Slashdot Mirror
Escalating Gmail/Spamming Attacks
We've been getting submissions about an uptick in compromised Gmail accounts in the last few days, but nothing that could be substantiated. Robert McMillan did a bit of digging and now reports in PC World that "Google is investigating a growing number of reports that hackers are breaking into legitimate Gmail accounts and then using them to send spam messages. The problem started about a week ago but seems to have escalated over the past few days. ... [I]n forum posts, Gmail users note that the hackers appear to be sending spam via Gmail's mobile interface — which gives mobile-phone users a way to check their Gmail accounts — and wonder if there may be a bug in the mobile interface that is allowing criminals to send the spam. ... Google says there's no Gmail bug. ... 'Spammers may sometimes use a mobile interface to access accounts they have already compromised because it's simpler for bots to use this method at large scale.'" Here's how to tell if your Gmail account has been accessed by bad guys, and what to do about it.
Wasn't that google sso (Gaia) code ganked recently? Wonder if it's connected....
Website Hosting
Sounds like the outcome of the stolen login source.
...if this didn't have an effect in Wall Street.
About a week ago, ironically. She had a pathetic password, so I wasn't too surprised. The upside to the story was that we contained it rapidly, and now she actually USES keepass for all her passwords. Woot! Thanks mister Romanian hacker dude.
All your base are belong to Google.
It makes sense bots would use the mobile interface. Its lighter so it uses less bandwidth, so more spam-per-bots == profit.
NO SIG
And I had a pretty secure password. Now it is much more secure.
I got lucky, noticed the odd activity (from Texas no less) and jumped all over fixing it.
Suppose you were an idiot and suppose you were a member of Congress
I can verify this trend. Several of my aunts have switched to Gmail lately, decreasing the spam I get from Hotmail/Yahoo and being replaced by Gmail-based spam.
My webcomic
Apparently this happened to someone I know. She created a third-party web account (in her case, I think it's LinkedIn), entered her Gmail address, and used the same Gmail password for that account. I had to remind everyone I know that some websites *always* check to see if they can log into your e-mail with the password you supplied. Or it could be that the third-party account database was compromised. Either way, always use a different password. A lot of websites apparently store password in clear text, or in non-salted SHA1 or MD5 form so you can easily perform an inverse lookup.
After she changed her password, her account is clean again.
I once had a signature.
Are they really 'breaking in'? If I leave a post-it on my front door that says 'key under mat', and someone uses that to get into my home, I don't believe that's 'breaking in'. So if I have a Gmail password of 'password123', and my account is compromised, can we call that 'breaking in'. Not really sure if computer crime is analogous in this way. Trespassing maybe...
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
I have an Android phone (Moto Droid)... curious to see if anybody else that's been compromised has one, too?
All this, and more, brought to you by the "Cloud"®.
Gotta love that Cloud® thingy, it's way more secure than old fashioned email.
Convenience kills civilizations, R.I.P., it's already too late for the "Western Posse" so full of narcissism that they can only see profits, and units in a world full of diminishing resources, welcome back to the third world, any day now.
I'll miss it, but hopefully adapt.
Can your filters respond to an avalanche of spam from an increasing number of throw-away email accounts when it is relayed by legitimate email servers? Can your filters handle spam email that changes body, subject, header, relay, and source address? How much time are you putting into these filtering configurations to do that?
Maybe it is time to start thinking about how to actually address the spamming problem now, instead of just dealing with the spam itself. Your filters aren't going to help you forever...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
And I reviewed her security protocols. She has a Mac and uses Firefox or Chrome exclusively. This leaves out attacks based on Microsoft security holes (un-updated Microsoft installations, etc).
She visits sites while still logged into Google. I wonder if there is some way to do that. The only other thing I can think is that she used her email address to create an account at a compromised or fake website and used that email account's password as the account password.
Nevertheless, I can confirm the unauthorized access was through the mobile interface. In fact, the access point was Portugal.
The only other thing I can think of is somehow her use of Google's software for accessing her email or syncing her calendar through her iPod Touch might have been compromised. Then again, she only connects to the network here. (Unless she left it roaming.)
On a side note, GMail, by default, does not require an SSL connection. I wonder if anyone who was hacked had their settings set to require that.
Anyway, the point is that Google's assertions that accounts are compromised is bogus. If my family member's account was compromised, it was because of an insecurity in Gmail. Either browsing while logged into Google, or by not requiring an SSL connection to access Gmail, I don't know -- but I feel confident the insecurity was not the typical social engineering or browser/chat hole.
As some have said above -- Gotta love the Cloud!
I think I'll keep predominantly to old-fashioned email. After all, Google went and picked a fight with the Chinese. Maybe it isn't state-sponsored hacking, but that doesn't mean it's not Chinese hacking.
This happened to a gmail account that I use specifically just to auto-forward e-mails. I never log-in to it since all it does is forward, and it had a pretty secure password. I would imagine a spammer wouldn't just brute-force random accounts?
As soon as I read this I went to my account, and saw a lot of mobile activity from California. I freaked! Then I had a thought - so I went to my WM6 cell phone and had it synchronize with gmail. Aha! I knew it - my cell phone is really in California. (And some mobile activity may be legit, and the state may be wrong, as I'm in Texas, T-Mobile must route it out there.)
A rapid scan shows that most of those who, here on this page AND are complaning about or admitting to having gmail accounts hacked, are within the US. I am in Austria, and know of no compromised accounts whatsoever - friends, acqaintances, etc. etc. Although the Serbian hackers are damn close... Coincidence ?
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Yeah this happened to me last week and had a secure 8 character password made up of random letters and numbers. I'm not sure if it was a hack or maybe I just got sloppy and used that same password on some other site were I also provided my e-mail and they somehow got it that way. I'm not sure if I had the SSL setting enabled because when I went to set it, neither the http or https radio button was set. I had also just written up an automated perl server monitoring script a few days before that would use the account to send an automated message (via SSL) but that could have been coincidental, who knows? All they did was send Viagra spam to all the contacts. I immediately changed the password and also made the security question/answer nonsense since I can remember my damn password. Only check the mail from my Macbook or iPhone.
Gmail's security sucks and it's customer service is non-existent. Try getting Google to respond to your attempts to regain control of your own gmail account after it's been hacked.
,we were robbed, worse of it is that bags, cash and cards and cell phone were stolen at GUN POINT, it's such a crazy experience for us, we need help flying back home, the authorities are not being 100% supportive but the good thing is that we still have our passport but dont have enough money to get on a plane back home, and i need you to loan me some cash just to complete the ticket fee till we are back home to refund it back to you,i'm dead serious about this.hope to read back from you asap."
My friend had her gmail hacked recently. The hackers locked her out, changed her private info, and then sent this email to every single one of her contacts:
"i'm sorry for this odd request because it might get to you too urgent but it's because of the situation of things right now,We are stuck in london right now,we came down here on vacation
The hackers then sat logged-in to her account pretending to e her, and chatted with her contacts via gmail chat begging them to Western Union cash ASAP.
Over the course of many hours, we tried to regain control of the account via Google's automated system, but we were repeatedly denied. There was no way to contact an actual human being at Google. After a day of pleading on Google forums, control was finally returned to the accounts rightful owner, but the damage was already done.
Google encourages people to trust gmail with their most sensitive personal data. I think their negligence and lack of response regarding their own products' defects borders on criminal.
Happened to my spouse. Password was more than eight characters, letters, numbers, etc. but I think her work is the likely vulnerability (these free screen savers are great!) No more of that now, obviously. The awful part was trying to get the account back. Because of Gmail's "Swiss Bank Account" set up, there is no way to prove you are the real user. She lost access to Email, Docs, Calendar. She just kept filling out the form, and getting rejected. Google advises to set a security question, but that was the second thing changed, after the password. Only after filling out the form over and over for 10 days, was she finally judged to be "real", and her password was reset. For the cloud to take off, there has to be a better structure. A local admin structure? If we were going to start using Google products again fresh, I would sign us up for a free Apps domain, and then give us each user accounts. (When I first signed up for free Webmail, not only did I not know my spouse, I had no idea much of our data-lives would eventually be linked to the account.) That way, if anything untoward happens, I can login as admin from home and reset the accounts. Unfortunately, I don't think there's a way to link personal accounts into an Apps set up. Not yet anyway (crossing fingers). My other work around is that I set up a proxy double email account, to which my real address forwards everything. If for some reason I need to read my email from an unsecured computer, I log in to the proxy account, where I can read copies of all my mail. If its compromised, I cut it off from the actual account faster than a zombifying limb. Still not a great solution, because all my mail is compromised, but at least I don't lose control of my email address and the rest of my Google account.
I posted the info last night in the thread about someone stealing google's auth code. I don't think it's a dictionary attack. I think it's related to using the password on other sites. Happend to my wife right after setting up a Nike account. No malware detected. I guess it could be fishing sites.
Zoid.com
You bastard. I needed this reminder that I share my birthday with one of the lowest life forms ever to have inhabited a human-looking body. Douchebag.
although i also recently started getting Nigerian offers for my craigslist posts from ppl with gmail accounts..
I seem to have been compromised by Chinese mmorpg gold farmers. They even send their sent mail to the trash, which I find interesting. They have sent over 15 emails already in the past 4 hours advertising the site: www.Mmop.com from ip 58.20.79.212. What is most interesting about this is the fact that the password on this account isn't exactly what I would call easy to guess, and has to have been lifted from another site or source.
happened to me on sunday. and six other friends. 25 people i know since sunday have gotten hit as well.
obnoxiously there's no way to report the incident to google. all the help stuff is self-serve and the "send feedback" link is a closed beta.
i had a 28 character password of numbers, letters (upper and lower case) and punctuation that I only used for gmail, so it's highly doubtful they were able to guess at that.
somehow i feel like this is linked to the theft of their security software
Don't these guy realize gmail accounts are free? Who hires these guys?
From the page where Google talks about keeping your account secure....
"We can tell you, though, that trying all of these programs often makes a difference, as does having the latest versions.
* Google Pack - Norton Security Scan, Spyware Doctor
* Kaspersky Free Virus Scan
* Spybot Search and Destroy
* Lavasoft Ad-Aware
* MacScan"
Norton is not part of the Google pack. Besides, when did it become a good idea to run more then one anti-virus? I always thought that was a good way to cause problems with them fighting each other over a virus.
From the Google Pack page...
"Learn more about Google Pack Software
* Google Chrome Web Browser
* Google Apps
* Google Earth
* Google Toolbar for IE
* Spyware Doctor with Anti-Virus
* Google Desktop
* Picasa
* Adobe Reader
* Firefox with Google Toolbar
* Google Talk
* Skype
* RealPlayer"
What is interesting is that it includes Chrome and Firefox. It is nice to see them recommending Spybot. It has long been a favorite of mine that seems to have lost some of its popularity over the past year or two. On the other hand, they have RealPlayer in the Google Pack and I have despised them for ages.
Is he strong? Listen bud, He's got radioactive blood.
I have found that my Google Account password is my most important password. Not only does it have my Gmail since 2004, it also has my Calendar, Voice, Documents, and Checkout. It's pretty freaking terrifying. Interesting question: do I need to split it up amongst different providers? Putting your eggs in one basket is a pretty stupid idea but having everything together is so freaking convenient. Ugh.
Anyway, I use Keepass. I have a 60 character password with symbols, letters, numbers, and the like. That means that I cannot use my Gmail account on public computers that do not have the Keepass software and my password database, but that forces me to keep my discipline. I literally cannot log into my email away from a computer or device that I own.
A NYC lawyer blogs. http://www.chuangblog.com/
Although this isn't directly related to this particular occurrence, I think Google has some serious security issues to deal with on the entire gmail platform. I am a forum admin, and I find that the vast majority of spammers who sign up for accounts do so with a gmail account. most of these appear to be bots, they are only marginally slowed down by our captcha, so I suspect they have no trouble with google's either. The fact that such a large percentage of the spam comes from accounts set up through gmail tells me that spammers find it to be the easiest email system to break in to with automated tools.
If I had the option I would simply ban all registrations from gmail accounts, it would eliminate the vast majority of our forum spam. Unfortunately though too many of our legitimate users also use gmail accounts.
Happy birthday, AC!
This is why I randomly generate all my important passwords.
'Political power grows out of the barrel of a gun.' - Mao Tse-tung
my thoughts are along the lines of "password recovery" compromises
1. your main password should be sick complex and written down
2. with any "password recovery" questions should you should choose one where you can put in a real password and not simply choose an option from a drop down list, the password should be even more difficult than your main password, destroy all copies thereof after entering it into the system including clearing the cache(don't write it down)
3. never give google your phone number since they consider it a viable form of id for password recovery and can be spoofed (or a phone company bot-net master can request your password)
i wish there was a true "no password recovery" option, but till there is that's the best improvisation i can think of
she clicked on a link sent by one of her friends, and it asked for her gmail password, which she duly filled in.
Luckily for her, she was online on gmail when the hacker started sending mails and phishing links to her other friends,
and we immediately changed the password, and forced signed out all other sessions [yes, that little feature on gmail recent login details came in handy.]
The account is safe now, and more importantly.. she learned her lesson, not to give away her passwords to any random site.
I feel like this may be linked to the theft of their security software. Or else maybe a breech from the way past that someone has decided to jump on. Long gone mad employee or something could also be the blame. From what I have read from others that were breached, it does not matter the complexity or age of the password, you still get breached. So something fishy is definitely going on here. I guess it is safe to say that if you have a gmail account it is not safe, and you should check it everyday.
it's surprising people here at slashdot are not defending google.
as it's motto do no evil, it's not their fault. it's the user's fault. it's never google's. screw you.
Mine was hacked about a week ago; I chalked it up to a weak password.
all google services should only work via SSL, this is not the case at the moment so even if I use https on gmail, it doesnt mean calendar will only open on https for me! this is probably how they sniffed all the passwords so far :/
My password is a mix 8 letters and numbers I only use for gmail. Spam was sent out from my contacts in groups of 10. Each group of ten got a different link to somthing.spaces.live(dot)com. I caught it an hour after I started getting return dead addresses and immediately changed my password and password retrieval question. I went over my filters to make sure none were changed and also checked forwarding and pop access.
Adaware and virus scan showed nothing. As a precaution I saved my contacts to a file and deleted them for now.
Interesting investigation work on the Google forums:
http://www.google.com/support/forum/p/gmail/thread?tid=77127463d8f40cb6&hl=en