Gsuite - "Send mail as" under Settings > Account

[timbo343]

It would appear that users both students and staff are able to Send Mail As another user and the steps to complete this are allowed even though i've not been able to find anything in the admin console about this. It doesn't work on external addresses that are not part of the Google Organisation.

 

Instead, we've blocked incoming emails via a content compliance rule that matches all the following:

Sender - [email protected]

Subject Containing - Send mail as

Send to a Quarantine.

 

Hope this helps someone unless there is a better way to do this. Blocking the option to hide Send Mail As would be better.

[fiza]

@rogerdnixon - Any thoughts on this?

[TwistedHelixis]

OK, so I have just tested this and the account they use gets sent a verification email, so they need access to that account first. Have they got round this somehow?

[timbo343]

OK, so I have just tested this and the account they use gets sent a verification email, so they need access to that account first. Have they got round this somehow?

 

What stops a bully forcing a user to accept the request? Or even User A sending a "send mail as" request to User B, then User A knowing the account details for User B, accepting the and deleting the request. User B doesn't know anything about this and User A then starts emailing other users looking like the email has come from User B.

 

Surely it's best to remove / hide this option completely?

[Arthur]

Blocking the option to hide Send Mail As would be better.

Blocking automatic forwarding hides the Send Mail As option.

 

Edit. It must be some other setting.

Edited December 18, 2019 by Arthur

[timbo343]

@Arthur

 

This is set at the highest level yet Send Mail As is still shown. No other policies are overriding this.

[Zoom7000]

What stops a bully forcing a user to accept the request? Or even User A sending a "send mail as" request to User B, then User A knowing the account details for User B, accepting the and deleting the request. User B doesn't know anything about this and User A then starts emailing other users looking like the email has come from User B.

 

Surely it's best to remove / hide this option completely?

 

True, it would be good to have the option to disable (if it doesn't already exist, I haven't checked!) but incidents like bullying would need to be addressed offline and it could be argued that an incident like this might actually highlight a bullying case. Not defending G Suite in any way, but just highlighting the importance of understanding and being able to identify bullying from an offline perspective, including the perception of the welfare of the victim.

[Arthur]

This is set at the highest level yet Send Mail As is still shown. No other policies are overriding this.

Edit. This is what my Gmail settings looks like. I don't have the "Send Mail As" option under "Accounts" (since that tab is missing).

 

Edited December 18, 2019 by Arthur

[timbo343]

True, it would be good to have the option to disable (if it doesn't already exist, I haven't checked!) but incidents like bullying would need to be addressed offline and it could be argued that an incident like this might actually highlight a bullying case. Not defending G Suite in any way, but just highlighting the importance of understanding and being able to identify bullying from an offline perspective, including the perception of the welfare of the victim.

 

Agreed but why have the option there in the first place?

 

I also have POP and IMAP disabled. I think this is the setting that disables the tab in Gmail's settings.

 

That is also disabled at top level too - the OUs have the exact same settings as your's.

[Arthur]

That is also disabled at top level too - the OUs have the exact same settings as your's.

That's strange. I must have some other setting that disables it because I can't see the "Send Mail As" option at all in my Gmail account (as shown in the screenshot above).

[jthompson]

What stops a bully forcing a user to accept the request? Or even User A sending a "send mail as" request to User B, then User A knowing the account details for User B, accepting the and deleting the request. User B doesn't know anything about this and User A then starts emailing other users looking like the email has come from User B.

 

Surely it's best to remove / hide this option completely?

 

Worth noting that in this example, emails would appear to recipients as being from "Person A ([email protected])", so still technically distinguishable from both Person A and Person B's regular emails.

 

To put is another way:

 

From: Bully Bullison ([email protected])

 

and not:

 

From: Vicky Victim ([email protected])

Edited December 18, 2019 by jthompson

[timbo343]

Worth noting that in this example, emails would appear to recipients as being from "Person A ([email protected])", so still technically distinguishable from both Person A and Person B's regular emails.

 

To put is another way:

 

From: Bully Bullison ([email protected])

 

and not:

 

From: Vicky Victim ([email protected])

 

Depends how savvy the bully is.

 

When in the user's account 2017@ and account > Send Mail As wizard is configured, if the user enters the name Test, 2011 as it would normally show and the email address 2011@, the user 2017@ can select the From address of 2011@ and it will display both the correct display name and the 2011@ email address.

[timbo343]

Edit. This is what my Gmail settings looks like. I don't have the "Send Mail As" option under "Accounts and Import" (since that tab is missing).

 

 

I'd love to know where the "Accounts" options is on your Gsuite. That would solve the issues that i have been testing.

[timbo343]

Edit. This is what my Gmail settings looks like. I don't have the "Send Mail As" option under "Accounts and Import" (since that tab is missing).

 

 

I've just had a thought, are you using SSO with Azure? I'm wondering if that is why the accounts tab is missing from the user's setting in Gmail.

The only way i can get it to be removed is to go in as a delegated user, then accounts is not shown.

Edited December 18, 2019 by timbo343

[timbo343]

Whilst on the subject of this, i have also seen the "edit info" link which displays Edit email address for changing the reply to address.

 

Edited December 18, 2019 by timbo343

[jthompson]

The reply-to option won't affect the "From" header. It just adds a reply-to header, where otherwise there wouldn't be one.

[jthompson]

Depends how savvy the bully is.

 

When in the user's account 2017@ and account > Send Mail As wizard is configured, if the user enters the name Test, 2011 as it would normally show and the email address 2011@, the user 2017@ can select the From address of 2011@ and it will display both the correct display name and the 2011@ email address.

 

Good point. The display name is customisable there. In conjunction with the reply-to option, there's significant scope for abuse. It would rely on access to the victim's inbox, but it could be done in a classroom in a matter seconds with the victom left with absolutely no indication whatsoever.

[Arthur]

I've just had a thought, are you using SSO with Azure?

No SSO with Azure. I do have delegated access to other email accounts (although mine isn't delegated to anyone else).

 

I just checked a test student account and it does have the Accounts tab.

 

[timbo343]

Uh Oh, and i'm on with Google Support Chat now and they have confirmed:

 

After verifying this I found that unfortunately there is no option in the Admin Console to disable the "Send mail as" option for users, as this is an end-user setting in Gmail interface and cannot be changed in the Admin Console.

[jthompson]

I've now done what you did and created a content compliance rule to block the delivery of the verification email.

 

Rather than quarantine it, I've opted to reject it. The user trying to set it up will receive a notification to tell them that it's not permitted.

 

 

[timbo343]

@jthompson good plan, i have it set to quarantine just so that i can see who is trying, will also be providing a bounce back.

 

Still on with Google Support on how to get around the FROM and REPLYTO issue. I've told them i want a rule that says if the FROM and REPLYTO are different, reject the mail. Obviously service accounts may be different but i want this applied to all staff and students.

[jthompson]

Just tweaked my rule slightly to change the subject match to "Confirmation - Send Mail as". This then prevents delivery of confirmation emails when the "send mail as" is being set up from a consumer Gmail account (i.e. outside the domain).

 

When doing it from a consumer Google account (i.e. from a different domain) Gmail requires login credentials for SMTP auth, and requires that "Less secure apps" is enabled on the victim's account.

 

I'm guessing that if this was set up successfully from some other external email system, having a DMARC policy in place would take care of things, as it's basically a spoofing attack by that point. In any case, the attacker will be in possession of the victim's credentials, so could log in directly to send prank messages.

Edited December 18, 2019 by jthompson

[timbo343]

Whilst on the subject of this, i have also seen the "edit info" link which displays Edit email address for changing the reply to address.

 

[ATTACH=CONFIG]56133[/ATTACH]

 

Just want to point out that Google Support have confirmed this:

 

My Statement:

I've looked at the headers in a test email with a different reply address to the From and a rule needs to be in place to say if the from address is different to the reply address reject the email

 

Google's Reply:

I have confirmed that we do not have any tools to remove that setting or stop those messages Tim, I wish I could have been more of help. We did a lot of tests from our accounts with a specialist but could not find a workaround.

[jthompson]

Do you need to worry about that, if the send as setup can't get verified in the first place?

[timbo343]

Do you need to worry about that, if the send as setup can't get verified in the first place?

 

You don't need to verify an account to edit a replyto address