Hi,

We would like to let you know that we have updated our report to include the omitted details. You can read it at: http://ece.uprm.edu/~andre/insert/gmail.html

Also we have made our proof of concept available at: http://ece.uprm.edu/~andre/insert/gmail.tar.gz

Best Regards,

Pablo Ximenes

I love short mails with a clear message

“Google’s chronic silence on all abuse reports makes it impossible to tell whether they’ve taken any action on the problem, whether the problem reports have even made it to the operational staff responsible for the mailservers, or whether they simply don’t care. I’m sure you can all make your own snarky comments re ‘Do no evil’.” (BugTraq)

Don’t forget: Google offers a fast paced and dynamic work environment *rofl*

May 20 21:43:16 mail postfix/smtpd[30948]: connect from qb-out-0506.google.com[72.14.204.235]
May 20 21:43:17 mail postfix/policyd-weight[2754]: weighted check: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .qb-out-0506.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2 <client=72.14.204.235> <helo=qb-out-0506.google.com> <from=alexandrearw7@gmail.com> <to=michael@liquidbytes.net>, rate: -8.5
May 20 21:43:17 mail postfix/policyd-weight[2754]: decided action=PREPEND X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .gmail. - helo: .qb-out-0506.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2 <client=72.14.204.235> <helo=qb-out-0506.google.com> <from=alexandrearw7@gmail.com> <to=michael@liquidbytes.net>, rate: -8.5; delay: 0s
May 20 21:43:18 mail postfix/smtpd[30948]: 09CFB196802E: client=qb-out-0506.google.com[72.14.204.235]
May 20 21:43:49 mail postfix/smtpd[30948]: disconnect from qb-out-0506.google.com[72.14.204.235]

Yes, these servers belong to…

OrgName:    Google Inc.
OrgID:      GOGL
Address:    1600 Amphitheatre Parkway
City:       Mountain View
StateProv:  CA
PostalCode: 94043
Country:    US
NetRange:   72.14.192.0 - 72.14.255.255
CIDR:       72.14.192.0/18
NetName:    GOOGLE

Other people are getting tons of spam from Google as well as it seems.

See also: Exploiting Google MX servers as Open SMTP Relays

So why is that? Mmmh… because the cool and smart engineers at Google can’t handle their job:

We would like to clarify to the security community that we have contacted Google about the issue more than a week ago and no response was provided despite our clear intent of cooperation regarding this matter.
We have plans to submit a paper about our work on the trust hierarchy of email providers to the SBSEG’2008 over this weekend. Since the paper will necessarily include full details about the flaw, we see no point on withholding the full disclosure of our self-censored report.
We are still waiting to hear from Google and we sincerely hope that this flaw can be fixed before the full details about the problem are released. (Source)

This was 8 days ago. Hello? Somebody there!? I’m 99.99% sure that Google won’t answer to my spam report. They can’t even write a small mail to the team that found out how to use Google as open mail relay. Other large providers like T-Online are far more cooperative and they actually answer to your requests.

“We are Google. Resistance is a good idea, because: You will be spammed. We will add our spam mail to your mailbox. Your culture will have to learn how to adapt its spam filters.”

#!/usr/local/bin/php
<?php
$mysqli = new mysqli("localhost", "dbmail", "yourpassword", "dbmail");
/* check connection */
if (mysqli_connect_errno()) {
printf("Connect failed: %s\n", mysqli_connect_error());
exit();
}
$q = $mysqli->query("SELECT DISTINCT alias FROM dbmail_aliases");
$content = '';
$domains = array();
while($r=$q->fetch_assoc()) {
$content .= $r['alias']." OK\n";
$parts = explode('@', $r['alias']);
if(!in_array($parts[1], $domains)) {
$domains[] = $parts[1];
}
}
file_put_contents('myusers', $content);
file_put_contents('mydomains', join("\n", $domains));
exec('postmap myusers');
$mysqli->close();
?>

Maybe it is of some use for anybody out there… the config in /etc/postfix/main.cf should look like:

mydestination = /etc/postfix/mydomains localhost
local_recipient_maps = hash:/etc/postfix/myusers $alias_maps