GMail quirk used to subvert website spam tracking

Published: 2014-12-10. Last Updated: 2014-12-11 14:31:07 UTC
by Alex Stanford (Version: 1)
5 comment(s)

Yesterday while reviewing our logs here at the SANS Internet Storm Center I stumbled upon these:

login failed for s.ervic.d.157.6@gmail.com
login failed for se.rv.icd.15.76@gmail.com
login failed for r.a.mo.s.odalys.33.3@gmail.com
login failed for sho.ppin.g48service@gmail.com

The reason this caught my eye is because I recall reading that GMail ignores periods in email addresses. For example, if I register alexs12345@gmail.com but then begin sending email to a.l.e.x.s.1.2.3.4.5@gmail.com, it will arrive in my new inbox despite the additional periods.

Many blog and forum platforms have functionality for banning by email address. Spammers can use the periods in GMail addresses to subvert such banning controls by registering again without having to produce a truly new email address. Do your systems and/or websites allow for registering multiple accounts this way?

Where this becomes more interesting is that these logs indicate visitors that tried to log in using these email addresses without having even attempted to register them first. None of the above logs come from a single IP address, though the first two do come from a single IP range. Is this due to a poorly programmed bot, or is it indicative of something else?

Let us know what you think in the comments!

-- 
Alex Stanford - GIAC GWEB & GSEC,
Research Operations Manager,
SANS Internet Storm Center
/in/alexstanford

Keywords:
5 comment(s)

Comments

http://gmailblog.blogspot.de/2008/03/2-hidden-ways-to-get-more-from-your.html

It's an intentional feature of gmail to give its users more flexibility on how they use their email address. You can also use a plus "+" to append something to your gmail address. I've used this often for filtering e-mails. You can also determine who is distributing your email address if you use this when you register for a site by appending the sitename or some indicator to your email address: email+sans@gmail.com
I just tried sending an email w/ periods from my personal Gmail to my Google Apps account and it rejected. So I'm assuming this doesn't affected organizations within Google Apps?
[quote=comment#32727]I just tried sending an email w/ periods from my personal Gmail to my Google Apps account and it rejected. So I'm assuming this doesn't affected organizations within Google Apps?[/quote]
Correct, it appears that this does not affect Google Apps but only @gmail.com addresses:
[quote=Google]Periods (.) are not ignored as they are in a gmail.com account. If you create a user account called username, this user will not be able to receive messages addressed to user.name, or us.er.na.me, or any other combination of periods.[/quote]
Source: https://support.google.com/a/answer/33386?hl=en
just tested using a personal gmail account user.name@gmail.com and username+SANS@gmail.com
Both were delivered successfully
The "+" syntax is a standard, not a google-ism like the periods.

Diary Archives