4 ms·

In gmail I get numerous easy to spot spam a day, McAfee warnings, CVS gift cards, Kohls cache, Costco $500 rewards, Geico insurance etc. Way worse than my pers

by sliken 5y ago

In gmail I get numerous easy to spot spam a day, McAfee warnings, CVS gift cards, Kohls cache, Costco $500 rewards, Geico insurance etc. Way worse than my personal mail server with a straight forward greylist/SpamAssassin setup. What's worse is recently I searched for home depot, clicked on the top result (an ad), that clearly listed the destination URL as homedepot.com. Ended up with a malware site with multiple pop ups claiming I had a virus and had to install some plugin to fix things. Feels quite a bit like yahoo used to: sketchy ads, malware, spam, payroll loans, etc.

krono 5y ago
But then perfectly valid messages from someone's self-hosted mailserver never even make it past their pre-screener. If DKIM, SPF, or DMARC record validity, or even past conversations don't matter for deliverability, what does? I'm beginning to think even Google doesn't really have these types of answers anymore.
- idop 5y ago
  if (msg.source != "gmail"): msg.drop()
  - deleted 5y ago
    [deleted]
  - krono 5y ago
    Gave you the opportunity to make that joke for free, the least you could have done was write it in GoogleLang ;)
    - easrng 5y ago
      var message = GmailApp.getMessageById(newMessageId); if(!message.getFrom().match(/@gmail.com>?$/)) { message.moveToTrash(); }
metadat 5y ago
Everything old is new again! Is this what they meant the other day with "Signs the old web is coming back"? https://news.ycombinator.com/item?id=30078971 https://news.ycombinator.com/item?id=30078971
silisili 5y ago
Yeah, I got that with USPS change address search a few years back. Look, I think of myself as a decently smart guy, not a sucker, etc. But at 2am when exhausted from moving and just wanting to check something off a list...I got got. It was my mistake. I trusted Google. Google's top result took me to one of the thousands of identical copies of the official USPS change address forms that charge $49. Could have been worse, I guess.
bcrl 5y ago
Even worse is when Google's own search results include ads that direct to malware sites (like https://imgur.com/a/Lk85lST https://imgur.com/a/Lk85lST ). Google, when will you start following the best practices in the advertising industry like Ad Standards Council?
- elondaits 5y ago
  In Argentina (Latin America, even probably) if you searched for Paramount+ (right when the streaming service launched here) the top result was a Google ad with a spoof domain (that could have been legit) pointing to a credit card stealing phishing site.
foxfluff 5y ago
> that clearly listed the destination URL as homedepot.com Does anyone have an explanation for this? I've heard such claims before, but I'd like to see it to believe it. I could perhaps imagine yet another unicode "feature" (non-printing characters or some very subtle combining characters or a font variant?) being abused for this. On the other hand, part of me wants to believe that despite all their failings, there's no way Google wouldn't have thought of that and prevented it. Right? EDIT: Somewhat recently I tried to find out if this is true after someone claimed they had had a legit URL lead them to a phishing site, but the only juice I found is the same old: typo-squatting. Just now showing up in big G's results. Apparently e.g. homedopet.com leads to a site that uBlock doesn't want me to visit (badware risks). On the other hand homedepet.com and homodepot.com took me to the right site.
- sliken 5y ago
  I'm pretty security conscious, and I immediately double checked and replicated what I had done. The ad looked perfect, including the right URL, and includes the normal subsections, store finder, special of the day, careers, etc. The home depot search result labeled as an "ad", but shown inline, with an easy to miss small gray font mentioning the URL. Much like if you search for ace hardware now, I did notice that home depot searches no longer shows an ad. I normally have zero plugins enabled, but I did discover I had a keybase plugin installed, from before zoom bought them. I've since disabled it and am considering a reinstall. The URL it sent me to was: http://34.220.130.1/window-security-alert/werrx01/ http://34.220.130.1/window-security-alert/werrx01/, which at the time worked (visit at your own risk). But I tried it just now and it now triggered a chrome warning about "Deceptive site ahead".
- easrng 5y ago
  IIRC you can set the domain you want to show on your ad and it doesn't have to be what you actually link to. They allow that so marketers can do click tracking stuff I guess.
  - foxfluff 5y ago
    Sad if true. Outright irresponsible, I would say. Knowing which domain you're talking to is such a basic security requirement; TLS and the whole CA model is worth nothing if you're being lied about what domain you're navigating to. This is also why typosquatting is such a dangerous attack..

by sliken 5y ago

krono 5y ago

But then perfectly valid messages from someone's self-hosted mailserver never even make it past their pre-screener. If DKIM, SPF, or DMARC record validity, or even past conversations don't matter for deliverability, what does? I'm beginning to think even Google doesn't really have these types of answers anymore.

idop 5y ago
if (msg.source != "gmail"): msg.drop()
- deleted 5y ago
  [deleted]
- krono 5y ago
  Gave you the opportunity to make that joke for free, the least you could have done was write it in GoogleLang ;)
  - easrng 5y ago
    var message = GmailApp.getMessageById(newMessageId); if(!message.getFrom().match(/@gmail.com>?$/)) { message.moveToTrash(); }

metadat 5y ago

Everything old is new again! Is this what they meant the other day with "Signs the old web is coming back"? https://news.ycombinator.com/item?id=30078971 https://news.ycombinator.com/item?id=30078971

silisili 5y ago

Yeah, I got that with USPS change address search a few years back. Look, I think of myself as a decently smart guy, not a sucker, etc. But at 2am when exhausted from moving and just wanting to check something off a list...I got got. It was my mistake. I trusted Google. Google's top result took me to one of the thousands of identical copies of the official USPS change address forms that charge $49. Could have been worse, I guess.

bcrl 5y ago

Even worse is when Google's own search results include ads that direct to malware sites (like https://imgur.com/a/Lk85lST https://imgur.com/a/Lk85lST ). Google, when will you start following the best practices in the advertising industry like Ad Standards Council?

elondaits 5y ago
In Argentina (Latin America, even probably) if you searched for Paramount+ (right when the streaming service launched here) the top result was a Google ad with a spoof domain (that could have been legit) pointing to a credit card stealing phishing site.

foxfluff 5y ago

> that clearly listed the destination URL as homedepot.com Does anyone have an explanation for this? I've heard such claims before, but I'd like to see it to believe it. I could perhaps imagine yet another unicode "feature" (non-printing characters or some very subtle combining characters or a font variant?) being abused for this. On the other hand, part of me wants to believe that despite all their failings, there's no way Google wouldn't have thought of that and prevented it. Right? EDIT: Somewhat recently I tried to find out if this is true after someone claimed they had had a legit URL lead them to a phishing site, but the only juice I found is the same old: typo-squatting. Just now showing up in big G's results. Apparently e.g. homedopet.com leads to a site that uBlock doesn't want me to visit (badware risks). On the other hand homedepet.com and homodepot.com took me to the right site.

sliken 5y ago
I'm pretty security conscious, and I immediately double checked and replicated what I had done. The ad looked perfect, including the right URL, and includes the normal subsections, store finder, special of the day, careers, etc. The home depot search result labeled as an "ad", but shown inline, with an easy to miss small gray font mentioning the URL. Much like if you search for ace hardware now, I did notice that home depot searches no longer shows an ad. I normally have zero plugins enabled, but I did discover I had a keybase plugin installed, from before zoom bought them. I've since disabled it and am considering a reinstall. The URL it sent me to was: http://34.220.130.1/window-security-alert/werrx01/ http://34.220.130.1/window-security-alert/werrx01/, which at the time worked (visit at your own risk). But I tried it just now and it now triggered a chrome warning about "Deceptive site ahead".
easrng 5y ago
IIRC you can set the domain you want to show on your ad and it doesn't have to be what you actually link to. They allow that so marketers can do click tracking stuff I guess.
- foxfluff 5y ago
  Sad if true. Outright irresponsible, I would say. Knowing which domain you're talking to is such a basic security requirement; TLS and the whole CA model is worth nothing if you're being lied about what domain you're navigating to. This is also why typosquatting is such a dangerous attack..