News for hackers. Stuff that matters.

A comment on My account is sending spam emails.

Re:My account is sending spam emails by ninjaranter on Sunday April 22, 2018 @01:59AM (#16894914)
I had the same thing in my account (same relay through Telus). Here're my headers

  Delivered-To: <[email protected]>
  Received: by 10.74.77.209 with SMTP id p78csp1252253ood;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5
  X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none;
          d=google.com; s=arc-20160816;
          b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg
           NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk
           pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB
           +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD
           86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD
           Lzng==
  ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
          h=date:message-id:subject:to:from:arc-authentication-results;
          bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=;
          b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe
           QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh
           DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d
           7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam
           q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ
           e5RA==
  ARC-Authentication-Results: i=1; mx.google.com;
         spf=pass (google.com: domain of [email protected] designates 69.64.35.11 as permitted sender) [email protected];
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
  Return-Path: <[email protected]>
  Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [69.64.35.11])
          by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30
          for <<[email protected]>>;
          Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
  Received-SPF: pass (google.com: domain of [email protected] designates 69.64.35.11 as permitted sender) client-ip=69.64.35.11;
  Authentication-Results: mx.google.com;
         spf=pass (google.com: domain of [email protected] designates 69.64.35.11 as permitted sender) [email protected];
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
  Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
          by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
          for <<[email protected]>>;
          Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
  Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245;
  from: ABC Shark Tank <<[email protected]>>
  To: <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>
  Subject: Exclusive Limited Time Online Offer Shark Tank Success Story
  Message-ID: <[email protected]=Mx.google.com>
  Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
  X-EMMAIL: <@googlemail.fr <[email protected]>>
  Date: Sat, 21 Apr 2018 22:48:30 -0400  

  --f4f5e80f07d80f991b056a2936a0
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:18AM (#16894950)
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results.

The current SPF records for telus.com don't seem to allow sending by 69.64.35.11.

Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed?

Also, the timestamps on the received headers differ by a lot. This one:

    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for <[email protected]>;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
appears to be identical (except for the email address) for the two sample sets of headers in the thread.
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:51AM (#16895030)
Telus has this entry:

    exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com
Reading RFC 7208, that would be expanded to

    exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com
which means if that any record exists at that name, it will pass.

    dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com
    127.0.0.1
trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.
[ Parent | on HN ]
Re:My account is sending spam emails by tetha on Sunday April 22, 2018 @03:19AM (#16895105)
It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @10:42AM (#16896356)
They appear to have quitely fixed it.
[ Parent | on HN ]
Re:My account is sending spam emails by tetha on Sunday April 22, 2018 @12:20PM (#16896823)
Indeed, the DNS records are gone. They had a tweet[1] 1 hour or 2 ago how they are working on it. I guess someone got phoned on his sunday to fix it. I'm hoping for a further update from their side what happened.

1: https://twitter.com/TELUSsupport/status/988060048843657216

[ Parent | on HN ]
Re:My account is sending spam emails by zephharben on Sunday April 22, 2018 @02:30AM (#16894986)
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender.

That's why the SPF check doesn't fail.

However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.

[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:38AM (#16894996)
It's not being sent from any of the IPs listed under _spf.google.com, though.
[ Parent | on HN ]
Re:My account is sending spam emails by bertjk on Sunday April 22, 2018 @02:19AM (#16894952)
This part is interesting:

  Authentication-Results: mx.google.com;
         spf=pass (google.com: domain of [email protected] designates 69.64.35.11 as permitted sender) [email protected];
         dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
I had thought that as of early 2017 that had changed the DMARC policy to p=REJECT which would basically reject any attempts at spoofing gmail.com in the From: field. It seems as if someone suddenly (maybe accidentally) reverted that change?
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:26AM (#16894969)
It appears to be validating the envelope sender ([email protected]) rather than the from address, per the spec.

The thing is, telus.com doesn't have a DMARC record, and thier SPF record doesn't include 69.64.35.11. This header might be fake. Gmail does currently have a DMARC record that says p=none sp=quarantine. The 'sp' value only applies to subdomains, so the "none" (no action) policy should be used.

Edit: I just verified that gmail's dmarc has had p=none for a long time.

[ Parent | on HN ]
Re:My account is sending spam emails by zephharben on Sunday April 22, 2018 @02:19AM (#16894951)
Yep - I received precisely the same message, among 3 others. They all had the same "Message-ID" header as your example.
[ Parent | on HN ]