3 ms·

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

by rwmj 1y ago

fastest963 1y ago
Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).
- youngtaff 1y ago
  From the article he uses gmail I think
traceroute66 1y ago
> Wouldn't the Apple account reject it because it fails DKIM/etc? Yeah, I would be curious to see the actual email headers of what was received. As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.
- Avamander 1y ago
  How would recipients know to expect an S/MIME signature though. It's not like it's enforced by MTAs like DMARC is.
  - traceroute66 1y ago
    IIRC, if you're using Apple's Mail client it gets validated against the root cert shipped with MacOS/iOS. You get a little black tick next to the sender. In theory, third-party places like gmail could (should ?) automagically verify S/MIME sigs where a root cert is readily available.
    - Avamander 1y ago
      Support for verification is indeed widespread, but if it's missing there's nothing to verify. There's no system in place to warn the user when there is no signature and that there should be one.
- valleyer 1y ago
  > this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer A few do, but most do not, and certainly Apple's automated-system e-mails do not.
rolph 1y ago
How Email Spoofing Exploits SPF and DMARC: A Cybersecurity Deep Dive. https://undercodetesting.com/how-email-spoofing-exploits-spf-and-dmarc-a-cybersecurity-deep-dive/ https://undercodetesting.com/how-email-spoofing-exploits-spf...
neuronflux 1y ago
They probably sent it from gmail which would pass the SPF check (google.com and gmail.com have the same SPF). They wouldn't have it signed to pass DKIM, but google doesn't use strict alignment checking so to pass DMARC either SPF or DKIM are acceptable. ~ dig _dmarc.google.com txt +short "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"
- Avamander 1y ago
  Can't practically require both SPF and DKIM with DMARC anyways. Doing so would also be dumb as it would break forwarding (even when DKIM would otherwise remain intact). Deprecating SPF would do everyone a favour though. Especially for reasons like these.
  - neuronflux 1y ago
    SPF alignment ensures the MAIL FROM domain matches the From header. DKIM alignment ensures the From header matches the domain in the DKIM signature header. In the DMARC policy, you can set both adkim=s and aspf=s. Google owns and manages all of this, so they can send emails with a google.com MAIL FROM, a google.com header, and signed with a google.com DKIM key. And they could do likewise with gmail.com emails. I'm not clear on why this isn't practical, perhaps there is something I'm missing though? I would appreciate your viewpoint. Edit: I see you added a point about forwarding.
    - Avamander 1y ago
      DMARC specifies that SPF alignment is checked for the domain in the MIME From. The domains in SMTP and MIME From do not have to be the same (nor both align). Your MTA can still check alignment for both HELO and SMTP From as specified by SPF's RFC(s) though and spam filters often do for extra information/signal. DMARC's adkim/aspf aren't basically supported in practice. Nor they should be. For reasons already mentioned, as you already read.
- teraflop 1y ago
  So any message from Gmail is treated as legitimate for google.com, and yet Gmail can't do its own checks on outgoing mail to ensure that unauthorized people don't put legal@google.com in the From: header? Seriously?
fkskammerz 1y ago
I use gmail and i was attacked almost identically and the email came thru to my gmail with a @google origin account
- davsti4 1y ago
  More details would be great, like the headers.
davidscoville 1y ago
I’ve heard scammers use Google tools like Google forms or Google cloud to send out fraudulent emails that appear like they come from Google.
- thrill 1y ago
  The latest attempted scams I’m getting on my gmail account are fake postmaster bounces “from” google.com.
bradly 1y ago
Probably not the same attack vector, but I've gotten phising emails from a real googlemail.com addresses by the scammer abusing backscatter spam and the reply-to address.
Flimm 1y ago
I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.
- noname120 1y ago
  Can you download the email as EML and paste the content here?
beambot 1y ago
There have been cases recently of exploits that successfully spoof valid DKIM credentials too: https://easydmarc.com/blog/google-spoofed-via-dkim-replay-attack-a-technical-breakdown/ https://easydmarc.com/blog/google-spoofed-via-dkim-replay-at...

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

by rwmj 1y ago

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

fastest963 1y ago

Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).

youngtaff 1y ago
From the article he uses gmail I think

traceroute66 1y ago

> Wouldn't the Apple account reject it because it fails DKIM/etc? Yeah, I would be curious to see the actual email headers of what was received. As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.

Avamander 1y ago
How would recipients know to expect an S/MIME signature though. It's not like it's enforced by MTAs like DMARC is.
- traceroute66 1y ago
  IIRC, if you're using Apple's Mail client it gets validated against the root cert shipped with MacOS/iOS. You get a little black tick next to the sender. In theory, third-party places like gmail could (should ?) automagically verify S/MIME sigs where a root cert is readily available.
  - Avamander 1y ago
    Support for verification is indeed widespread, but if it's missing there's nothing to verify. There's no system in place to warn the user when there is no signature and that there should be one.
valleyer 1y ago
> this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer A few do, but most do not, and certainly Apple's automated-system e-mails do not.

rolph 1y ago

How Email Spoofing Exploits SPF and DMARC: A Cybersecurity Deep Dive. https://undercodetesting.com/how-email-spoofing-exploits-spf-and-dmarc-a-cybersecurity-deep-dive/ https://undercodetesting.com/how-email-spoofing-exploits-spf...

neuronflux 1y ago

They probably sent it from gmail which would pass the SPF check (google.com and gmail.com have the same SPF). They wouldn't have it signed to pass DKIM, but google doesn't use strict alignment checking so to pass DMARC either SPF or DKIM are acceptable. ~ dig _dmarc.google.com txt +short "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"

Avamander 1y ago
Can't practically require both SPF and DKIM with DMARC anyways. Doing so would also be dumb as it would break forwarding (even when DKIM would otherwise remain intact). Deprecating SPF would do everyone a favour though. Especially for reasons like these.
- neuronflux 1y ago
  SPF alignment ensures the MAIL FROM domain matches the From header. DKIM alignment ensures the From header matches the domain in the DKIM signature header. In the DMARC policy, you can set both adkim=s and aspf=s. Google owns and manages all of this, so they can send emails with a google.com MAIL FROM, a google.com header, and signed with a google.com DKIM key. And they could do likewise with gmail.com emails. I'm not clear on why this isn't practical, perhaps there is something I'm missing though? I would appreciate your viewpoint. Edit: I see you added a point about forwarding.
  - Avamander 1y ago
    DMARC specifies that SPF alignment is checked for the domain in the MIME From. The domains in SMTP and MIME From do not have to be the same (nor both align). Your MTA can still check alignment for both HELO and SMTP From as specified by SPF's RFC(s) though and spam filters often do for extra information/signal. DMARC's adkim/aspf aren't basically supported in practice. Nor they should be. For reasons already mentioned, as you already read.
teraflop 1y ago
So any message from Gmail is treated as legitimate for google.com, and yet Gmail can't do its own checks on outgoing mail to ensure that unauthorized people don't put legal@google.com in the From: header? Seriously?

fkskammerz 1y ago

I use gmail and i was attacked almost identically and the email came thru to my gmail with a @google origin account

davsti4 1y ago
More details would be great, like the headers.

davidscoville 1y ago

I’ve heard scammers use Google tools like Google forms or Google cloud to send out fraudulent emails that appear like they come from Google.

thrill 1y ago
The latest attempted scams I’m getting on my gmail account are fake postmaster bounces “from” google.com.

bradly 1y ago

Probably not the same attack vector, but I've gotten phising emails from a real googlemail.com addresses by the scammer abusing backscatter spam and the reply-to address.

Flimm 1y ago

I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.

noname120 1y ago
Can you download the email as EML and paste the content here?

beambot 1y ago

There have been cases recently of exploits that successfully spoof valid DKIM credentials too: https://easydmarc.com/blog/google-spoofed-via-dkim-replay-attack-a-technical-breakdown/ https://easydmarc.com/blog/google-spoofed-via-dkim-replay-at...