[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[public-dns-discuss] Domain names re-encoded incorrectly (here: german eszett)



Summary: mail.google.com is sending mails to not addressed domains

Dear Sir/Madam,

The moderator of Google's VRP pleased me to publish a vulnerability #129558305 here. So you can find the original report here, but without the description how it could be misused.

Unfortunately, the e-mail system sends e-mails despite of correct addressees to foreign domains:

1.) Login on mail.google.com (Version online 29.03.2019 21:09 CET)
2.) Create a new e-mail
3.) Enter an address with the eszett-letter (alias sharp-s), i.e. "google-test@a n h e ß dot d e"
4.) send the e-mail
5.) open the sent e-mail
6.) Have a look to the addressee - suddenly it was changed to "google-test@a n h e s s dot d e" instead remaining correctly "google-test@a n h e ß dot d e". The letter eszett has been translated.

Info: https://en.wikipedia.org/wiki/eszett

Problem:
============

- The e-mail is sent to a not addressed domain
- The user isn't aware about this
- It seems that the IDN standard that is available since August 2010 has not yet been implemented after nearly nine years.
Referring to page 28 of the rfc 5894, section 7.2.1 is talking about conversion of "ß" to capital letters, yes. This is only affecting capital written words.
But referring to section 7.2.3 the eszett "should be treated as distinct and protocol-valid character". Even section 4.4 (last paragraph, second sentence) is confirming that the eszett is valid starting IDNA2008.

The German registrar's DeNIC explanation: https://www.denic.de/fragen-antworten/faqs-zu-idns-ss/#faq-385

Expecation:
============

- Domains should be handled by the since 2010 existing standard
- Only this way is ensuring that all e-mails are delivered to the correct addressee. If a host is then invalid the delivery has to be rejected.
- {censored}
- {censored}
- Of course, this also applies to all other characters that may not yet be properly implemented.

Interesting: Directly after sending the e-mail you'll receive a little dark popup on the bottom left. After opening the sent e-mail via this you'll see the addressed domain "a n h e ß". But when you enter the sent folder you are seeing the "a n h e s s".

Mit freundlichen Grüßen
A.

--
You received this message because you are subscribed to the Google Groups "public-dns-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to public-dns-discuss+unsubscribe AT googlegroups.com.
To post to this group, send email to public-dns-discuss AT googlegroups.com.
Visit this group at https://groups.google.com/group/public-dns-discuss.
To view this discussion on the web visit https://groups.google.com/d/msgid/public-dns-discuss/5297cef1-8912-4f73-a5b8-03d7006a08e9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.