Slashdot Mirror
Escalating Gmail/Spamming Attacks
We've been getting submissions about an uptick in compromised Gmail accounts in the last few days, but nothing that could be substantiated. Robert McMillan did a bit of digging and now reports in PC World that "Google is investigating a growing number of reports that hackers are breaking into legitimate Gmail accounts and then using them to send spam messages. The problem started about a week ago but seems to have escalated over the past few days. ... [I]n forum posts, Gmail users note that the hackers appear to be sending spam via Gmail's mobile interface — which gives mobile-phone users a way to check their Gmail accounts — and wonder if there may be a bug in the mobile interface that is allowing criminals to send the spam. ... Google says there's no Gmail bug. ... 'Spammers may sometimes use a mobile interface to access accounts they have already compromised because it's simpler for bots to use this method at large scale.'" Here's how to tell if your Gmail account has been accessed by bad guys, and what to do about it.
Wasn't that google sso (Gaia) code ganked recently? Wonder if it's connected....
Website Hosting
About a week ago, ironically. She had a pathetic password, so I wasn't too surprised. The upside to the story was that we contained it rapidly, and now she actually USES keepass for all her passwords. Woot! Thanks mister Romanian hacker dude.
All your base are belong to Google.
And I had a pretty secure password. Now it is much more secure.
I got lucky, noticed the odd activity (from Texas no less) and jumped all over fixing it.
Suppose you were an idiot and suppose you were a member of Congress
I can verify this trend. Several of my aunts have switched to Gmail lately, decreasing the spam I get from Hotmail/Yahoo and being replaced by Gmail-based spam.
My webcomic
Apparently this happened to someone I know. She created a third-party web account (in her case, I think it's LinkedIn), entered her Gmail address, and used the same Gmail password for that account. I had to remind everyone I know that some websites *always* check to see if they can log into your e-mail with the password you supplied. Or it could be that the third-party account database was compromised. Either way, always use a different password. A lot of websites apparently store password in clear text, or in non-salted SHA1 or MD5 form so you can easily perform an inverse lookup.
After she changed her password, her account is clean again.
I once had a signature.
Can your filters respond to an avalanche of spam from an increasing number of throw-away email accounts when it is relayed by legitimate email servers? Can your filters handle spam email that changes body, subject, header, relay, and source address? How much time are you putting into these filtering configurations to do that?
Maybe it is time to start thinking about how to actually address the spamming problem now, instead of just dealing with the spam itself. Your filters aren't going to help you forever...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Gmail's security sucks and it's customer service is non-existent. Try getting Google to respond to your attempts to regain control of your own gmail account after it's been hacked.
,we were robbed, worse of it is that bags, cash and cards and cell phone were stolen at GUN POINT, it's such a crazy experience for us, we need help flying back home, the authorities are not being 100% supportive but the good thing is that we still have our passport but dont have enough money to get on a plane back home, and i need you to loan me some cash just to complete the ticket fee till we are back home to refund it back to you,i'm dead serious about this.hope to read back from you asap."
My friend had her gmail hacked recently. The hackers locked her out, changed her private info, and then sent this email to every single one of her contacts:
"i'm sorry for this odd request because it might get to you too urgent but it's because of the situation of things right now,We are stuck in london right now,we came down here on vacation
The hackers then sat logged-in to her account pretending to e her, and chatted with her contacts via gmail chat begging them to Western Union cash ASAP.
Over the course of many hours, we tried to regain control of the account via Google's automated system, but we were repeatedly denied. There was no way to contact an actual human being at Google. After a day of pleading on Google forums, control was finally returned to the accounts rightful owner, but the damage was already done.
Google encourages people to trust gmail with their most sensitive personal data. I think their negligence and lack of response regarding their own products' defects borders on criminal.
Happened to my spouse. Password was more than eight characters, letters, numbers, etc. but I think her work is the likely vulnerability (these free screen savers are great!) No more of that now, obviously. The awful part was trying to get the account back. Because of Gmail's "Swiss Bank Account" set up, there is no way to prove you are the real user. She lost access to Email, Docs, Calendar. She just kept filling out the form, and getting rejected. Google advises to set a security question, but that was the second thing changed, after the password. Only after filling out the form over and over for 10 days, was she finally judged to be "real", and her password was reset. For the cloud to take off, there has to be a better structure. A local admin structure? If we were going to start using Google products again fresh, I would sign us up for a free Apps domain, and then give us each user accounts. (When I first signed up for free Webmail, not only did I not know my spouse, I had no idea much of our data-lives would eventually be linked to the account.) That way, if anything untoward happens, I can login as admin from home and reset the accounts. Unfortunately, I don't think there's a way to link personal accounts into an Apps set up. Not yet anyway (crossing fingers). My other work around is that I set up a proxy double email account, to which my real address forwards everything. If for some reason I need to read my email from an unsecured computer, I log in to the proxy account, where I can read copies of all my mail. If its compromised, I cut it off from the actual account faster than a zombifying limb. Still not a great solution, because all my mail is compromised, but at least I don't lose control of my email address and the rest of my Google account.
My Gmail account was accessed by the Amazon EC2 cloud about a week ago. (http ://aws.amazon.com/ec2/ ) I have an 18 character upper/lower/numeric/special character password so I'm guessing it wasn't a dictionary attack. "Something" odd is definitely going on. I changed the account password as soon as I was alerted to the unusual IP and have been OK since, but I'm watching the access IP's like a hawk now. An no, I don't use this password for any other web site or application.