7 ms·

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freakin

Exact same thing for me. Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder. But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case". However one interesting part is after about 4 hours the emails automatically became marked as "spam" - and they disappeared from my "sent" folder simulatenously. So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels. Seems this was flagged as a security risk over a year ago - and Google declined to fix? https://www.zdnet.com/article/spammers-delight-gmail-weirdly-doesnt-see-spoofed-gmail-com-addresses-as-junk/ https://www.zdnet.com/article/spammers-delight-gmail-weirdly...

laurencei 8y ago
Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none; d=google.com; s=arc-20160816; b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ 0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI ziIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=; b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB 69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM cc6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from rine.play-wto.com ([91.203.70.10]) by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19 for <my.email.fake@gmail.com>; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245; from: Bitcoin Loophole <my.email.fake@gmail.com> To: <senderus@justvaluerate.com>,<senderse@justvaluerate.com>,<monsl@50-233-80-21-static.hfc.comcastbusiness.net>,<mz@traveldailymedia.com>,<gego@nih.gov>,<iscontact@rei.com>,<mz@wp.com>,<info@chadog.fr>,<info@autotrader.com> Subject: Are you still alone? Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr my.email.fake@gmail.com> Date: Sun, 22 Apr 2018 01:54:19 -0400
- deleted 8y ago
  [deleted]
- mingabunga 8y ago
  You could make a filter like this: The email is spam if FROM and TO address = my.email.fake@gmail.com AND Return-Path is not = my.email.fake@gmail.com So you could still send emails to your self and they would not get flagged as spam.
  - laurencei 8y ago
    The thing is I've used Gmail for nearly 10 years (give or take) - and I've never once had a spoofed email reach my inbox. Ever. Something must have changed, most likely in the past 24 hours (give or take) to allow this to suddenly occur? Or someone's worked out a way passed the gmail spam filters or something. Either way - this is clearly "new".
    - jsjohnst 8y ago
      I’ve used Gmail for longer and I’ve seen it a lot over the years. What’s most likely changed is the volume at which the spammers are doing it, so you finally started seeing some come your way.
  - yzmtf2008 8y ago
    That would have been nice, but you can't actually filter by return-path in gmail :(
- jlgaddis 8y ago
  Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA: Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows up under "Sent" as well. After opening up "Show Original" in a new tab and then returning to the message, there's now a small banner (with a yellow background) at the top that reads: > This may be a spoofed message. Gmail couldn't verify that it was actually sent from your account. Learn more.
wincy 8y ago
Crazy, I'm glad it's not just me. Looking in my spam and there's dozens of them.
emmelaich 8y ago
Same too. The odd thing for me is that the client address (from the original text) was an AWS address. Only two appeared in the main inbox. More were sent straight to spam. They appeared just after I turned on my AWS instance briefly. So I thought it was related.
kome 8y ago
wow... reading this thread is scary. Google is a joke; my humble advice would be to close your accounts and pay for a better service, life Fastmail or Protonmail.
Screwtellus 8y ago
Hey guys, you can contact tellus via this link. You don't need to he a customer for this. https://www.telus.com/en/support/article/ccts-and-cprst-feedback-and-contact-information https://www.telus.com/en/support/article/ccts-and-cprst-feed...
jjhb94 8y ago
When you changed your password did you receive a google code from a 614 area code number?
morganvachon 8y ago
I think this is exactly what is going on. Gmail doesn't use IMAP folders in the traditional sense, it uses labels. For something to appear in your "Sent" folder, it only has to show your email address as the sender. Since it's quite common for spammers to use your email address as the "From" in spam messages sent to you, Gmail automatically throws it in your Sent "folder" by way of a label. I freaked out at first when my Fastmail account started getting spammed seemingly by my old Gmail account (I no longer use Gmail but I kept the account active and forwarded to Fastmail to catch anyone I forgot to update with the new address). I logged into Gmail and immediately changed my password, made sure I didn't have any third party app access, and turned on 2FA. After seeing this HN piece and reading through the first few messages in the Google product forum, I realized it was typical spam that was breaking through Google's spam filter and freaking everyone out due to Google's handling of the Sent folder/label.

laurencei 8y ago

Here is a raw header for people smarter than me (I've changed my email to "my.email.fake@gmail.com": Delivered-To: my.email.fake@gmail.com Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none; d=google.com; s=arc-20160816; b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ 0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI ziIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:subject:to:from:arc-authentication-results; bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=; b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB 69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM cc6Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: <Reply@telus.com> Received: from rine.play-wto.com ([91.203.70.10]) by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19 for <my.email.fake@gmail.com>; Sat, 21 Apr 2018 22:54:19 -0700 (PDT) Received-SPF: pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) client-ip=91.203.70.10; Authentication-Results: mx.google.com; spf=pass (google.com: domain of reply@telus.com designates 91.203.70.10 as permitted sender) smtp.mailfrom=Reply@telus.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <my.email.fake@gmail.com>; Fri, 20 Apr 2018 00:37:14 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning nkhpw@google.com does not designate 91.203.70.10 as permitted sender) client-ip=13.58.85.245; from: Bitcoin Loophole <my.email.fake@gmail.com> To: <senderus@justvaluerate.com>,<senderse@justvaluerate.com>,<monsl@50-233-80-21-static.hfc.comcastbusiness.net>,<mz@traveldailymedia.com>,<gego@nih.gov>,<iscontact@rei.com>,<mz@wp.com>,<info@chadog.fr>,<info@autotrader.com> Subject: Are you still alone? Message-ID: <NkhPw@google.com=Mx.google.com> Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status X-EMMAIL: <@googlemail.fr my.email.fake@gmail.com> Date: Sun, 22 Apr 2018 01:54:19 -0400

deleted 8y ago
[deleted]
mingabunga 8y ago
You could make a filter like this: The email is spam if FROM and TO address = my.email.fake@gmail.com AND Return-Path is not = my.email.fake@gmail.com So you could still send emails to your self and they would not get flagged as spam.
- laurencei 8y ago
  The thing is I've used Gmail for nearly 10 years (give or take) - and I've never once had a spoofed email reach my inbox. Ever. Something must have changed, most likely in the past 24 hours (give or take) to allow this to suddenly occur? Or someone's worked out a way passed the gmail spam filters or something. Either way - this is clearly "new".
  - jsjohnst 8y ago
    I’ve used Gmail for longer and I’ve seen it a lot over the years. What’s most likely changed is the volume at which the spammers are doing it, so you finally started seeing some come your way.
- yzmtf2008 8y ago
  That would have been nice, but you can't actually filter by return-path in gmail :(
jlgaddis 8y ago
Yep, based on those headers it's the exact same thing discussed in the ZDNet and LinkedIn articles. ---- ETA: Just tried it myself, through my own mail server, and the headers are pretty much the same: the IPs are different, of course, and I didn't bother including extra forged Received: headers and such). This works beautifully -- message is in my Inbox (flagged as "Important according to Google magic.") and shows up under "Sent" as well. After opening up "Show Original" in a new tab and then returning to the message, there's now a small banner (with a yellow background) at the top that reads: > This may be a spoofed message. Gmail couldn't verify that it was actually sent from your account. Learn more.

wincy 8y ago

Crazy, I'm glad it's not just me. Looking in my spam and there's dozens of them.

emmelaich 8y ago

Same too. The odd thing for me is that the client address (from the original text) was an AWS address. Only two appeared in the main inbox. More were sent straight to spam. They appeared just after I turned on my AWS instance briefly. So I thought it was related.

kome 8y ago

wow... reading this thread is scary. Google is a joke; my humble advice would be to close your accounts and pay for a better service, life Fastmail or Protonmail.

Screwtellus 8y ago

Hey guys, you can contact tellus via this link. You don't need to he a customer for this. https://www.telus.com/en/support/article/ccts-and-cprst-feedback-and-contact-information https://www.telus.com/en/support/article/ccts-and-cprst-feed...

jjhb94 8y ago

When you changed your password did you receive a google code from a 614 area code number?

morganvachon 8y ago

I think this is exactly what is going on. Gmail doesn't use IMAP folders in the traditional sense, it uses labels. For something to appear in your "Sent" folder, it only has to show your email address as the sender. Since it's quite common for spammers to use your email address as the "From" in spam messages sent to you, Gmail automatically throws it in your Sent "folder" by way of a label. I freaked out at first when my Fastmail account started getting spammed seemingly by my old Gmail account (I no longer use Gmail but I kept the account active and forwarded to Fastmail to catch anyone I forgot to update with the new address). I logged into Gmail and immediately changed my password, made sure I didn't have any third party app access, and turned on 2FA. After seeing this HN piece and reading through the first few messages in the Google product forum, I realized it was typical spam that was breaking through Google's spam filter and freaking everyone out due to Google's handling of the Sent folder/label.