Overclock.net › Forums › Industry News › Software News › [Ars] Security flaw turns Gmail into open-relay server
New Posts  All Forums:Forum Nav:

[Ars] Security flaw turns Gmail into open-relay server

post #1 of 12
Thread Starter 
Quote:
A recently-discovered flaw in Gmail is capable of turning Google's e-mail service into a highly effective spam machine. According to the Information Security Research Team (INSERT), Gmail is susceptible to a man-in-the-middle attack that allows a spammer to send thousands of bulk e-mails through Google's SMTP service without fear of detection. This attack bypasses both Google's identity fraud protection mechanisms and the current 500-address limit on bulk e-mail.
Gotcha, CAPTCHA! Gmail bot detector system cracked

A flaw in Gmail that allows spammers to send a potentially unlimited number of messages is definitely a problem, but there's another, external factor that could exacerbate any potential spam attack. As the volume of spam has risen—it currently accounts for 95 percent of all e-mail traffic—many e-mail providers have adopted whitelists and blacklists as a first line of defense against the flood. An e-mail from johdoe@awinnerisyou.com (or the corresponding IP address block) may be automatically blocked by any given e-mail service, while an e-mail from a trusted, authenticated source such as Gmail is automatically allowed through the gateway. E-mail providers regularly use multi-level filtering services, any of which might detect that the forged Gmail missive is actually spam, but the message has cleared a substantial hurdle that would have otherwise barred it from delivery.

E-mail that originates from Google, it seems, is particularly well-regarded by both Yahoo and Hotmail. The INSERT team tested the degree of trust between the three major e-mail providers by sending spam messages to Yahoo and Hotmail using two sources. In the first test, messages were sent from personal systems whose IP addresses had been blacklisted by Yahoo and Hotmail. The second test consisted of sending the exact same message via the Gmail flaw that INSERT discovered.

The difference was significant. E-mail sent to Yahoo and Hotmail from a blacklisted IP didn't even necessarily reach the account's spam box, while forged e-mail sent via Gmail always arrived in the intended account's inbox. The goal here is not to condemn trusted-source filtering as bad, but to emphasize how a security flaw in a single product or service can ripple through an ecosystem. Google will likely act quickly to close this particular loophole, but Yahoo and Hotmail might want to read their Russian proverbs a little more closely. doveryai, no proveryai (Trust, but Verify) remains an eternally good idea.
Source
The Kandalf
(16 items)
 
  
CPUMotherboardGraphicsGraphics
I7 5820K MSI X99S Gaming 7 ASUS R9 280X TOP Crossfire X ASUS R9 280X TOP Crossfire X 
RAMHard DriveOptical DriveOS
Crucial DDR4 2133MHz 8GB (2x4GB) Samsung SpinPoint F1 1TB HP DVD630 Ubuntu 
MonitorKeyboardPowerCase
2x Philips Brilliance 220CW Microsoft Wireless Desktop Elite Keyboard Fractal Design Newton R3, 800W 80+ Platinum Corsair 900D 
MouseMouse PadAudioAudio
Mionix Naos 8200 Razer Pro Solutions Arcam rDAC B&W CM1 
  hide details  
Reply
The Kandalf
(16 items)
 
  
CPUMotherboardGraphicsGraphics
I7 5820K MSI X99S Gaming 7 ASUS R9 280X TOP Crossfire X ASUS R9 280X TOP Crossfire X 
RAMHard DriveOptical DriveOS
Crucial DDR4 2133MHz 8GB (2x4GB) Samsung SpinPoint F1 1TB HP DVD630 Ubuntu 
MonitorKeyboardPowerCase
2x Philips Brilliance 220CW Microsoft Wireless Desktop Elite Keyboard Fractal Design Newton R3, 800W 80+ Platinum Corsair 900D 
MouseMouse PadAudioAudio
Mionix Naos 8200 Razer Pro Solutions Arcam rDAC B&W CM1 
  hide details  
Reply
post #2 of 12
Oh, dear.
post #3 of 12
A general good bashing of the major free email providers right there!
Celos
(15 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 Asus Maximus Formula Sapphire AMD 6950 2GB 4x 2GB G.Skills PC8000 DDR2 
Hard DriveOSMonitorMonitor
Crucial M4 Windows 7 x64 Samsung T260 Samsung 913N 
KeyboardPowerCaseMouse
Logitech G15 Rev 2 Thermaltake Toughpower 850w Thermaltake Kandalf LCS Logitech G500 
Mouse PadAudio
Steelseries Asus Xonar 
  hide details  
Reply
Celos
(15 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 Asus Maximus Formula Sapphire AMD 6950 2GB 4x 2GB G.Skills PC8000 DDR2 
Hard DriveOSMonitorMonitor
Crucial M4 Windows 7 x64 Samsung T260 Samsung 913N 
KeyboardPowerCaseMouse
Logitech G15 Rev 2 Thermaltake Toughpower 850w Thermaltake Kandalf LCS Logitech G500 
Mouse PadAudio
Steelseries Asus Xonar 
  hide details  
Reply
post #4 of 12
They should just make it cost $1 when you first make the account and this wouldn't be happening.
Cataclysm
(20 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 G0 GA-EP45-UD3P Rev. 1.0 Sapphire 4850 4x 2GB DDR2-1066 
Hard DriveHard DriveOptical DriveCooling
WD1600AAJS Random IDE Sony DVD Burner Tuniq Tower 120 
CoolingCoolingCoolingOS
6x 120mm Scythe SY1225SL12SH Fans Thermalright T-RAD2 2x 92mm Scythe DFS922512M-PWM Fans Windows 7 Ultimate x64 SP1 
MonitorMonitorKeyboardPower
Acer 19" @ 1400x900 Sceptre 19" @ 1280x1024 Cherry G81-7000LPAUS-2 (MY Switches) Corsair 650TX 
CaseMouseMouse PadAudio
Antec 900 Razer Diamondback 3G A black one with a cat in a hammock Asus Xonar D1 
  hide details  
Reply
Cataclysm
(20 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 G0 GA-EP45-UD3P Rev. 1.0 Sapphire 4850 4x 2GB DDR2-1066 
Hard DriveHard DriveOptical DriveCooling
WD1600AAJS Random IDE Sony DVD Burner Tuniq Tower 120 
CoolingCoolingCoolingOS
6x 120mm Scythe SY1225SL12SH Fans Thermalright T-RAD2 2x 92mm Scythe DFS922512M-PWM Fans Windows 7 Ultimate x64 SP1 
MonitorMonitorKeyboardPower
Acer 19" @ 1400x900 Sceptre 19" @ 1280x1024 Cherry G81-7000LPAUS-2 (MY Switches) Corsair 650TX 
CaseMouseMouse PadAudio
Antec 900 Razer Diamondback 3G A black one with a cat in a hammock Asus Xonar D1 
  hide details  
Reply
post #5 of 12
The world runs on these free webclients....you'd think they'd be a little more secure.
ElRigTheRig
(13 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 G0 @ 2.4 GHz Asus Maximus Formula Asus EN8800GT 512MB 4GB G.Skill DDR2-1000 
Hard DriveOptical DriveOSMonitor
1.858TB (3x JBOD) HP 16x DVD Burner Vista Ultimate x64 SP2 24" FPD2485 Gateway LCD 
KeyboardPowerCaseMouse
Razer Lycosa Ultra X3 1000w Antec P182 Logitech G5 
Mouse Pad
Razer Xact Mat 
  hide details  
Reply
ElRigTheRig
(13 items)
 
  
CPUMotherboardGraphicsRAM
Q6600 G0 @ 2.4 GHz Asus Maximus Formula Asus EN8800GT 512MB 4GB G.Skill DDR2-1000 
Hard DriveOptical DriveOSMonitor
1.858TB (3x JBOD) HP 16x DVD Burner Vista Ultimate x64 SP2 24" FPD2485 Gateway LCD 
KeyboardPowerCaseMouse
Razer Lycosa Ultra X3 1000w Antec P182 Logitech G5 
Mouse Pad
Razer Xact Mat 
  hide details  
Reply
post #6 of 12
Holy Molex!
Uhh.. Thing
(17 items)
 
TERA
(22 items)
 
MEGA
(13 items)
 
CPUMotherboardGraphicsRAM
4690K Z97-PRO GAMER GigaByte GTX970 G1 Corsair Vengeance 
Hard DriveHard DriveCoolingOS
Samsung 830 Pro Samsung 850 EVO Noctua D15 Windows 10 x64 Enterprise 
MonitorKeyboardPowerCase
ASUS VG248QE QPAD MK-50 EVGA 750W G2 Frractal Design R5 
MouseMouse PadAudioAudio
Logitech G502 IKEA Galant SupremeFX -> Pioneer VSX-D711-S 5.1 receiver Dali Zensor 1+SUB E-12F 
Other
Logitech G27 
CPUMotherboardGraphicsGraphics
Intel i7 2700k @ 4.5GHz 1.425v with HT enabled ASUS P8Z77-V Gigabyte GTX670 OC Gigabyte GTX670 OC 
RAMHard DriveHard DriveHard Drive
Corsair Vengeanve LP White 16GB Corsair Force GT 120GB WD RED SOHO 3TB WD RED SOHO 3TB 
Hard DriveHard DriveCoolingCooling
WD BLACK 4TB Seagate 5900 LP 2TB XSPC Raystorm D5 XSPC RX480 w/ GT AP-13 
CoolingOSMonitorKeyboard
XSPC RX360 w/ GT AP-15 Windows 7 Ultimate x64 DELL U3011 Logitech K800 
PowerCaseMouseMouse Pad
Corsair HX1000W Corsair 900D Logitech G500 SARGAS 460 
AudioAudio
Denon AVR-2313 Dali Zensor 7, 5, Vocal 
CPUMotherboardRAMHard Drive
i5 3570k 4.2GHz ASUS P8Z77-i DELUXE Corsair Vengeance LP 4GB Samsung 830 256GB 
CoolingOSMonitorPower
Corsair H100 Windows 7 x64 Ultimate SP1 ASUS V248QE Corsair HX650W 
CaseMouse PadAudioAudio
BitFenix Prodigy Funk Surface 1030 Realtek 898 Pioneer VSX-D711-S 5.1 receiver 
Audio
Dali Zensor 1+SUB E-12F 
  hide details  
Reply
Uhh.. Thing
(17 items)
 
TERA
(22 items)
 
MEGA
(13 items)
 
CPUMotherboardGraphicsRAM
4690K Z97-PRO GAMER GigaByte GTX970 G1 Corsair Vengeance 
Hard DriveHard DriveCoolingOS
Samsung 830 Pro Samsung 850 EVO Noctua D15 Windows 10 x64 Enterprise 
MonitorKeyboardPowerCase
ASUS VG248QE QPAD MK-50 EVGA 750W G2 Frractal Design R5 
MouseMouse PadAudioAudio
Logitech G502 IKEA Galant SupremeFX -> Pioneer VSX-D711-S 5.1 receiver Dali Zensor 1+SUB E-12F 
Other
Logitech G27 
CPUMotherboardGraphicsGraphics
Intel i7 2700k @ 4.5GHz 1.425v with HT enabled ASUS P8Z77-V Gigabyte GTX670 OC Gigabyte GTX670 OC 
RAMHard DriveHard DriveHard Drive
Corsair Vengeanve LP White 16GB Corsair Force GT 120GB WD RED SOHO 3TB WD RED SOHO 3TB 
Hard DriveHard DriveCoolingCooling
WD BLACK 4TB Seagate 5900 LP 2TB XSPC Raystorm D5 XSPC RX480 w/ GT AP-13 
CoolingOSMonitorKeyboard
XSPC RX360 w/ GT AP-15 Windows 7 Ultimate x64 DELL U3011 Logitech K800 
PowerCaseMouseMouse Pad
Corsair HX1000W Corsair 900D Logitech G500 SARGAS 460 
AudioAudio
Denon AVR-2313 Dali Zensor 7, 5, Vocal 
CPUMotherboardRAMHard Drive
i5 3570k 4.2GHz ASUS P8Z77-i DELUXE Corsair Vengeance LP 4GB Samsung 830 256GB 
CoolingOSMonitorPower
Corsair H100 Windows 7 x64 Ultimate SP1 ASUS V248QE Corsair HX650W 
CaseMouse PadAudioAudio
BitFenix Prodigy Funk Surface 1030 Realtek 898 Pioneer VSX-D711-S 5.1 receiver 
Audio
Dali Zensor 1+SUB E-12F 
  hide details  
Reply
post #7 of 12
Lol@the tags
    
CPUMotherboardGraphicsRAM
i5 3570K P8Z77-M XFX 7870 1150/1400 2 x 4g Corsair Vengeance LP 1600MHz 
Hard DriveOptical DriveOSMonitor
Callisto Deluxe 40GB & 1TB Sammy Spinpoint F1 &... Nec ND3540A W7 RTM ACER V243HLbmd 
KeyboardPowerCaseMouse
Microsoft Curve 2000 PC P&C Silencer 750w Antec 300 MX518 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5 3570K P8Z77-M XFX 7870 1150/1400 2 x 4g Corsair Vengeance LP 1600MHz 
Hard DriveOptical DriveOSMonitor
Callisto Deluxe 40GB & 1TB Sammy Spinpoint F1 &... Nec ND3540A W7 RTM ACER V243HLbmd 
KeyboardPowerCaseMouse
Microsoft Curve 2000 PC P&C Silencer 750w Antec 300 MX518 
  hide details  
Reply
post #8 of 12
INSERT has discovered it, no one else has or probably will implement it. By now Google probably fixed it.
Blood
(13 items)
 
  
Reply
Blood
(13 items)
 
  
Reply
post #9 of 12
The tags are gonna be abused to hell.
Nemesis NE-α
(15 items)
 
   
CPUMotherboardGraphicsRAM
Intel Core i7 4790k (Devil's Canyon) AsRock Z97 Extreme 4 Visiontek AMD 6990 Corsair XMS3 DDR3 1600 
Hard DriveCoolingOSMonitor
Samsung EVO 840 XSPC Raystorm Windows 8.1 Dell U2311H 1920x1080 IPS 
MonitorMonitorKeyboardPower
Dell U2311H 1920x1080 IPS Dell U2311H 1920x1080 IPS Ducky Blue Overclock.net Themed Mechanical Keyb... Corsair Silver 1kw  
CaseMouseAudio
Case Labs TH10 Logitech G502 Logitech 5.1 speakers w/ Onkyo Receiver 
CPUMotherboardGraphicsRAM
Intel Xeon W3520 i7 4.0ghz EVGA X58 Classified Visiontek 6990 GSkill 6GB DDR3 Pi 
Hard DriveOptical DriveOSMonitor
2x OCZ Vertex 60GB SSD ; 2x 1TB ; 2x 2TB Samsung BluRay Burner Windows 7 Ultimate 64x 3x Dell U2311H 23" 1080p IPS 
KeyboardPowerCaseMouse
Logitech G15 Gaming Keyboard SilverStone Strider 1000w Modular Power Supply Lian Li V2000 Plus Logitech G9 Gaming Laser Mouse 
Mouse Pad
Cyba Sniper Tracer (Acrylic Glass) 
  hide details  
Reply
Nemesis NE-α
(15 items)
 
   
CPUMotherboardGraphicsRAM
Intel Core i7 4790k (Devil's Canyon) AsRock Z97 Extreme 4 Visiontek AMD 6990 Corsair XMS3 DDR3 1600 
Hard DriveCoolingOSMonitor
Samsung EVO 840 XSPC Raystorm Windows 8.1 Dell U2311H 1920x1080 IPS 
MonitorMonitorKeyboardPower
Dell U2311H 1920x1080 IPS Dell U2311H 1920x1080 IPS Ducky Blue Overclock.net Themed Mechanical Keyb... Corsair Silver 1kw  
CaseMouseAudio
Case Labs TH10 Logitech G502 Logitech 5.1 speakers w/ Onkyo Receiver 
CPUMotherboardGraphicsRAM
Intel Xeon W3520 i7 4.0ghz EVGA X58 Classified Visiontek 6990 GSkill 6GB DDR3 Pi 
Hard DriveOptical DriveOSMonitor
2x OCZ Vertex 60GB SSD ; 2x 1TB ; 2x 2TB Samsung BluRay Burner Windows 7 Ultimate 64x 3x Dell U2311H 23" 1080p IPS 
KeyboardPowerCaseMouse
Logitech G15 Gaming Keyboard SilverStone Strider 1000w Modular Power Supply Lian Li V2000 Plus Logitech G9 Gaming Laser Mouse 
Mouse Pad
Cyba Sniper Tracer (Acrylic Glass) 
  hide details  
Reply
post #10 of 12
Quote:
Originally Posted by OmegaNemesis28 View Post
The tags are gonna be abused to hell.
ROFL, here's one tag: "where is your google now?"
Blood
(13 items)
 
  
Reply
Blood
(13 items)
 
  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Software News
Overclock.net › Forums › Industry News › Software News › [Ars] Security flaw turns Gmail into open-relay server