Re: Exploiting Google MX servers as Open SMTP Relays
On Sat, May 10, 2008 at 8:04 PM, Todd T. Fries <todd@xxxxxxxxx> wrote:
> Yes this is very frustrating.
>
> The details are not so hard to guess. Unless this post is different,
> anyone can send an email to a nonexistent user at a google service and
> they accept it and bounce back to the envelope recipient. *sigh*.
They don't, for normal gmail service:
$ telnet gmail-smtp-in.l.google.com 25
Trying 209.85.135.114...
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP n10si11051555mue.14
helo test
250 mx.google.com at your service
mail from: <bugtraq@xxxxxxxxxxxxxxxxx>
250 2.1.0 OK
rcpt to: <nonexistinguserongmail@xxxxxxxxx>
550-5.1.1 This Gmail user does not exist. Please try double-checking
550-5.1.1 the recipient's email address for typos or unnecessary spaces.
550-5.1.1 Learn more at
550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596
n10si11051555mue.14
quit
221 2.0.0 mx.google.com closing connection n10si11051555mue.14
Connection closed by foreign host.
They do have some problems with Google Groups, as far as I'm aware.
I don't really see a big vulnerability here. Any organization that has
mass accounts will have problems with relaying stuff, it's just more
visible with Gmail (that being said, there are many many other things
they can do to improve this).
Other sites shouldn't really configure their filters to blindly accept
e-mail from Google's servers, just because it's Google (and that's
part of the issue here as well).
Cheers,
Bojan
--
Bojan Zdrnja, B.Sc.
CISSP/GCIA/GCIH
Senior Information Security Consultant
Infigo IS
http://www.infigo.hr/en