On Sat, May 10, 2008 at 8:04 PM, Todd T. Fries <todd@xxxxxxxxx> wrote: > Yes this is very frustrating. > > The details are not so hard to guess. Unless this post is different, > anyone can send an email to a nonexistent user at a google service and > they accept it and bounce back to the envelope recipient. *sigh*. They don't, for normal gmail service: $ telnet gmail-smtp-in.l.google.com 25 Trying 209.85.135.114... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP n10si11051555mue.14 helo test 250 mx.google.com at your service mail from: <bugtraq@xxxxxxxxxxxxxxxxx> 250 2.1.0 OK rcpt to: <nonexistinguserongmail@xxxxxxxxx> 550-5.1.1 This Gmail user does not exist. Please try double-checking 550-5.1.1 the recipient's email address for typos or unnecessary spaces. 550-5.1.1 Learn more at 550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 n10si11051555mue.14 quit 221 2.0.0 mx.google.com closing connection n10si11051555mue.14 Connection closed by foreign host. They do have some problems with Google Groups, as far as I'm aware. I don't really see a big vulnerability here. Any organization that has mass accounts will have problems with relaying stuff, it's just more visible with Gmail (that being said, there are many many other things they can do to improve this). Other sites shouldn't really configure their filters to blindly accept e-mail from Google's servers, just because it's Google (and that's part of the issue here as well). Cheers, Bojan -- Bojan Zdrnja, B.Sc. CISSP/GCIA/GCIH Senior Information Security Consultant Infigo IS http://www.infigo.hr/en
