom]

7. Thanks for the explaination

and the pleasant:eyes: way you presented it... capisce?

Spammers use all sorts of cloned addresses in my regular email. Furthermore, they use keywords which relate to things/sites I have been looking at online AND discussing in phone conversations, so I think there are more problems than gmail. And I don't think all the illegal spying on most Americans is anything but marketing research. ;)

[MADem]

11. The internet is not very good at conveying tone, capisce?

It wasn't intended to be mean, it was intended to be straightforward.

What is apparently happening is that someone is hijacking accounts and using them to send unwanted mail to people.

[ThoughtCriminal]

6. I'm getting flooded with Backscatter Bounces

due to spammers forging my email address in the "From:" field. Several hundred so far today.

It's called "Backscatter":
http://en.wikipedia.org/wiki/Backscatter#Backscatter_of_email_spam

It's an annoying problem that is casued by brain-dead ISP's that bounce spam instead of discarding it and not checking the headers. These idiots ignore the fact that there is close to a 100% chance that they are bouncing to an innocent party rather than the actual sender.

Fighting "Backscatter":
http://www.dontbouncespam.org/

[havocmom]

9. Hmm, not sure I understand, but is it like all those 'unable to deliver' notices?

My REGULAR email (local phone co-op service provider) goes through cycles where bunches of those come to many of us here. We all have different security on machines (and Havocdad is pretty fussy about ours) so I figure it is the service provider that is not secure. All of us in the area get spam with other local's names in sender or subject (VERY small rural communities).

[ThoughtCriminal]

10. Possibly

What happens is that a spammer gets your email address, forges it in the "From" field of the email and then send it out to thousands, even millions of addresses. The recipients' ISP spam filter recognizes it as spam since wither the content of the forged header match a pattern, but is too stupid to realize tha bouncing it back to the forged address is pointless. It ussually comes in waves of several thousand "returned" messages over a few days.

Unfortunately, there really isn't much, if anything that you can do when a spammer is forging your email address. We really need more accountablility and intelligence from our ISP's, but they are too busy fighting Net Neutrality (with the aid of the GOP).:

http://gizmodo.com/389016/dems-launch-net-neutrality-bill-gop-says-hands-off-the-poor-isps

That's really a different topic, but ISP's are on my "Send to the cornfield" list today.