I think this is exactly what is going on. Gmail doesn't use IMAP folders in the traditional sense, it uses labels. For something to appear in your "Sent" folder, it only has to show your email address as the sender. Since it's quite common for spammers to use your email address as the "From" in spam messages sent to you, Gmail automatically throws it in your Sent "folder" by way of a label.

I freaked out at first when my Fastmail account started getting spammed seemingly by my old Gmail account (I no longer use Gmail but I kept the account active and forwarded to Fastmail to catch anyone I forgot to update with the new address). I logged into Gmail and immediately changed my password, made sure I didn't have any third party app access, and turned on 2FA.

After seeing this HN piece and reading through the first few messages in the Google product forum, I realized it was typical spam that was breaking through Google's spam filter and freaking everyone out due to Google's handling of the Sent folder/label.

Hey guys, you can contact tellus via this link. You don't need to he a customer for this.

https://www.telus.com/en/support/article/ccts-and-cprst-feed...

Crazy, I'm glad it's not just me. Looking in my spam and there's dozens of them.

Here is a raw header for people smarter than me (I've changed my email to "[email protected]":

    Delivered-To: [email protected]
    Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH
    X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none;
            d=google.com; s=arc-20160816;
            b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU
             +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ
             0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX
             jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN
             A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI
             ziIw==
    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
            h=date:message-id:subject:to:from:arc-authentication-results;
            bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=;
            b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB
             Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB
             69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG
             Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B
             xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM
             cc6Q==
    ARC-Authentication-Results: i=1; mx.google.com;
           spf=pass (google.com: domain of [email protected] designates 91.203.70.10 as permitted sender) [email protected];
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Return-Path: <[email protected]>
    Received: from rine.play-wto.com ([91.203.70.10])
            by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19
            for <[email protected]>;
            Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
    Received-SPF: pass (google.com: domain of [email protected] designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10;
    Authentication-Results: mx.google.com;
           spf=pass (google.com: domain of [email protected] designates 91.203.70.10 as permitted sender) [email protected];
           dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for <[email protected]>;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
    Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245;
    from: Bitcoin Loophole <[email protected]>
    To: <[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>,<[email protected]>
    Subject: Are you still alone?
    Message-ID: <[email protected]=Mx.google.com>
    Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
    X-EMMAIL: <@googlemail.fr [email protected]>
    Date: Sun, 22 Apr 2018 01:54:19 -0400

Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "[email protected]" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources -- usually multiple received headers form a chain of custody for the email, and this looks like two different sources somehow both sent the same message ... maybe one of those is forged?).

The only part of this that looks like a Google-specific bug to me is that I'm not sure Gmail should be dropping messages into your Sent folder that did not originate from your authenticated account. If you send a message using some other mail client that logs in to your Gmail account, or an app, or the web app, sure, but if a message just pops into your account with your address as the "from:" header, it shouldn't show up in your Sent label.

The rest of this is just email being as broken as it usually is.

SPF only checks the envelope-from. It doesn't check the other "from:" header. Anybody can easily clone anybody else's SPF records, so any service that allows you to route mail through them and has already cloned Google's SPF records (so that users can send mail through Gmail's servers using their @telus.com address) is vulnerable to this.

If SPF were changed to also check the other from: header, then it would break every single domain that uses Google's mail hosting services but hasn't updated their SPF records. So that's never gonna happen.

This is maybe the biggest reason I wish people would stop using Gmail for any kind of important mail services. The moment you do that, mail from your domain can be spoofed by any other outfit that also uses Gmail, and it will pass SPF, which means it'll cruise right through most spam filters.

DKIM can resolve some of this, but it comes along with a suitcase full of its own nightmares.

Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for SPF), or DKIM domain and From: header.

DMARC could solve this problem, but it would break a lot of things reliant on forwards. When Yahoo set their DMARC policy to reject, there was quite a stir about it: https://www.ietf.org/mail-archive/web/ietf/current/msg87153....

In this particular case, it seems the major issue is that spammers got access to 69.64.35.11, which is included in telus.com's SPF record. In the end, this will hurt deliverability for legitimate emails sent with telus.com in the return path, and I suspect telus.com's customer service will have some explaining to do for their customers.

ARC is the new standard designed to fix the DMARC edge case with forwarding. It's relatively new, though, so adoption isn't nearly as widespread as SPF, DKIM, or DMARC.

ryan-c comments below that the 'exists:' config at Telus allows any IP to send mail.

Spammers seem to be abusing this hole.

You're right. I was thinking DMARC but wrote DKIM.

it does say DMARC=fail fwiw

Gmail's sent folder isn't a sent folder in the traditional sense. It's a label that just filters mails based on the "from" address.

Are you sure about that? I have gotten many spoofed spam emails before but I've never seen them appear in my sent folder before. Furthermore when I search "from:[my email]", I see a different listing than when I look in the sent folder.

I have a very short gmail address so I get _loads_ of spam daily. The above is actually correct. Emails from my address, even though they are spoofed will show up in my Sent folder until I mark them as Junk. I just checked with the 3-4 spams I received last night all all where in Sent.

That's a bug. Does anyone disagree?

It's non-standard, for sure, but it's "by design" and I suppose they can do whatever they want on their own platform. I'll stick with my IMAP4-compliant mail server, though.

I disagree because your sent mail also appears in your inbox and vice versa as part of threads.

It was always like this and I never considered it as bug.

Then that is really stupid. I want an email client, not a gmail client.

Re: others forging your domain by using Gmail - this is only true in narrow edge cases like this one (which appears to have been relatively quickly fixed by Gmail).

In practice, the Gmail and G suite UIs provide enforcement mechanisms to ensure you own a domain/address before allowing you to send from it.

Does it potentially open you up to spoofing if another loophole/exploit like this is discovered? Sure. But as risk factors go, depending on who you are, that's probably relatively low on the list.

Adding to this. You can only use Gmail for sending with your own domains when you have 2FA enabled.

Not really. It also works if you also lower your account security setting to low to enable 'Less-secured app' to login.

Sure that is still available? Pretty sure this is disabled for a few years now. At least it was when I checked last time.

Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles.

----

ETA: Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows up under "Sent" as well.

After opening up "Show Original" in a new tab and then returning to the message, there's now a small banner (with a yellow background) at the top that reads:

> This may be a spoofed message. Gmail couldn't verify that it was actually sent from your account. Learn more.

The strange thing is the article is a year old? Why would it suddently be exploited now? I find it difficult to believe no one's tried until today?

It's probably been exploited for quite a while already, takes a certain time and threshold until these kinds of things fully bubble up to the public.

People who've been affected might not have noticed or cared enough to say/do something.

Maybe some dark-hat's side project finally reached a major milestone and was released?

No idea.

Apparently someone just found out about it and decided to try it out -- it's obviously "new" to a lot of HN'ers as well.

There is something strange about those headers. Are they all from the same email?

There are two Received: with by mx.google.com, and they are nearly two days apart. And there are two Received-SPF: headers.

Other than that, my guess is that the spammer has BCC'd you and put your email address in the from: header (oddly lowercase here). Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail.

The extra ones are probably made up by the spammer trying to trick Google's anti spam machinery.

When I was an anti-spam engineer 10 years ago, we saw this sort of tricks all the time. Basically the only headers you can trust are the ones inserted by your own infrastructure. DKIM does mitigate this somewhat, but of course has its own problems.

>Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail.

On the principle of least surprise, this would seem to be incomplete behavior. I bet every single person reading this was surprised.

It's not a bad place to put such mail, so I suggest that on its web and mobile interface, Gmail simply put some kind of badge for sent mail sent from outside Gmail or your devices. Example:

https://imgur.com/a/KEMf1HM

(Notice the ⓘ [circled i] in the first line.)

Source: I mocked above up from Google image search for "gmail sent folder" and an open clipart "information icon".

If you click on that i or hover it should mention that some of these messages were sent from outside Gmail or from your authorized devices but have been put in your Sent folder because your email address is in the from: field.

People notoriously won't know what a new badge means, and this being an uncommon scenario, no one will, panic ensues.

It might be better if such email was automatically marked as spam until the user marks it as good. If they keep doing that, then that send path should gain elevated trust. (I mean, they are using some ML system here right?) I'm imagining an anti-spam-campaign supervisor system that also tracks spam with some sort of soft hash (or ML), running across many user's email.

I can see this getting easily confused with emoji subject lines: http://www.emailmarketingtipps.de/2015/05/11/animated-emojis...

The last Received: and Received-SPF: headers are forged. It's pretty common for spammers to do that, apparently in an attempt to "trick" either spam filtering software or a person looking at the headers.

You could make a filter like this: The email is spam if FROM and TO address = [email protected] AND Return-Path is not = [email protected]

So you could still send emails to your self and they would not get flagged as spam.

The thing is I've used Gmail for nearly 10 years (give or take) - and I've never once had a spoofed email reach my inbox. Ever.

Something must have changed, most likely in the past 24 hours (give or take) to allow this to suddenly occur? Or someone's worked out a way passed the gmail spam filters or something.

Either way - this is clearly "new".

I’ve used Gmail for longer and I’ve seen it a lot over the years. What’s most likely changed is the volume at which the spammers are doing it, so you finally started seeing some come your way.

That would have been nice, but you can't actually filter by return-path in gmail :(

Hey guys, you can contact tellus via this link. You don't need to he a customer for this.

https://www.telus.com/en/support/article/ccts-and-cprst-feed...

It’s clearly failing DMARC there. Very odd.

Same too. The odd thing for me is that the client address (from the original text) was an AWS address. Only two appeared in the main inbox. More were sent straight to spam.

They appeared just after I turned on my AWS instance briefly. So I thought it was related.

When you changed your password did you receive a google code from a 614 area code number?

wow... reading this thread is scary. Google is a joke; my humble advice would be to close your accounts and pay for a better service, life Fastmail or Protonmail.