News for hackers. Stuff that matters.

A comment on My account is sending spam emails. Parent comment

Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:18AM (#16894950)
Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results.

The current SPF records for telus.com don't seem to allow sending by 69.64.35.11.

Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed?

Also, the timestamps on the received headers differ by a lot. This one:

    Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
            by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
            for <[email protected]>;
            Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
appears to be identical (except for the email address) for the two sample sets of headers in the thread.
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:51AM (#16895030)
Telus has this entry:

    exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com
Reading RFC 7208, that would be expanded to

    exists:CL.69.64.35.11.FR.reply.F2.telus.com.spf.nssi.telus.com
which means if that any record exists at that name, it will pass.

    dig +short cl.69.64.35.11.fr.reply.f2.telus.com.spf.nssi.telus.com
    127.0.0.1
trying a few other values, it seems that telus.com is saying ALL IP addresses are allowed to send for it.
[ Parent | on HN ]
Re:My account is sending spam emails by tetha on Sunday April 22, 2018 @03:19AM (#16895105)
It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.
[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @10:42AM (#16896356)
They appear to have quitely fixed it.
[ Parent | on HN ]
Re:My account is sending spam emails by tetha on Sunday April 22, 2018 @12:20PM (#16896823)
Indeed, the DNS records are gone. They had a tweet[1] 1 hour or 2 ago how they are working on it. I guess someone got phoned on his sunday to fix it. I'm hoping for a further update from their side what happened.

1: https://twitter.com/TELUSsupport/status/988060048843657216

[ Parent | on HN ]
Re:My account is sending spam emails by zephharben on Sunday April 22, 2018 @02:30AM (#16894986)
mxtoolbox indicates that SPF for telus.com redirects to "_spf_telus_com.nssi.telus.com", which designates "_spf.google.com" as an authorized sender.

That's why the SPF check doesn't fail.

However, in the year 2018 I'm shocked that Gmail would put messages that fail dmarc into users' inboxes.

[ Parent | on HN ]
Re:My account is sending spam emails by ryan-c on Sunday April 22, 2018 @02:38AM (#16894996)
It's not being sent from any of the IPs listed under _spf.google.com, though.
[ Parent | on HN ]