Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Bojan Zdrnja (bojan.zdrnjagmail.com)
Date: Sun May 11 2008 - 04:37:31 CDT
On Sat, May 10, 2008 at 8:04 PM, Todd T. Fries <toddfries.net> wrote:
> Yes this is very frustrating.
> The details are not so hard to guess. Unless this post is different,
> anyone can send an email to a nonexistent user at a google service and
> they accept it and bounce back to the envelope recipient. *sigh*.
They don't, for normal gmail service:
$ telnet gmail-smtp-in.l.google.com 25
Connected to gmail-smtp-in.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP n10si11051555mue.14
250 mx.google.com at your service
mail from: <bugtraqsecurityfocus.com>
250 2.1.0 OK
rcpt to: <nonexistinguserongmailgmail.com>
550-5.1.1 This Gmail user does not exist. Please try double-checking
550-5.1.1 the recipient's email address for typos or unnecessary spaces.
550-5.1.1 Learn more at
550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596
221 2.0.0 mx.google.com closing connection n10si11051555mue.14
Connection closed by foreign host.
They do have some problems with Google Groups, as far as I'm aware.
I don't really see a big vulnerability here. Any organization that has
mass accounts will have problems with relaying stuff, it's just more
visible with Gmail (that being said, there are many many other things
they can do to improve this).
Other sites shouldn't really configure their filters to blindly accept
e-mail from Google's servers, just because it's Google (and that's
part of the issue here as well).
Bojan Zdrnja, B.Sc.
Senior Information Security Consultant