6 ms·

Hacking Gmail’s UX with 'From' Fields – Another Phishing Vector

114 points by cottenio 8y ago

amelius 8y ago
Is someone collecting these attack vectors somewhere? That would help prevent anyone writing an email client to make the same mistake.
- jorangreef 8y ago
  I wrote @ronomon/mime, an email parser which enforces RFC 2822 3.6.2 and which also detects a variety of attack vectors before they can reach the email client. A summary of these vectors are listed in the README (amongst various sanity checks): https://github.com/ronomon/mime#robust https://github.com/ronomon/mime#robust Just through checking everything about an email carefully, @ronomon/mime has detected and brought to light some interesting attack vectors, for example a malformed email which crashes Apple Mail. This was disclosed to Apple's security team although they did not see any actual security implications. Another interesting attack vector was an email containing millions of empty multiparts, which was able to crash several popular email servers. This was disclosed through Snyk, here are the details: https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
- bo1024 8y ago
  My understanding is that email headers can be spoofed and should not be relied on. So this is probably too hard to ask from an email client (i.e. a program that reads and writes emails) that only has access to the email headers. Whereas for the email server (the computer that sends/receives emails for this address) this would be trivial, just keep a list of emails that the server has sent.
bonoetmalo 8y ago
I believe this has been a known issue for years now.
- scandox 8y ago
  Indeed it has. It's been there so long I think it must be considered a feature.
  - cottenio 8y ago
    As @romed notes above, it looks like it is intended as a feature. One which I think sacrifices majority-security for minority-utility.
zerocrates 8y ago
I just naturally assumed Gmail only filed things into Sent when it... sent them. I know that it does "pay attention" to what it's sending: if you're accessing Gmail through IMAP/SMTP you don't need to have your client store sent messages on the server; Gmail will populate them there for you when you send through their SMTP server.
- yakubin 8y ago
  My best guess would be that it is caused by the fact that GMail doesn't really have folders per se. It emulates them when it's syncing with your client through IMAP and the web interface shows you folder icons, but these are really labels. In the case of the "sent" label I'd guess it's just a well-optimized search over "From:" headers of all the mails stored in "All Mail". If this is the case, then it appears that this search isn't as accurate as one would wish it was.
tekstar 8y ago
A different one than the article but also weird/dangerous, it (was? is still?) possible to manipulate someone else's contact identifiers. This may have been fixed, but I stopped using gmail years ago so I'm not sure.. For example imagine Alice emails Bob and Chad, and in the To: field for Bob she gives Bob a different "Name" like "Brad" <bob@bob.com>. If Chad replies to this email, Bob will now be in his contact list as Brad. The email is still bob@bob.com but you can see how it could be malicious, or at least fodder for fun pranks.
- 3pt14159 8y ago
  This drives me fucking crazy. I have a long history of emailing a particular dude, call him Greg. Greg's email address does not have any periods in it. Gmail ignores periods, yes, but many other clients don't, so I want to never type Greg's email with a period. Further, I want to be able to reliably grep and join my own email exports. Upon buying a new phone I received an email from Frank, who cc'd Greg. Fucking Frank has Greg's email address with a period in it. From now on, no matter what I do, my phone autocomplete's Greg's email address with a period. At first I manually fixed it every time, but at this point I've given up. Now I'm as bad as Frank. It's like this virus that goes from Frank to Frank polluting the data as it goes. If my contacts are going to be changeable by other people can they at the very least ask me first? Greg is on Gmail, can Gmail not auto-switch Greg to his canonical email unless I specifically request it not to? If Greg is going to be changed, why on earth is it one way (the right way) in my web inbox and a completely different way in my phone?
  - tekstar 8y ago
    Brutal. In my case, my friend's name got replaced with something like "Schookums Bear <3" after replying to an email from his fiance.
Sephr 8y ago
You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed. Vulnerability details: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/ https://eligrey.com/blog/google-inbox-spoofing-vulnerability... Screenshot: https://go.eligrey.com/t/screenshots/google-inbox-spoofing-on-android https://go.eligrey.com/t/screenshots/google-inbox-spoofing-o... PoC demo (open on Android using Google Inbox or Gmail): https://dangerous.link/gmail-and-inbox-spoofing-on-android https://dangerous.link/gmail-and-inbox-spoofing-on-android
- sazfedjhrgnukc 8y ago
  > ... and it's still not fixed It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox-by-gmail https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...
  - Sephr 8y ago
    It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.
    - sazfedjhrgnukc 8y ago
      Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.
- cottenio 8y ago
  I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.
- terrik 8y ago
  Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing support@paypal.com, when you are not.
romed 8y ago
This is a feature, not a bug, and it's required to get enterprise business.
- p1necone 8y ago
  What enterprise use case exists for telling me I've sent email that I haven't actually sent?
  - romed 8y ago
    First, note that a great many enterprise use cases are total nonsense. But still: people want to be able to put messages into gmail from random other systems and have the "sent" label be applied, so they can treat it as a system of record.
    - eridius 8y ago
      You wouldn't do that by sending an email to the account. You'd do that by logging in with IMAP and importing an email that way.
      - elcomet 8y ago
        That's how you would do it if course, but not everyone knows or understand IMAP. Everyone knows how to send an email
  - michaelmior 8y ago
    I assume the use case is when email has been sent by the user, but not via Gmail. The external system can send the email to Gmail with the correct From header and have it filed along with other sent messages.
    - kbenson 8y ago
      Even if that's the reason why, it's a pretty brain-dead way for them to implement it. If people want emails from a separate address that CC's Gmail on sending to be seen as sent, Gmail should have them show up like the normal emails that they are received but show a little button that asks if you want them to be seen as sent, and if you accept creates the filter to do so from that source (and shows it in filters so it can be removed later). It's not like Gmail doesn't show "nudges" and other crap all over the place for stuff like this.
martin-adams 8y ago
This reminds me of the issue where spam emails with a calendar invite would not only appear on your Google calendar, but if the event was triggered, would give you a notification. I believe they fixed this one.

114 points by cottenio 8y ago

Is someone collecting these attack vectors somewhere? That would help prevent anyone writing an email client to make the same mistake.

jorangreef 8y ago
I wrote @ronomon/mime, an email parser which enforces RFC 2822 3.6.2 and which also detects a variety of attack vectors before they can reach the email client. A summary of these vectors are listed in the README (amongst various sanity checks): https://github.com/ronomon/mime#robust https://github.com/ronomon/mime#robust Just through checking everything about an email carefully, @ronomon/mime has detected and brought to light some interesting attack vectors, for example a malformed email which crashes Apple Mail. This was disclosed to Apple's security team although they did not see any actual security implications. Another interesting attack vector was an email containing millions of empty multiparts, which was able to crash several popular email servers. This was disclosed through Snyk, here are the details: https://snyk.io/blog/how-to-crash-an-email-server-with-a-single-email https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...
bo1024 8y ago
My understanding is that email headers can be spoofed and should not be relied on. So this is probably too hard to ask from an email client (i.e. a program that reads and writes emails) that only has access to the email headers. Whereas for the email server (the computer that sends/receives emails for this address) this would be trivial, just keep a list of emails that the server has sent.

bonoetmalo 8y ago

I believe this has been a known issue for years now.

scandox 8y ago
Indeed it has. It's been there so long I think it must be considered a feature.
- cottenio 8y ago
  As @romed notes above, it looks like it is intended as a feature. One which I think sacrifices majority-security for minority-utility.

zerocrates 8y ago

I just naturally assumed Gmail only filed things into Sent when it... sent them. I know that it does "pay attention" to what it's sending: if you're accessing Gmail through IMAP/SMTP you don't need to have your client store sent messages on the server; Gmail will populate them there for you when you send through their SMTP server.

yakubin 8y ago
My best guess would be that it is caused by the fact that GMail doesn't really have folders per se. It emulates them when it's syncing with your client through IMAP and the web interface shows you folder icons, but these are really labels. In the case of the "sent" label I'd guess it's just a well-optimized search over "From:" headers of all the mails stored in "All Mail". If this is the case, then it appears that this search isn't as accurate as one would wish it was.

tekstar 8y ago

A different one than the article but also weird/dangerous, it (was? is still?) possible to manipulate someone else's contact identifiers. This may have been fixed, but I stopped using gmail years ago so I'm not sure.. For example imagine Alice emails Bob and Chad, and in the To: field for Bob she gives Bob a different "Name" like "Brad" <bob@bob.com>. If Chad replies to this email, Bob will now be in his contact list as Brad. The email is still bob@bob.com but you can see how it could be malicious, or at least fodder for fun pranks.

3pt14159 8y ago
This drives me fucking crazy. I have a long history of emailing a particular dude, call him Greg. Greg's email address does not have any periods in it. Gmail ignores periods, yes, but many other clients don't, so I want to never type Greg's email with a period. Further, I want to be able to reliably grep and join my own email exports. Upon buying a new phone I received an email from Frank, who cc'd Greg. Fucking Frank has Greg's email address with a period in it. From now on, no matter what I do, my phone autocomplete's Greg's email address with a period. At first I manually fixed it every time, but at this point I've given up. Now I'm as bad as Frank. It's like this virus that goes from Frank to Frank polluting the data as it goes. If my contacts are going to be changeable by other people can they at the very least ask me first? Greg is on Gmail, can Gmail not auto-switch Greg to his canonical email unless I specifically request it not to? If Greg is going to be changed, why on earth is it one way (the right way) in my web inbox and a completely different way in my phone?
- tekstar 8y ago
  Brutal. In my case, my friend's name got replaced with something like "Schookums Bear <3" after replying to an email from his fiance.

Sephr 8y ago

You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed. Vulnerability details: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/ https://eligrey.com/blog/google-inbox-spoofing-vulnerability... Screenshot: https://go.eligrey.com/t/screenshots/google-inbox-spoofing-on-android https://go.eligrey.com/t/screenshots/google-inbox-spoofing-o... PoC demo (open on Android using Google Inbox or Gmail): https://dangerous.link/gmail-and-inbox-spoofing-on-android https://dangerous.link/gmail-and-inbox-spoofing-on-android

sazfedjhrgnukc 8y ago
> ... and it's still not fixed It was fixed in May: https://www.xda-developers.com/google-fixes-flaw-spoof-inbox-by-gmail https://www.xda-developers.com/google-fixes-flaw-spoof-inbox...
- Sephr 8y ago
  It was only fixed in the webapp. As you can see with the PoC demo link, this is still unfixed in the Inbox app for Android.
  - sazfedjhrgnukc 8y ago
    Thanks for clarifying. I should've been able to deduced that it was only fixed in the webapp from the "open on Android using Google Inbox or Gmail" part of your comment. I'm sorry.
cottenio 8y ago
I'm shocked this hasn't been resolved in mobile yet. I opened it up on my phone, and heck, with a pretty HTML form emulation in the email you could really have a very effective phishing campaign.
terrik 8y ago
Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing support@paypal.com, when you are not.

romed 8y ago

This is a feature, not a bug, and it's required to get enterprise business.

p1necone 8y ago
What enterprise use case exists for telling me I've sent email that I haven't actually sent?
- romed 8y ago
  First, note that a great many enterprise use cases are total nonsense. But still: people want to be able to put messages into gmail from random other systems and have the "sent" label be applied, so they can treat it as a system of record.
  - eridius 8y ago
    You wouldn't do that by sending an email to the account. You'd do that by logging in with IMAP and importing an email that way.
    - elcomet 8y ago
      That's how you would do it if course, but not everyone knows or understand IMAP. Everyone knows how to send an email
- michaelmior 8y ago
  I assume the use case is when email has been sent by the user, but not via Gmail. The external system can send the email to Gmail with the correct From header and have it filed along with other sent messages.
  - kbenson 8y ago
    Even if that's the reason why, it's a pretty brain-dead way for them to implement it. If people want emails from a separate address that CC's Gmail on sending to be seen as sent, Gmail should have them show up like the normal emails that they are received but show a little button that asks if you want them to be seen as sent, and if you accept creates the filter to do so from that source (and shows it in filters so it can be removed later). It's not like Gmail doesn't show "nudges" and other crap all over the place for stuff like this.

martin-adams 8y ago

This reminds me of the issue where spam emails with a calendar invite would not only appear on your Google calendar, but if the event was triggered, would give you a notification. I believe they fixed this one.