bugtraq - Re: Exploiting Google MX servers as Open SMTP Relays

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 11 May 2008 11:37:31 +0200
From: "Bojan Zdrnja" <bojan.zdrnja@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: Exploiting Google MX servers as Open SMTP Relays

On Sat, May 10, 2008 at 8:04 PM, Todd T. Fries <todd@...es.net> wrote:
> Yes this is very frustrating.
>
> The details are not so hard to guess.  Unless this post is different,
> anyone can send an email to a nonexistent user at a google service and
> they accept it and bounce back to the envelope recipient. *sigh*.

They don't, for normal gmail service:

$ telnet gmail-smtp-in.l.google.com 25
Trying 209.85.135.114...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP n10si11051555mue.14
helo test
250 mx.google.com at your service
mail from: <bugtraq@...urityfocus.com>
250 2.1.0 OK
rcpt to: <nonexistinguserongmail@...il.com>
550-5.1.1 This Gmail user does not exist. Please try double-checking
550-5.1.1 the recipient's email address for typos or unnecessary spaces.
550-5.1.1 Learn more at
550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596
n10si11051555mue.14
quit
221 2.0.0 mx.google.com closing connection n10si11051555mue.14
Connection closed by foreign host.

They do have some problems with Google Groups, as far as I'm aware.

I don't really see a big vulnerability here. Any organization that has
mass accounts will have problems with relaying stuff, it's just more
visible with Gmail (that being said, there are many many other things
they can do to improve this).
Other sites shouldn't really configure their filters to blindly accept
e-mail from Google's servers, just because it's Google (and that's
part of the issue here as well).

Cheers,

Bojan

-- 
Bojan Zdrnja, B.Sc.
CISSP/GCIA/GCIH
Senior Information Security Consultant

Infigo IS
http://www.infigo.hr/en