12 ms·

My account is sending spam emails

647 points by benpink 8y ago

Operyl 8y ago
This is spoofed email, with you also being the recipient as far as I can tell... Am I missing anything else in this matter? If not, this isn't new. EDIT from below: "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well."
- alex_young 8y ago
  They are reporting the items in their sent items though...
  - Operyl 8y ago
    If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well.
  - johnrob 8y ago
    My guess is the sent folder is just a label where from-address matches one of your emails. Spoofing the inbox in the manner mentioned here will naturally also fool the sent folder.
- CivilEngineer 8y ago
  No no! There's something going on here. These emails are in the sent email folder, and people who are definitely not compromised (long random passwords, 2fa, and checked the device login log from google are showing nothing.)
- DEFCON28 8y ago
  Read the thread before you comment! People are reporting these messages are in their sent mail folder! Now it's possible that gmail makes it looks like it was "sent mail" if it receives a message "from you" even if you didn't send it, but it's also possible that google has been hacked in a big way. And some of the people reporting this are knowledgeable people who know what spoofing is, and who have good unique passwords and two-factor enabled.
  - Operyl 8y ago
    I did read it before I commented. I just proved what I said below (before you commented). "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well." Google threw it in my Sent Items despite me not sending it from gmail itself.
    - CivilEngineer 8y ago
      So you read the thread and then edited your statement to make you look like you read it! First class work.
FuckOffNeemo 8y ago
My house mate has had the same issue today on both of his Google accounts. He is both the sender and recipient and there were several other nonsensical email addresses being CC'd in. SMTP headers show the emails are relayed from Telus. I'll provide the SMTP headers when I get home. = = = No unauthorised attempts to log in from third party sources, seperate passwords and MFA on both services. It doesn't seem to me that the accounts have been compromised, instead the emails are spoofed. They have all been forwarded from Telus.com. The forum OP posted shows everyone else has the same issue. Both accounts were sending hundreds of emails today and Google flagged the emails as likely having not been sent by him, but still did not place them in an appropriate spam filters and allowed them through to his inbox? Edit: = = = = = I won't bother adding my headers now, the others that have even added theirs are almost identical to our own, here's a snippet of some one who posted below: SPF and DMARC results ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<myemail@gmail.com>>; Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245;
- foota 8y ago
  What do the DKIM and SPF checks say?
  - FuckOffNeemo 8y ago
    Same as the others that have been posted. DMARC failed and SPF shows that Telus.com was an approved SMTP relay for Google.com Edit: posted into my original comment.
Keverw 8y ago
I got 2 of these a hour ago. "This may be a spoofed message" Google says, I clicked spam even though it's from myself. It was to me and a bunch of other emails. Wasn't in my sent folder though and no one else has accessed my account. "Sexy Girls Asian Girls Looking for US Men" is the subject and says it's sent from "----------------- via telus.com" Really odd, seems to be some ISP in Canada and I live in the USA... Wonder how they got my email.
- coleschifer 8y ago
  I encountered the same thing, but different adverts.
- Spooky23 8y ago
  Weird. My wife and I got the same email.
- lione 8y ago
  Telus is a phone/ISP company, they're pretty much uninvolved other then the ability to send emails from a @gmail.com address for their customers needs. Spammers are just utilizing that for malicious purposes with spoofed headers. As for how they got your email, the spammers could very well be working from the US too, Telus is just a tool. But then again on the internet boundaries matter less and they could be halfway across the world and got your email from a random online leaked list.
aquova 8y ago
I had some of these earlier today as well. Mine wasn't from telus however, it was from some .science account. I use a password manager and have 2FA enabled, but I quickly switched my password just to make sure. Sure enough, a few hours later I got another one, for about 5 in total. They seemed to have stopped however.
SyneRyder 8y ago
Another HN thread with more comments about this: https://news.ycombinator.com/item?id=16894593 https://news.ycombinator.com/item?id=16894593
jimrandomh 8y ago
If you have a suspicious or spoofed email and you want people to analyze what happened, it helps a lot if you include the full headers. To do this in gmail, open the menu and pick "Show Original". Particularly useful are the lines that start with "Received:".
ninjaranter 8y ago
I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: <myemail@gmail.com> Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none; d=google.com; s=arc-20160816; b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD 86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD Lzng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=; b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d 7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ e5RA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [69.64.35.11]) by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30 for <<myemail@gmail.com>>; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) client-ip=69.64.35.11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<myemail@gmail.com>>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245; from: ABC Shark Tank <<myemail@gmail.com>> To: <senderus@justvaluerate.com>, <senderse@justvaluerate.com>, <monsl@50-233-80-21-static.hfc.comcastbusiness.net>, <mz@traveldailymedia.com>, <gego@nih.gov>, <iscontact@rei.com>, <mz@wp.com>, <info@chadog.fr>, <info@autotrader.com> Subject: Exclusive Limited Time Online Offer Shark Tank Success Story Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr <myemail@gmail.com>> Date: Sat, 21 Apr 2018 22:48:30 -0400 --f4f5e80f07d80f991b056a2936a0
lukeholder 8y ago
My father and I have been getting these all evening.
mediocrejoker 8y ago
I had the same thing happen today. At least 6-8 emails in my inbox over the course of an hour or two, from my email address. Mostly ads for "dating" sites with photos of scantily-clad women. The to list includes my address, as well as about 8-10 other addresses, including one at rei.com and another at nih.gov. Mine are showing Telus in the relay as well. None show up in the sent folder, and I use 2FA on the account.
jeroenheijmans 8y ago
Perhaps it's a browser extension/plugin that got hacked?
- firewalkwithme 8y ago
  Yeah, I am also thinking app or phone
laurencei 8y ago
Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case". However one interesting part is after about 4 hours the emails automatically became marked as "spam" - and they disappeared from my "sent" folder simulatenously. So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels. Seems this was flagged as a security risk over a year ago - and Google declined to fix? https://www.zdnet.com/article/spammers-delight-gmail-weirdly-doesnt-see-spoofed-gmail-com-addresses-as-junk/ https://www.zdnet.com/article/spammers-delight-gmail-weirdly...
- laurencei 8y ago
  Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none; d=google.com; s=arc-20160816; b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ 0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI ziIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=; b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB 69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM cc6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from rine.play-wto.com ([91.203.70.10]) by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19 for <my.email.fake@gmail.com>; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245; from: Bitcoin Loophole <my.email.fake@gmail.com> To: <senderus@justvaluerate.com>,<senderse@justvaluerate.com>,<monsl@50-233-80-21-static.hfc.comcastbusiness.net>,<mz@traveldailymedia.com>,<gego@nih.gov>,<iscontact@rei.com>,<mz@wp.com>,<info@chadog.fr>,<info@autotrader.com> Subject: Are you still alone? Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr my.email.fake@gmail.com> Date: Sun, 22 Apr 2018 01:54:19 -0400
Tagore 8y ago
I remember when my mom's machine started sending spam with my name in the address field. Clever Trojan.
hartator 8y ago
From the way the emails are sent, I bet it's an Android security hole.
- andromeduck 8y ago
  What about those of us who don't use Android phones?
kerng 8y ago
Relevant security issue Gmail declined to fix over a year ago: https://www.zdnet.com/article/spammers-delight-gmail-weirdly-doesnt-see-spoofed-gmail-com-addresses-as-junk/ https://www.zdnet.com/article/spammers-delight-gmail-weirdly...
- ajnin 8y ago
  I'm not sure how they would fix that, assuming that's even a bug. The email protocol is completely unverified, anyone can send the header they please, including spoofed From: headers. The GMail client itself even allows it, when you compose a new email you can change the "From" to anything. That's actually a rather useful feature when you have several addresses redirecting to one gmail address.
DrScump 8y ago
This strategy seems odd. If they had simply omitted the spoofed sending email address from the To:/(B)cc lines, we'd never had seen them in our inboxes... right? Why call early attention to yourself? I had 24 in my Inbox starting as 6:13PM (GMT-7).
- p49k 8y ago
  Maybe that’s part of the technique to trip up Google’s spam filters, as Google might have assumed that spammers would never bcc the sender and thus treat such mails as more likely to be legitimate.
downandout 8y ago
I had the same issue tonight. It did not appear in my sent folder, however, and was sent from the same “reply@telus.com” account that everyone else reports. The most recent one (of 5 sent so far) was sent 2 minutes ago. I changed my password an hour ago - but as I suspected that didn’t help because these aren’t being sent via compromised accounts. Someone is using an SMTP server and just spoofing the sent from address.
jlgaddis 8y ago
Don't freak out about them being in your Sent folder. Remember that Gmail doesn't have "traditional" mail folders -- just a huge pile of all your e-mail messages with "labels" attached to them. Apparently Google decides that if the From: address is yours, then you "sent" the message. Note that in SMTP there are two "from addresses": the envelope sender (which you don't see) and the "From:" address/header (which you do see) that everyone is familiar with. In most (but not all) legitimate e-mail, they will be the same. In these cases, your e-mail address is being used in the "From:" and "To:" headers but a different address is being used in the envelope sender (which is the one that the MTA uses). Google does seem to be checking SPF correctly (i.e., according to RFC, which says to use the envelope sender) -- since (it seems that) the result of check_host should be "softfail" and the RFC says that one "SHOULD NOT" reject a message based on that... but Google apparently logged "pass". Odd. --- ETA: See a comment from ryan-c below about the funky "exists:" mechanism in Telus' SPF record; it explains why check_host() passed.
- berg01 8y ago
  > Apparently Google decides that if the From: address is yours, then you "sent" the message. Bad design, period.
- notriddle 8y ago
  > In most (but not all) legitimate e-mail, they will be the same. Just to be clear, most automated emails from major providers have them different. This is because, while the From header is shown to the user, the envelope sender is sent bounces. So companies like Google, SendGrid (used by GitHub), and MailChimp set up special "bounce handler" addresses as the envelope sender to detect if there's a problem sending you email. https://en.m.wikipedia.org/wiki/Variable_envelope_return_path https://en.m.wikipedia.org/wiki/Variable_envelope_return_pat...
c3534l 8y ago
There was an attack going around many years ago that was basically a spam email that had code embedded in it, which would hack your browser, causing you to send out more spam email when you logged into your account. I assume this is the same sort of thing.
- Operyl 8y ago
  Nope. This is just Gmail appending the "Sent" label to an email that you received from "you". You didn't actually send it, it was just a spoofed From header.
mexicanandre 8y ago
Yes my gmail spam has gone nuts!!!! Wtf has happened
helloindia 8y ago
I’ve had similar problem a long time ago with my yahoo account. (Password change didn’t help) So, I cleared my yahoo contact list and that stopped the spam.
dawnerd 8y ago
Just wanted to say, the top response on the google forum is exactly why google needs real support and not community members copy-pasting “solutions”.
- ocdtrekkie 8y ago
  Stories like this make me glad I use an email service which values me enough to have real humans who actually work there answer my support requests.
  - Bedon292 8y ago
    What do you use as your email service?
    - ocdtrekkie 8y ago
      FastMail. I've opened a handful of support tickets and always gotten an answer within a few hours.
- tomkwong 8y ago
  https://support.google.com/mail/answer/50200?hl=en https://support.google.com/mail/answer/50200?hl=en
  - hedora 8y ago
    I think that link was pasted in sarcastically - Microsoft “support” style, where someone is paid to keyword-match your question without bothering to understand your question.
deleted 8y ago
[deleted]
mike-cardwell 8y ago
Some of you posting raw message sources might find a website I built useful: https://www.parsemail.org https://www.parsemail.org From my about page: "Paste the raw source of an email into the form on the front page. The email will then be parsed, decoded, separated into its various MIME parts, and displayed in an easy to view fashion. Image attachments will be displayed as images. HTML parts will be rendered in webkit (with javascript and plugins disabled) and then also displayed as an image. IP addresses in headers and message bodies will be identified and highlighted along with a flag representing their origin country. Hostnames and email addresses will also be identified and highlighted."
- timvdalen 8y ago
  Wow, that's really useful! Whenever I get a weird/suspicious email the first thing I do is look at the source but the amount of info in there (and different encodings) can make it hard to grasp what's going on. I'll definitely use this in the future!
jlengrand 8y ago
Great to see this! I was getting mad at all this SPAM coming from myself today!
piyush_soni 8y ago
Wow. I've been facing this since yesterday night, didn't know the entire internet is facing this problem. There's still no official response from Google it seems.
DigitalSea 8y ago
Crazy. This was happening to me today as well. Tonnes of spam from my email, but being sent to these weird blanket emails. Worrying.
imraj96 8y ago
Same thing here! I woke up this morning and saw that I've sent out spam emails (about 15 of them) with my email address via telus and receive responses in my inbox.
dorfsmay 8y ago
I wonder if telus did this to allow people using their email system to use Google calendar to send reminders.
- Tempest1981 8y ago
  Who is Telus? I'm seeing the spam sent from me via Telus, but I don't use Telus, afaik. Their website is so abstract... sustainability, values, Health? No idea what they do.
  - dorfsmay 8y ago
    Telus is one of the major Canadian telecom companies, and one of the largest ISP in Canada. As such they provide @telus.com email address, and my thinking is that this is why they would add google.com to their SPF record, so that people registering google accounts with their telus email address could receive reminders sent by google but with the user's email address in the from field.
some1else 8y ago
Most people don't realize some services you "Logged into with Google" can also send emails in your name. I didn't come across anyone checking authorized apps in that thread. While this appears to be a spoofing issue, I suggest pruning the list of authorized apps frequently: https://support.google.com/accounts/answer/3466521?hl=en https://support.google.com/accounts/answer/3466521?hl=en
- popcorncolonel 8y ago
  I checked that and the only one that had email access was my Windows desktop. This led me to assume my PC had a virus, until I saw this thread.
- ebikelaw 8y ago
  Most people "don't realize" that because it's totally false. Only holders of specific OAuth scopes can use the Gmail API. The "basic account info" access that login with Google grants is not sufficient.
rco8786 8y ago
Ditto here. 1Password generated pw, 2fa, etc.
marsrover 8y ago
Something funny I've noticed is my business account is not receiving any spam but my free gmail account is.
tomkat0789 8y ago
This is pretty alarming. Is there another service to switch to that's as reliable and more generally safe as Gmail?
tlogan 8y ago
The emails are spoofed. The bug is Google is labeling emails with "Sent Mail" because "from:" header matches your email. I think the "bug" was that not all "Received-SPF" headers are not correctly checked (only first one was checked). However, I'm not even sure if this is a bug since I'm not sure if their migration of emails into G Suite will work if they start not trusting "from: header. The real bug is probably that email is not marked as spam :)
tytso 8y ago
So it's not so simple. You could use DMARC to tell mail servers which honor DMARC to drop all e-mails that have @gmail.com addresses that don't come from gmail.com servers. In fact, this is how @google.com e-mail addresses are treated, and I believe this is a setting which G-Suite administrators can set up for their domains. BUT. It comes with a downside. Suppose you want to send e-mail from your Linux laptop, or from a Linux mail server you control, without hard-coding your account password in a text file so you can send e-mail via a GMail server. Or suppose you want to subscribe to a mailing list which rewrites the subject line to include the mailing list name. DMARC breaks all of this. Horribly. So yes, it's more secure, but it comes with a massive cost. What this means, for example, is I recommend people who work at Google, and who want to interact with either IETF mailing lists or the Linux-kernel mailing lists at vger.kernel.org to send their patches and PULL requests using their @gmail.com address. If they send it using their @google.com address, the same security settings that will prevent this spammers from "faking" e-mails that didn't come from gmail servers, will also break git send-email (unless you want to save your password into at text file --- which is against policy and common sense) and it will break traditional mailing lists.
Tempest1981 8y ago
So who is Telus, and why are they special? Is it Google who has a relationship with Telus -- because I'm pretty sure I don't. Can Google prevent Telus from doing whatever they're doing? Or is Telus just the victim/conduit of the real spammers?
- lione 8y ago
  Telus is a phone company. They presumably deal with text/email stuff through their phone services, and they presumably have some sort of interactions with Gmail as a result. This isn't Telus doing it, it's just spammers utilizing the ability for Telus to send emails to customers. From someone else in the thread: "it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from")". Telus is just being maliciously used for something it rightfully offers to customers.
- appleiigs 8y ago
  Telus is a big telecom company in Canada: landline, mobile, ISP, TV. Other big companies comparable are Roger’s and Bell. Telus has a wikipedia page.
Screwtellus 8y ago
Hey guys, you can contact tellus via this link. You don't need to he a customer for this. https://www.telus.com/en/support/article/ccts-and-cprst-feedback-and-contact-information https://www.telus.com/en/support/article/ccts-and-cprst-feed...
Tempest1981 8y ago
If the emails are (spoofed as) from me, and I tell gmail to mark them as spam, does anything bad happen? Gmail shows a weird "Mute" instead option -- never saw that before.
sethvargo 8y ago
Hi all, Seth Vargo here from Google. Thank you all for taking the time to report the issue, and thank you for your patience as we fix it. Our engineering teams are aware of this issue and they are working to resolve it as quickly as possible. You should no longer see new spam messages appear in your sent box, and existing spam messages will be automatically removed over the next few days.
- appleiigs 8y ago
  Can you comment on what the issue actually is? Is the issue with gmail or telus or both?
  - deleted 8y ago
    [deleted]
  - sethvargo 8y ago
    We will share more information as it becomes available and relevant.
    - smt88 8y ago
      This is exactly the kind of non-human PR speak that saturates Google's response to customers in all forums. Promises are half-made and always broken. There doesn't seem to be a will or desire to aggregate and manager customers' concerns. I hope this time is different, and your team really does share more information as it becomes available and relevant. I doubt it, though, and will switch to a mail provider that I pay for and has good customer service (which is my inclination toward all Google services these days).
      - always_good 8y ago
        Why do people consistently think that an employee gives a shit about whether you continue using a service? I'm reminded of the summer I worked at the electronics booth at Target and people would threaten to take their precious business to Walmart.
dman214 8y ago
This happened to me today as well. I also run 2FA. Did not see any suspicious devices or activity in the log, other than the sent emails.
stanmancan 8y ago
I’ve been debating leaving Google Apps for months now and oddly enough this is the straw that broke the camels back. Will be migrating to a new host today.
criley2 8y ago
I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases. But my gmail has zero new logins, my 2fa wasn't triggered, etc. How does a hacker create labels to delete my email but not register a login attempt or trigger my 2fa? I wish I was able to contact google. EDIT: my only guess was accessing my PC where logins are saved, but I sleep in the same room and I don't think ninja spies broke in. Remote login? Seems farfetched.
- jiveturkey 8y ago
  the login occurred awhile ago?
ladram 8y ago
oh wow i just searched google to see what was goin on cuz i am getting this shit too ... it also was <randomletters@google.com=mx.google.com> in the MEssage ID one of them, at least the one that i was still in my sent mail Sent to random people, none of which whom i know I'm not as technical as some of you guys here, but i saved the message headers and sent it to google, anything that I can provide to help? I didn't read this whole thread, just skimming it. I just spent 2 hours also freaking out that I was hacked, (I have 2fa, reviewed security, revoked access from all apps even tho was already limited, changed password, ran malware checks, etc), I Really don't want to have to factory reset my phone, but I'm considering it. ALthough after reading here it seems to be some perps who managed to find a flaw in the way google handles message headers(?, i'll read through more to understand just outta curiousity). One thing I will mention, I accidentally clicked one of those redirected ads last night (and I use BRAVE Browser which blocks most all ads) on mobile, I was so mad at myself, it literally was a tap accident, I wasn't paying attention and talking to someone at the same time. It does seem like a weird coincidence that the same time I did that, this happened. But maybe it is just a coincidence. If it's not, I'm inclined to literally factory reset my phone. Would anyone here advise to do so? Or is this really not on my end of my device or anything (btw I also have complex passwords & the like - I am pretttty tech savy, just not on the level of some of the people here). Thanks for all the info though, and let me know how I can contribute, if at all. oh also not sure if this is relevant, but I use PIA VPN ....
DanielDent 8y ago
Probably unrelated, but telus.net's SPF record appears to authorize RFC6598 (https://tools.ietf.org/html/rfc6598 https://tools.ietf.org/html/rfc6598) IP space: "v=spf1 ip4:199.185.220.0/24 ip4:198.161.157.0/24 ip4:198.161.156.0/24 ip4:204.209.205.0/26 ip4:209.171.16.0/24 ip4:100.64.0.0/24 mx ?all" 100.64.0.0/24 is within 100.64.0.0/10 Either I'm missing something, or Telus appears quite confused about the purpose/nature of SPF.
aetherspawn 8y ago
To temporarily alleviate this issue, I created the following filter to stop my phone ringing constantly: from:(me@gmail.com|me@salesforce.com) to:(me@gmail.com) -{has:attachment} Mark as read Skip the inbox Until I added this rule I was being pinged once a minute since lunch time yesterday. This ignores: emails from me, or some sales force spammer they were using, to me, that doesn’t have an attachment (so I can still email myself files).
sengork 8y ago
Some of you might want to see this as well: https://mashable.com/2018/04/22/google-gmail-spam-telus/ https://mashable.com/2018/04/22/google-gmail-spam-telus/
neop1x 8y ago
A bit unrelated but requiring login to just read a forum thread is not good. :( I don't want to login to google again on this device therefore I haven't seen the thread.
4llan 8y ago
I have this problem with my Hotmail/Outlook account for almost 5 years and Microsoft team don't even understand what's going on. - https://answers.microsoft.com/en-us/outlook_com/forum/oemail-osend/receiving-phishing-message-in-behalf-of-my-outlook/8201fe49-6a67-49a0-8f7e-b03f9a3bc786 https://answers.microsoft.com/en-us/outlook_com/forum/oemail...
loribeth28 8y ago
Hi my name Lori. I'm having some problems with my email I got one last Thursday of return@external.telus.com saying on it ( hey Loribeth28lloyd) I still love you I want to talk and fix this mess and I'm hurt) I replayed back to it but got nothing back?Please help me

647 points by benpink 8y ago

This is spoofed email, with you also being the recipient as far as I can tell... Am I missing anything else in this matter? If not, this isn't new. EDIT from below: "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well."

alex_young 8y ago
They are reporting the items in their sent items though...
- Operyl 8y ago
  If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well.
- johnrob 8y ago
  My guess is the sent folder is just a label where from-address matches one of your emails. Spoofing the inbox in the manner mentioned here will naturally also fool the sent folder.
CivilEngineer 8y ago
No no! There's something going on here. These emails are in the sent email folder, and people who are definitely not compromised (long random passwords, 2fa, and checked the device login log from google are showing nothing.)
DEFCON28 8y ago
Read the thread before you comment! People are reporting these messages are in their sent mail folder! Now it's possible that gmail makes it looks like it was "sent mail" if it receives a message "from you" even if you didn't send it, but it's also possible that google has been hacked in a big way. And some of the people reporting this are knowledgeable people who know what spoofing is, and who have good unique passwords and two-factor enabled.
- Operyl 8y ago
  I did read it before I commented. I just proved what I said below (before you commented). "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well." Google threw it in my Sent Items despite me not sending it from gmail itself.
  - CivilEngineer 8y ago
    So you read the thread and then edited your statement to make you look like you read it! First class work.

FuckOffNeemo 8y ago

My house mate has had the same issue today on both of his Google accounts. He is both the sender and recipient and there were several other nonsensical email addresses being CC'd in. SMTP headers show the emails are relayed from Telus. I'll provide the SMTP headers when I get home. = = = No unauthorised attempts to log in from third party sources, seperate passwords and MFA on both services. It doesn't seem to me that the accounts have been compromised, instead the emails are spoofed. They have all been forwarded from Telus.com. The forum OP posted shows everyone else has the same issue. Both accounts were sending hundreds of emails today and Google flagged the emails as likely having not been sent by him, but still did not place them in an appropriate spam filters and allowed them through to his inbox? Edit: = = = = = I won't bother adding my headers now, the others that have even added theirs are almost identical to our own, here's a snippet of some one who posted below: SPF and DMARC results ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<myemail@gmail.com>>; Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245;

foota 8y ago
What do the DKIM and SPF checks say?
- FuckOffNeemo 8y ago
  Same as the others that have been posted. DMARC failed and SPF shows that Telus.com was an approved SMTP relay for Google.com Edit: posted into my original comment.

Keverw 8y ago

I got 2 of these a hour ago. "This may be a spoofed message" Google says, I clicked spam even though it's from myself. It was to me and a bunch of other emails. Wasn't in my sent folder though and no one else has accessed my account. "Sexy Girls Asian Girls Looking for US Men" is the subject and says it's sent from "----------------- via telus.com" Really odd, seems to be some ISP in Canada and I live in the USA... Wonder how they got my email.

coleschifer 8y ago
I encountered the same thing, but different adverts.
Spooky23 8y ago
Weird. My wife and I got the same email.
lione 8y ago
Telus is a phone/ISP company, they're pretty much uninvolved other then the ability to send emails from a @gmail.com address for their customers needs. Spammers are just utilizing that for malicious purposes with spoofed headers. As for how they got your email, the spammers could very well be working from the US too, Telus is just a tool. But then again on the internet boundaries matter less and they could be halfway across the world and got your email from a random online leaked list.

aquova 8y ago

I had some of these earlier today as well. Mine wasn't from telus however, it was from some .science account. I use a password manager and have 2FA enabled, but I quickly switched my password just to make sure. Sure enough, a few hours later I got another one, for about 5 in total. They seemed to have stopped however.

SyneRyder 8y ago

Another HN thread with more comments about this: https://news.ycombinator.com/item?id=16894593 https://news.ycombinator.com/item?id=16894593

jimrandomh 8y ago

If you have a suspicious or spoofed email and you want people to analyze what happened, it helps a lot if you include the full headers. To do this in gmail, open the menu and pick "Show Original". Particularly useful are the lines that start with "Received:".

ninjaranter 8y ago

I had the same thing in my account (same relay through Telus). Here're my headers Delivered-To: <myemail@gmail.com> Received: by 10.74.77.209 with SMTP id p78csp1252253ood; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5 X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none; d=google.com; s=arc-20160816; b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD 86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD Lzng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=; b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d 7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ e5RA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [69.64.35.11]) by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30 for <<myemail@gmail.com>>; Sat, 21 Apr 2018 19:48:30 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) client-ip=69.64.35.11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 69.64.35.11 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<myemail@gmail.com>>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 69.64.35.11 as permitted sender) client-ip=13.58.85.245; from: ABC Shark Tank <<myemail@gmail.com>> To: <senderus@justvaluerate.com>, <senderse@justvaluerate.com>, <monsl@50-233-80-21-static.hfc.comcastbusiness.net>, <mz@traveldailymedia.com>, <gego@nih.gov>, <iscontact@rei.com>, <mz@wp.com>, <info@chadog.fr>, <info@autotrader.com> Subject: Exclusive Limited Time Online Offer Shark Tank Success Story Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr <myemail@gmail.com>> Date: Sat, 21 Apr 2018 22:48:30 -0400 --f4f5e80f07d80f991b056a2936a0

lukeholder 8y ago

My father and I have been getting these all evening.

mediocrejoker 8y ago

I had the same thing happen today. At least 6-8 emails in my inbox over the course of an hour or two, from my email address. Mostly ads for "dating" sites with photos of scantily-clad women. The to list includes my address, as well as about 8-10 other addresses, including one at rei.com and another at nih.gov. Mine are showing Telus in the relay as well. None show up in the sent folder, and I use 2FA on the account.

jeroenheijmans 8y ago

Perhaps it's a browser extension/plugin that got hacked?

firewalkwithme 8y ago
Yeah, I am also thinking app or phone

laurencei 8y ago

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case". However one interesting part is after about 4 hours the emails automatically became marked as "spam" - and they disappeared from my "sent" folder simulatenously. So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels. Seems this was flagged as a security risk over a year ago - and Google declined to fix? https://www.zdnet.com/article/spammers-delight-gmail-weirdly-doesnt-see-spoofed-gmail-com-addresses-as-junk/ https://www.zdnet.com/article/spammers-delight-gmail-weirdly...

laurencei 8y ago
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none; d=google.com; s=arc-20160816; b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ 0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI ziIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=; b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB 69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM cc6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from rine.play-wto.com ([91.203.70.10]) by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19 for <my.email.fake@gmail.com>; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245; from: Bitcoin Loophole <my.email.fake@gmail.com> To: <senderus@justvaluerate.com>,<senderse@justvaluerate.com>,<monsl@50-233-80-21-static.hfc.comcastbusiness.net>,<mz@traveldailymedia.com>,<gego@nih.gov>,<iscontact@rei.com>,<mz@wp.com>,<info@chadog.fr>,<info@autotrader.com> Subject: Are you still alone? Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr my.email.fake@gmail.com> Date: Sun, 22 Apr 2018 01:54:19 -0400

Tagore 8y ago

I remember when my mom's machine started sending spam with my name in the address field. Clever Trojan.

hartator 8y ago

From the way the emails are sent, I bet it's an Android security hole.

andromeduck 8y ago
What about those of us who don't use Android phones?

kerng 8y ago

Relevant security issue Gmail declined to fix over a year ago: https://www.zdnet.com/article/spammers-delight-gmail-weirdly-doesnt-see-spoofed-gmail-com-addresses-as-junk/ https://www.zdnet.com/article/spammers-delight-gmail-weirdly...

ajnin 8y ago
I'm not sure how they would fix that, assuming that's even a bug. The email protocol is completely unverified, anyone can send the header they please, including spoofed From: headers. The GMail client itself even allows it, when you compose a new email you can change the "From" to anything. That's actually a rather useful feature when you have several addresses redirecting to one gmail address.

DrScump 8y ago

This strategy seems odd. If they had simply omitted the spoofed sending email address from the To:/(B)cc lines, we'd never had seen them in our inboxes... right? Why call early attention to yourself? I had 24 in my Inbox starting as 6:13PM (GMT-7).

p49k 8y ago
Maybe that’s part of the technique to trip up Google’s spam filters, as Google might have assumed that spammers would never bcc the sender and thus treat such mails as more likely to be legitimate.

downandout 8y ago

I had the same issue tonight. It did not appear in my sent folder, however, and was sent from the same “reply@telus.com” account that everyone else reports. The most recent one (of 5 sent so far) was sent 2 minutes ago. I changed my password an hour ago - but as I suspected that didn’t help because these aren’t being sent via compromised accounts. Someone is using an SMTP server and just spoofing the sent from address.

jlgaddis 8y ago

Don't freak out about them being in your Sent folder. Remember that Gmail doesn't have "traditional" mail folders -- just a huge pile of all your e-mail messages with "labels" attached to them. Apparently Google decides that if the From: address is yours, then you "sent" the message. Note that in SMTP there are two "from addresses": the envelope sender (which you don't see) and the "From:" address/header (which you do see) that everyone is familiar with. In most (but not all) legitimate e-mail, they will be the same. In these cases, your e-mail address is being used in the "From:" and "To:" headers but a different address is being used in the envelope sender (which is the one that the MTA uses). Google does seem to be checking SPF correctly (i.e., according to RFC, which says to use the envelope sender) -- since (it seems that) the result of check_host should be "softfail" and the RFC says that one "SHOULD NOT" reject a message based on that... but Google apparently logged "pass". Odd. --- ETA: See a comment from ryan-c below about the funky "exists:" mechanism in Telus' SPF record; it explains why check_host() passed.

berg01 8y ago
> Apparently Google decides that if the From: address is yours, then you "sent" the message. Bad design, period.
notriddle 8y ago
> In most (but not all) legitimate e-mail, they will be the same. Just to be clear, most automated emails from major providers have them different. This is because, while the From header is shown to the user, the envelope sender is sent bounces. So companies like Google, SendGrid (used by GitHub), and MailChimp set up special "bounce handler" addresses as the envelope sender to detect if there's a problem sending you email. https://en.m.wikipedia.org/wiki/Variable_envelope_return_path https://en.m.wikipedia.org/wiki/Variable_envelope_return_pat...

c3534l 8y ago

There was an attack going around many years ago that was basically a spam email that had code embedded in it, which would hack your browser, causing you to send out more spam email when you logged into your account. I assume this is the same sort of thing.

Operyl 8y ago
Nope. This is just Gmail appending the "Sent" label to an email that you received from "you". You didn't actually send it, it was just a spoofed From header.

mexicanandre 8y ago

Yes my gmail spam has gone nuts!!!! Wtf has happened

helloindia 8y ago

I’ve had similar problem a long time ago with my yahoo account. (Password change didn’t help) So, I cleared my yahoo contact list and that stopped the spam.

dawnerd 8y ago

Just wanted to say, the top response on the google forum is exactly why google needs real support and not community members copy-pasting “solutions”.

ocdtrekkie 8y ago
Stories like this make me glad I use an email service which values me enough to have real humans who actually work there answer my support requests.
- Bedon292 8y ago
  What do you use as your email service?
  - ocdtrekkie 8y ago
    FastMail. I've opened a handful of support tickets and always gotten an answer within a few hours.
tomkwong 8y ago
https://support.google.com/mail/answer/50200?hl=en https://support.google.com/mail/answer/50200?hl=en
- hedora 8y ago
  I think that link was pasted in sarcastically - Microsoft “support” style, where someone is paid to keyword-match your question without bothering to understand your question.

deleted 8y ago

[deleted]

mike-cardwell 8y ago

Some of you posting raw message sources might find a website I built useful: https://www.parsemail.org https://www.parsemail.org From my about page: "Paste the raw source of an email into the form on the front page. The email will then be parsed, decoded, separated into its various MIME parts, and displayed in an easy to view fashion. Image attachments will be displayed as images. HTML parts will be rendered in webkit (with javascript and plugins disabled) and then also displayed as an image. IP addresses in headers and message bodies will be identified and highlighted along with a flag representing their origin country. Hostnames and email addresses will also be identified and highlighted."

timvdalen 8y ago
Wow, that's really useful! Whenever I get a weird/suspicious email the first thing I do is look at the source but the amount of info in there (and different encodings) can make it hard to grasp what's going on. I'll definitely use this in the future!

jlengrand 8y ago

Great to see this! I was getting mad at all this SPAM coming from myself today!

piyush_soni 8y ago

Wow. I've been facing this since yesterday night, didn't know the entire internet is facing this problem. There's still no official response from Google it seems.

DigitalSea 8y ago

Crazy. This was happening to me today as well. Tonnes of spam from my email, but being sent to these weird blanket emails. Worrying.

imraj96 8y ago

Same thing here! I woke up this morning and saw that I've sent out spam emails (about 15 of them) with my email address via telus and receive responses in my inbox.

dorfsmay 8y ago

I wonder if telus did this to allow people using their email system to use Google calendar to send reminders.

Tempest1981 8y ago
Who is Telus? I'm seeing the spam sent from me via Telus, but I don't use Telus, afaik. Their website is so abstract... sustainability, values, Health? No idea what they do.
- dorfsmay 8y ago
  Telus is one of the major Canadian telecom companies, and one of the largest ISP in Canada. As such they provide @telus.com email address, and my thinking is that this is why they would add google.com to their SPF record, so that people registering google accounts with their telus email address could receive reminders sent by google but with the user's email address in the from field.

some1else 8y ago

Most people don't realize some services you "Logged into with Google" can also send emails in your name. I didn't come across anyone checking authorized apps in that thread. While this appears to be a spoofing issue, I suggest pruning the list of authorized apps frequently: https://support.google.com/accounts/answer/3466521?hl=en https://support.google.com/accounts/answer/3466521?hl=en

popcorncolonel 8y ago
I checked that and the only one that had email access was my Windows desktop. This led me to assume my PC had a virus, until I saw this thread.
ebikelaw 8y ago
Most people "don't realize" that because it's totally false. Only holders of specific OAuth scopes can use the Gmail API. The "basic account info" access that login with Google grants is not sufficient.

rco8786 8y ago

Ditto here. 1Password generated pw, 2fa, etc.

marsrover 8y ago

Something funny I've noticed is my business account is not receiving any spam but my free gmail account is.

tomkat0789 8y ago

This is pretty alarming. Is there another service to switch to that's as reliable and more generally safe as Gmail?

tlogan 8y ago

The emails are spoofed. The bug is Google is labeling emails with "Sent Mail" because "from:" header matches your email. I think the "bug" was that not all "Received-SPF" headers are not correctly checked (only first one was checked). However, I'm not even sure if this is a bug since I'm not sure if their migration of emails into G Suite will work if they start not trusting "from: header. The real bug is probably that email is not marked as spam :)

tytso 8y ago

So it's not so simple. You could use DMARC to tell mail servers which honor DMARC to drop all e-mails that have @gmail.com addresses that don't come from gmail.com servers. In fact, this is how @google.com e-mail addresses are treated, and I believe this is a setting which G-Suite administrators can set up for their domains. BUT. It comes with a downside. Suppose you want to send e-mail from your Linux laptop, or from a Linux mail server you control, without hard-coding your account password in a text file so you can send e-mail via a GMail server. Or suppose you want to subscribe to a mailing list which rewrites the subject line to include the mailing list name. DMARC breaks all of this. Horribly. So yes, it's more secure, but it comes with a massive cost. What this means, for example, is I recommend people who work at Google, and who want to interact with either IETF mailing lists or the Linux-kernel mailing lists at vger.kernel.org to send their patches and PULL requests using their @gmail.com address. If they send it using their @google.com address, the same security settings that will prevent this spammers from "faking" e-mails that didn't come from gmail servers, will also break git send-email (unless you want to save your password into at text file --- which is against policy and common sense) and it will break traditional mailing lists.

Tempest1981 8y ago

So who is Telus, and why are they special? Is it Google who has a relationship with Telus -- because I'm pretty sure I don't. Can Google prevent Telus from doing whatever they're doing? Or is Telus just the victim/conduit of the real spammers?

lione 8y ago
Telus is a phone company. They presumably deal with text/email stuff through their phone services, and they presumably have some sort of interactions with Gmail as a result. This isn't Telus doing it, it's just spammers utilizing the ability for Telus to send emails to customers. From someone else in the thread: "it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "reply@telus.com" return address (the "envelope from")". Telus is just being maliciously used for something it rightfully offers to customers.
appleiigs 8y ago
Telus is a big telecom company in Canada: landline, mobile, ISP, TV. Other big companies comparable are Roger’s and Bell. Telus has a wikipedia page.

Screwtellus 8y ago

Hey guys, you can contact tellus via this link. You don't need to he a customer for this. https://www.telus.com/en/support/article/ccts-and-cprst-feedback-and-contact-information https://www.telus.com/en/support/article/ccts-and-cprst-feed...

Tempest1981 8y ago

If the emails are (spoofed as) from me, and I tell gmail to mark them as spam, does anything bad happen? Gmail shows a weird "Mute" instead option -- never saw that before.

sethvargo 8y ago

Hi all, Seth Vargo here from Google. Thank you all for taking the time to report the issue, and thank you for your patience as we fix it. Our engineering teams are aware of this issue and they are working to resolve it as quickly as possible. You should no longer see new spam messages appear in your sent box, and existing spam messages will be automatically removed over the next few days.

appleiigs 8y ago
Can you comment on what the issue actually is? Is the issue with gmail or telus or both?
- deleted 8y ago
  [deleted]
- sethvargo 8y ago
  We will share more information as it becomes available and relevant.
  - smt88 8y ago
    This is exactly the kind of non-human PR speak that saturates Google's response to customers in all forums. Promises are half-made and always broken. There doesn't seem to be a will or desire to aggregate and manager customers' concerns. I hope this time is different, and your team really does share more information as it becomes available and relevant. I doubt it, though, and will switch to a mail provider that I pay for and has good customer service (which is my inclination toward all Google services these days).
    - always_good 8y ago
      Why do people consistently think that an employee gives a shit about whether you continue using a service? I'm reminded of the summer I worked at the electronics booth at Target and people would threaten to take their precious business to Walmart.

dman214 8y ago

This happened to me today as well. I also run 2FA. Did not see any suspicious devices or activity in the log, other than the sent emails.

stanmancan 8y ago

I’ve been debating leaving Google Apps for months now and oddly enough this is the straw that broke the camels back. Will be migrating to a new host today.

criley2 8y ago

I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases. But my gmail has zero new logins, my 2fa wasn't triggered, etc. How does a hacker create labels to delete my email but not register a login attempt or trigger my 2fa? I wish I was able to contact google. EDIT: my only guess was accessing my PC where logins are saved, but I sleep in the same room and I don't think ninja spies broke in. Remote login? Seems farfetched.

jiveturkey 8y ago
the login occurred awhile ago?

ladram 8y ago

oh wow i just searched google to see what was goin on cuz i am getting this shit too ... it also was <randomletters@google.com=mx.google.com> in the MEssage ID one of them, at least the one that i was still in my sent mail Sent to random people, none of which whom i know I'm not as technical as some of you guys here, but i saved the message headers and sent it to google, anything that I can provide to help? I didn't read this whole thread, just skimming it. I just spent 2 hours also freaking out that I was hacked, (I have 2fa, reviewed security, revoked access from all apps even tho was already limited, changed password, ran malware checks, etc), I Really don't want to have to factory reset my phone, but I'm considering it. ALthough after reading here it seems to be some perps who managed to find a flaw in the way google handles message headers(?, i'll read through more to understand just outta curiousity). One thing I will mention, I accidentally clicked one of those redirected ads last night (and I use BRAVE Browser which blocks most all ads) on mobile, I was so mad at myself, it literally was a tap accident, I wasn't paying attention and talking to someone at the same time. It does seem like a weird coincidence that the same time I did that, this happened. But maybe it is just a coincidence. If it's not, I'm inclined to literally factory reset my phone. Would anyone here advise to do so? Or is this really not on my end of my device or anything (btw I also have complex passwords & the like - I am pretttty tech savy, just not on the level of some of the people here). Thanks for all the info though, and let me know how I can contribute, if at all. oh also not sure if this is relevant, but I use PIA VPN ....

DanielDent 8y ago

Probably unrelated, but telus.net's SPF record appears to authorize RFC6598 (https://tools.ietf.org/html/rfc6598 https://tools.ietf.org/html/rfc6598) IP space: "v=spf1 ip4:199.185.220.0/24 ip4:198.161.157.0/24 ip4:198.161.156.0/24 ip4:204.209.205.0/26 ip4:209.171.16.0/24 ip4:100.64.0.0/24 mx ?all" 100.64.0.0/24 is within 100.64.0.0/10 Either I'm missing something, or Telus appears quite confused about the purpose/nature of SPF.

aetherspawn 8y ago

To temporarily alleviate this issue, I created the following filter to stop my phone ringing constantly: from:(me@gmail.com|me@salesforce.com) to:(me@gmail.com) -{has:attachment} Mark as read Skip the inbox Until I added this rule I was being pinged once a minute since lunch time yesterday. This ignores: emails from me, or some sales force spammer they were using, to me, that doesn’t have an attachment (so I can still email myself files).

sengork 8y ago

Some of you might want to see this as well: https://mashable.com/2018/04/22/google-gmail-spam-telus/ https://mashable.com/2018/04/22/google-gmail-spam-telus/

neop1x 8y ago

A bit unrelated but requiring login to just read a forum thread is not good. :( I don't want to login to google again on this device therefore I haven't seen the thread.

4llan 8y ago

I have this problem with my Hotmail/Outlook account for almost 5 years and Microsoft team don't even understand what's going on. - https://answers.microsoft.com/en-us/outlook_com/forum/oemail-osend/receiving-phishing-message-in-behalf-of-my-outlook/8201fe49-6a67-49a0-8f7e-b03f9a3bc786 https://answers.microsoft.com/en-us/outlook_com/forum/oemail...

loribeth28 8y ago

Hi my name Lori. I'm having some problems with my email I got one last Thursday of return@external.telus.com saying on it ( hey Loribeth28lloyd) I still love you I want to talk and fix this mess and I'm hurt) I replayed back to it but got nothing back?Please help me