Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Uncovers China-Based Password Collection Campaign

Posted by samzenpus on from the all-your-passwords-are-belong-to-us dept.

D H NG writes "Google announced that it recently uncovered a campaign to collect users' passwords. The campaign, apparently originating from China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior US government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists. Google said it detected and has disrupted this campaign and has notified victims and secured their accounts, as well as notified the relevant government authorities."

186 comments

  1. Hmm by Anonymous Coward · · Score: 1

    So is this an act of war by china?

    1. Re:Hmm by Anonymous Coward · · Score: 0

      No, they were just trying to find out passwords.

    2. Re:Hmm by Fluffeh · · Score: 3, Insightful

      I think this falls under that lovely "espionage" blanket. You know the "other guys" are doing it, they know that you are doing it. But everyone pretends like it isn't going on and no-one bats an eyelid in public. However, behind closed doors, this sort of action is driving yet another wedge into the relationship - but at the same time also driving more funding into your own budgets for doing a similar thing to the "other guys" yet again.

      My guess is that the fallout of this will be that there will be a project launched with some funny nondescript name that tries to get similar intel on the Chinese. They will likely get wind of it, but be unable to do anything about it as there will never be undeniable proof of the point of origin.

      This sort of thing went on for decades (and still does) with the US/Russians, the middle east and just about every European country. It just (mainly) never sees the light of day. The Chinese seem to be getting caught more of late though - which can mean that either they are pretty poor at it compared to the rest (dubious) or their program is a whole heck of a lot bigger and more ambitious than the other players in the game - which I think is much much more likely.

      --
      Moved to http://soylentnews.org/. You are invited to join us too!
    3. Re:Hmm by nurb432 · · Score: 3, Informative

      Who said it was the Chinese government?

      --
      ---- Booth was a patriot ----
    4. Re:Hmm by johnsnails · · Score: 1

      now pretty-please get of my lawn

    5. Re:Hmm by Mashiki · · Score: 1, Interesting

      Wrong. It's only an act of war if liberals will stop whining over civilian casualties.

      Feel free to say I'm an evil bastard or whatever. But we changed the RoE based on that above statement. And when we did, we ensured that we'd only fight wars where there was a low to no chance of the enemy having a chance of putting up a decent fight.

      --
      Om, nomnomnom...
    6. Re:Hmm by Luckyo · · Score: 2

      There is a far more obvious version of what this means:

      West is demonizing China for its population into next cold war opponent, therefore any and all negative news about China in relation to West will be published with reasonably big headlines.
      Notably, it's not very different for Chinese either, same seems to be going on on their side as well.

    7. Re:Hmm by infolation · · Score: 1

      either they are pretty poor at it compared to the rest (dubious) or their program is a whole heck of a lot bigger and more ambitious than the other players in the game

      ...or its an intentional act of provocation.

    8. Re:Hmm by TapeCutter · · Score: 1

      You do realise that the rules of war concerning the protection of civilians were established in the 1800's, right?

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    9. Re:Hmm by Doc+Ruby · · Score: 2

      "Liberals" (really "not quite evil bastards") have always resisted war on the basis of its inevitable civilian casualties. The US has avoided civilian casualties, even at the cost of missing out on really profitable wars, since the majority of Americans have resisted war's inevitable civilian casualties starting with WWI, but really after WWII: the wars in which many Americans actually saw some civilian casualties.

      You, however, have never seen either war or its civilian casualties personally. Before you demand more, go see some. There's plenty in the world, including by American hands.

      --

      --
      make install -not war

    10. Re:Hmm by Anonymous Coward · · Score: 0

      Of course it is! Are you retarded?

      They're fully blatant about it and just don't care.

    11. Re:Hmm by KiloByte · · Score: 1

      There are no big organizations in China that don't have government approval. In many cases it's just paying officials to look the other way, but it's still with their knowledge.

      So what we have here? A large scale undertaking that the Great Firewall would make harder without a permission to bypass, and one the government can use to spy on people. There's no way it's not at least closely tied with them.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    12. Re:Hmm by ppanon · · Score: 1

      Yep. Alternatively, walking through the streets of Joplin right now would probably give you a minor taste without the danger. Doing the same in Fukushima Prefecture will up the ante a bit without going into a real war zone.

      --
      Laissez lire, et laissez danser; ces deux amusements ne feront jamais de mal au monde. - Voltaire
    13. Re:Hmm by Anonymous Coward · · Score: 0

      Oh, well that's true. It could be a funded, technologically literate group inside china working to compromise high value intelligence targets of the chinese government and domestic enemies of their government, but without the government's consent or knowledge, from inside a country that prides itself on strictly controlling access to international resources on the web.

      Or maybe that's retarded.

    14. Re:Hmm by Mashiki · · Score: 1

      Don't ever assume anything. You'll only make an ass out of yourself.

      --
      Om, nomnomnom...
    15. Re:Hmm by rainmouse · · Score: 1

      Wrong. It's only an act of war if liberals will stop whining over civilian casualties.

      Somehow you manage to make liberal sound like an insult with your "Yehaw, lets high five each other and blow shit up because explosions are fucking cool and screw the collateral casualties"

      attitude. Your attitude only further perpetuates this somewhat unfair perception of the typical American. Maybe it bothers me more than it should because a girl from my school, Linda Norgrove was killed by Navy Seals who were apparently attempting to rescue her with grenades (they later lied and claimed it was a suicide bomber) and they even managed to shoot her corpse in the leg.
      This attitude of yours just makes the sad attempt of a rescue seem so very..... American.

    16. Re:Hmm by Issarlk · · Score: 1

      why modded down? It's true.

    17. Re:Hmm by cavreader · · Score: 1

      In war it's the winners who decide what is right not some policy devised 200 years ago.

    18. Re:Hmm by cavreader · · Score: 1

      Your friend is dead because of those who kidnapped her. Period. Making disparaging remarks against the people who attempted to rescue her and describing the attempt as "sad" and "American" does nothing but validate the actions of those who actually took her and encourage them to do it again.

    19. Re:Hmm by Doc+Ruby · · Score: 1

      Are you telling me that you've been in a war, directly and personally?

      --

      --
      make install -not war

    20. Re:Hmm by TapeCutter · · Score: 1

      Indeed, but what has that got to do with my point?

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    21. Re:Hmm by cavreader · · Score: 1

      You made a reference to the Laws of War in regards to killing civilians and my point was the winner of a war gets to decide what is and what is not lawful. I also have a problem when people use the term "illegal war". I doubt the US or any other military power have surrendered their sovereignty and made thier legal systems subservient to international laws.The biggest part of any legal framework requires the ability to enforce those laws and I don't see anyone stepping up to do that on the international level.

    22. Re:Hmm by TapeCutter · · Score: 1

      Whooosh! Look at the contex, the GP implied the rules of war were a recent invention of "liberals". I was correcting his erroneous statement, I said nothing about the utility or otherwise of such rules, but since you bring it up I'm in violent agreement with you.

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
  2. ...Wh.. by Anonymous Coward · · Score: 0

    ,,,What ?

    1. Re:...Wh.. by milkmage · · Score: 3, Informative

      where the hell have you been?

      "In its first formal cyber strategy, the Pentagon has concluded that computer sabotage by another country could constitute an act of war"

      http://www.msnbc.msn.com/id/43224451/ns/us_news-security/t/sources-us-decides-cyber-attack-can-be-act-war/

    2. Re:...Wh.. by Oxford_Comma_Lover · · Score: 1

      The question is (1) at what point the origin of a cyber-attack presents presumptive evidence of state action that must be rebutted, (2) whether the absence of a showing that the state was not involved means that the US should be launching reprisal cyber-attacks against China. Also, (3) whether it does so already and we just don't hear about it.

      At this point, there is a pattern of cyber-attacks on the US originating in China. If China does not hunt down the perpetrators, it should be considered complicit and the United States should strongly consider response in kind.

      --
      -- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
    3. Re:...Wh.. by Anonymous Coward · · Score: 0

      the United States should strongly consider response in kind.

      And when China redirects the "response in kind" traffic to a US system?

    4. Re:...Wh.. by rasmusbr · · Score: 2

      The article says "The officials emphasize, however, that not every attack would lead to retaliation. Such a cyber attack would have to be so serious it would threaten American lives, commerce, infrastructure or worse, and there would have to be indisputable evidence leading to the nation state involved, NBC Pentagon correspondent Jim Miklaszewski said."

      What that means in English is something like: If an hostile organization brought down the electric grid, or caused a meltdown in a nuclear plant, or caused airliners to crash, or did something equivalent, then that means that war is an option.

      That makes sense IMHO.

    5. Re:...Wh.. by gman003 · · Score: 1

      I would assume that the burden of proof needed to declare war over a cyber-attack is no different than that needed for a physical attack. The Pentagon was basically just saying "cyberattacks aren't exempted from war - we will retaliate as we would for any other attack".

      Now, if China were to launch a large-scale cyberattack, we'd know it was them, because they would simultaneously launch all kinds of other military attacks. If it's big enough to cause major problems, it's big enough to leave a trail, and eventually the culprit country will be hunted down. We know this. China knows this. Thus, any major cyberattack would be in combination with other attacks.

      Hypothetical war scenario: First warning is a massive cyberattack. Goal is denial-of-service of the entire North American comms system. Whether by clever hacking or sheer numbers, the systems go down, and stay down. No Internet, no phone, nothing faster than Fedex. Second notice is a full ICBM launch. 300 missiles, their full inventory, each with nuclear warheads. Priority targets are the American missile fields. They're hit before they can receive orders to fire, or even confirm that there's an attack going on. Time elapsed: 20 minutes. US ICBMs are effectively gone. The only remaining nuclear option (the bombers were mothballed long ago) is submarine-launched missiles. Enough for some nasty payback, but not enough to turn the tide.

      This could be either the prelude to an invasion, or simply a preventative measure - getting us out of the way so they can "finish" the Korean War, maybe. Perhaps even just a defensive distraction, should China feel that the American army is uncomfortably close to their border.


      OK, so I'm not Tom Clancy here, but that's the most plausible scenario I can imagine for a military cyberattack. Political or espionage, sure, there's plenty of those, but when was the last time we declared war over a spy?

    6. Re:...Wh.. by AHuxley · · Score: 1

      United States should strongly consider response in kind?
      Russia learned in the early 1950s that its mil radio communication was under constant threat. They changed to one time pads and hardened their communications networks.
      China did not leak much signal info during the cold war and if they where wise would not have much on any open networks now.
      Why the US would have any info on open networks beyond honeytraps/boondoggle efforts is very strange/sloppy/dumb.

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re:...Wh.. by thejynxed · · Score: 1

      You underestimate how many of those ICBMs were removed from stationary silos onto warships and submarines. Strangely enough, a large amount of the current number of nuclear arms in our inventory happen to be within easy striking distance of China via bodies of water near the Iraq and Afghan campaigns...

      BTW, right now Congress is attempting to force Obama into upgrading the rest of the stockpile now that we signed the new START and left the previous anti-nuke treaty that had been signed under an older administration. Republicans (with the backing of several Dems) have tied this into an appropriations bill, namely the kind that the president is not allowed to veto by law.

      --
      @Mindless Drivel: 100% of Twitter posts ever Tweeted.
    8. Re:...Wh.. by BrokenHalo · · Score: 1

      A lot of the problem stems from the fact that the US and other Western countries have got into the habit of licking the asses of the Chinese in order to maintain trade relationships. Acceptance of the principle that China has committed an act of war might presuppose that other sanctions are fair game, but Big Business always squeals when any political move is made counter to their short-term interests.

      It is perfectly possible for the rest of the world to pull the plug on China, leaving them to howl for any resources they need to maintain growth and dominance, but it would mean growing a pair. If we aren't prepared to fight back or isolate hostile attackers, then all we can do is play whack-a-mole with them.

    9. Re:...Wh.. by cavreader · · Score: 1

      The nuclear payload from just 1 submarine is capable of more than payback. And your scenerio also does not take into consideration that there are protocols in place to respond to certain types of threats even with coms down. That's even assuming they could take down the military coms at all. Do you think the military has not gone to great pains to harden their systems against EMP and position redundant satellites? The civilian communication networks could be crashed but I don't believe the military has their ICBM launch controls wired into the Internet.

  3. So... by Anonymous Coward · · Score: 1

    ...air strikes?

    1. Re:So... by creat3d · · Score: 2

      No, just a tighter grip on "Anonymous", whoever the fuck that is.

      --
      Grammar nazis are to this community what excrements are to gold.
    2. Re:So... by The+Snowman · · Score: 1

      ...air strikes?

      Attacking China would destroy our economy.

      --
      24 beers in a case, 24 hours in a day. Coincidence? I think not!
    3. Re:So... by Anonymous Coward · · Score: 1

      ...air strikes?

      Attacking China would destroy our economy.

      I'd be impressed if it could get much worse that it already is.

    4. Re:So... by Anonymous Coward · · Score: 0

      Sheesh, what economy?

    5. Re:So... by Anonymous Coward · · Score: 0

      Prepare to be impressed.

    6. Re:So... by BrokenHalo · · Score: 1

      Attacking China would destroy our economy.

      You don't need China, you're doing a good enough job of destroying your economy all by yourselves.

  4. excellent PR by Google by Presto+Vivace · · Score: 3, Insightful

    it isn't a data breach, Google has uncovered a campaign to steal passwords. Well done Google.

    1. Re:excellent PR by Google by Anonymous Coward · · Score: 0

      Phishing is not a 'data breach'.

    2. Re:excellent PR by Google by AlienIntelligence · · Score: 1

      Phishing is not a 'data breach'.

      Mmm, yes, because EVERYONE collects passwords
      like beanie babies right?

      Oh wait...

      -AI

      --
      For me, it is far better to grasp the Universe as it really is than to persist in delusion
    3. Re:excellent PR by Google by Anonymous Coward · · Score: 0

      You are just full of shit. There is no way for Google to prevent that kind of phishing, they don't have the control on the ISP/Wifi network of everybody. The best they can do is try to mitigate it by telling people to verify HTTPS certs and talking about it.
      And it's definitely NOT a data breach on Google's system. I mean if you have a keylogger on your computer and somebody use it to steal your bank account, it's nowhere near your bank's fault.

    4. Re:excellent PR by Google by rritterson · · Score: 1

      Well, if it is a phishing scheme like google believes, it's not quite the same thing as a data breach like we typically use the term.

      Sort of like the difference between me being tricked into giving away my ATM PIN and a hacker breaking into the bank system and taking money from my account.

      --
      -Ryan
      AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
    5. Re:excellent PR by Google by Idbar · · Score: 1
      As a security advice:

      Review the security features offered by the Chrome browser. If you donâ(TM)t already use Chrome, consider switching your browser to Chrome.

      Nice try Google, nice try! But, I'll keep my Firefox :P

    6. Re:excellent PR by Google by 1u3hr · · Score: 1

      it isn't a data breach

      Correct, it wasn't, at least not from Google. It relied on fooling users into logging in to counterfeit sites. So if you're implying Google failed to protect users' data, that's not the case. If people give up their passwords, it's their own fault.

    7. Re:excellent PR by Google by SpaceLifeForm · · Score: 3, Informative

      That is because it was NOT a data breach at Google, but a phishing campaign.

      --
      You are being MICROattacked, from various angles, in a SOFT manner.
    8. Re:excellent PR by Google by Neptunes_Trident · · Score: 0

      All while Google assists our own governments campaign (patriot act & such). Witness the hand of justice, while the other hand of deceit works behind your back. Dismantling our foundation of liberty by limiting economic freedoms by Google providing information & assistance with corporations and government. Marketing, Statistical information about anyones life, what harm can it do? NO, this information will never paint a target on your back, regardless of your idealogical or political stance. Sure, right. Hide in your cave. Careful what you chisel on the walls. Be a good slave & stay within your debt/credit system and you'll be fine.

    9. Re:excellent PR by Google by praxis · · Score: 2

      I think what you mean is if users give up their passwords to a site that cannot have its identity verified, it's their own fault. Giving up your password to Google is practically a requirement for using their Gmail service. Until we have better browser user-interfaces for authenticating sites, it will be very hard to prevent phishing attacks that look authentic. Getting rid of the address bar is probably not one of those improvements.

    10. Re:excellent PR by Google by poptones · · Score: 1

      Well it fucking happened to me and it sure feels like a data breach. This happened just the other day and they used my contacts folder to send spam (ONE PIECE) to everyone in my address book. This means they had access to every piece fo data saved in my account. If that isn't a data breach, what is?

    11. Re:excellent PR by Google by LordLimecat · · Score: 1

      Yes, well, google should have installed antivirus on the several hundred million home PCs you seem to think theyre responsible for.

    12. Re:excellent PR by Google by tabdelgawad · · Score: 1

      True, but it does highlight the danger of the government and enterprises moving their email service to Google and the 'cloud'. My company requires me to use an RSA token to log in to corporate mail or VPN, so simple phishing won't be successful. I'm aware of the recent RSA hack but in some ways, that's the point of two-factor authentication: you can completely compromise one factor but still have time to fix things before the other factor fails.

      --
      Imposing Libertarian views on everyone online since 1992.
    13. Re:excellent PR by Google by Anonymous Coward · · Score: 1

      Google only does that because they're completely forced to, and they've historically been very vocal in their resistance. They're NOT happy about it.

    14. Re:excellent PR by Google by RobbieThe1st · · Score: 1

      Erm, if they have your password, they have everything about you. That's not a data breach though. A data breach would be if Google lost a copy of their Gmail account DB, etc. Not just someone phishing for account passwords.

    15. Re:excellent PR by Google by Anonymous Coward · · Score: 1

      You're being sarcastic but your comment taken literally is true on all counts. Even the headline. It is good PR: other email providers, like Hotmail or Yahoo, either would have glossed over this internally, or lacked the competence to even discover the systematic attack.

    16. Re:excellent PR by Google by Anonymous Coward · · Score: 0

      Well it actually isn't, fuckhead. That's not PR, it's called truth.

    17. Re:excellent PR by Google by micheas · · Score: 1

      Ergo, chromeOS.

      --
      Work bio at MMWD
    18. Re:excellent PR by Google by innerweb · · Score: 1

      How did you get phished?

      --
      Freud might say that Intelligent Design is religion's ID.
    19. Re:excellent PR by Google by Anonymous Coward · · Score: 0

      Google offers free two factor authentication for Gmail and in fact recommends users to enable this in their blog post about this "breach".

    20. Re:excellent PR by Google by AHuxley · · Score: 1

      "Not happy about it" is sending in lawyers, PR teams and been very open about whats going on, not teaming up with the NSA.

      --
      Domestic spying is now "Benign Information Gathering"
    21. Re:excellent PR by Google by Anonymous Coward · · Score: 0

      You realize that one of the points of advice on this phishing thing was to enable 2-factor authentication on your gmail account, right? From the article (I know, silly me):

      Enable 2-step verification. This Gmail feature uses a phone and second password on sign-in, and it protected some accounts from this attack. So check out this video on setting up 2-step verification.

    22. Re:excellent PR by Google by AftanGustur · · Score: 1

      it isn't a data breach

      It may very well be a data breach for companies with employees that fell victim to the password-stealing campaign.

      Not that Google is to blame here, but stating that "this isn't a data breach" is a big statement to make.

      --
      echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
    23. Re:excellent PR by Google by Jouster · · Score: 1

      Two-factor authentication disables replay attacks (after, typically, several minutes). It doesn't disable MitM attacks.

    24. Re:excellent PR by Google by Shikaku · · Score: 1

      Giving up your password

      I really hope you don't use only 1 password.

    25. Re:excellent PR by Google by BrokenHalo · · Score: 1

      At least Google is still nice enough to continue funding contributions towards Firefox development.

    26. Re:excellent PR by Google by praxis · · Score: 1

      I was not aware that Gmail allowed multiple passwords. I suppose I should have been more clear and said "Giving up your Gmail password to Google is practically a requirement for using their Gmail service."

    27. Re:excellent PR by Google by poptones · · Score: 1

      I like to think I'm an experienced user (I'm 48 and used to be an admin), and I still don't know when or how it happened. Not a good feeling.

  5. Happened to My Wife by friedmud · · Score: 4, Interesting

    My wife's Gmail account got caught up in this! Last weekend I received some spam from _her_ gmail account. We immediately logged in and Google said that it had detected suspicious behavior and made her reset her password. It then showed us the connection log... and everything looked normal except one particular connection: FROM CHINA!

    We were pissed.... but it doesn't appear that anything else was compromised (she didn't have anything sensitive in her Gmail account luckily).

    Things really seem to be escalating on the 'net lately... from PS Network to Lockheed and now to Gmail. I really have to wonder if China is _actively_ participating at this point...

    1. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      ID theft is on the rise too. Peoples credit ratings will be fucked to the point of sending media shockwaves around the US. This will further compound the lack of "faith" into the system upon the already mounting debt. Basically, it's like Fight Club. The whole G-Damn thing is about to implode with many youths already unemployed and adults frustrated in dealing with debt.

      My advice. As a geek, now is the time to stock up on food, ammo, and learn to grow your own food. The collapse of civilization is at hand. Total anarchy! The police will not be around to save anyone. YOYO (You're On Your Own)

    2. Re:Happened to My Wife by Amouth · · Score: 0

      if only it would happen - i hate the hurry up and wait game.

      --
      '...if only "Jumping to a Conclusion" was an event in the Olympics.'
    3. Re:Happened to My Wife by Anonymous Coward · · Score: 2, Insightful

      I kind of wonder how China's great firewall plays into plausible deniability for these things.

      For example if China blocks civilian access to x service, and we see hacking attempts to x service originating from China, shouldn't there be a pretty good explanation?

    4. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      I really have to wonder if China is _actively_ participating at this point...

      Really? Really?

    5. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      The article says they were trying to steal the passwords of government officials, making it sound like espionage. If the real purpose of this was to send spam, then it's just commercially motivated crime.

    6. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      But enough with the Joker quotes. Heath Ledger's dead, OK? Let's all move on.

    7. Re:Happened to My Wife by Miamicanes · · Score: 2

      Keep in mind that China is a country with 4x the population of the US, and has at least the same percentage of corrupt politicians with ties into organized crime who can get the police, firewall-maintainers, and everyone else to look the other way when necessary.

      Are there lots of attacks coming from China? Absolutely. Do the flourish there because the government is unwilling or unable to meaningfully fight them? Sure. Does China have its own government espionage agency with more or less the same goals as the CIA? Of course. Is there actually an official division of China's government tasked with waging cyber warfare against the US? I doubt it. Cash and corruption are perfectly good explanations.

      A favorite scenario thrown around Slashdot is China using the internet to sabotage America's financial system... totally overlooking the fact that Chinese investors *own* an increasingly huge chunk of America's financial system, and their hands go as deeply into the pockets of China's leaders as those of their counterparts in the US.

      This doesn't mean that the US should passively tolerate it, but rather illustrates that calls for a military department of cyber warfare is totally the wrong approach because it assumes the wrong reasons, the wrong motives, and would ultimately be gearing up to fight the wrong war against the wrong people (while the ones really causing problems slip under the radar and keep doing it).

    8. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      "and everything looked normal except one particular connection: FROM CHINA!"

      Wow, they must be very poor, can't even rent a proxy for $3.95/month with all those US trillions they've got, to appear NOT COMING FROM CHINA!

    9. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      "For example if China blocks civilian access to x service, and we see hacking attempts to x service originating from China, shouldn't there be a pretty good explanation?"

      The explanation being?

      The Chinese are too cheap to use a proxy in Canada?
      The warmongers are using a Chinese proxy to lure us into war with China?
      An angel working on the End Of Times on October 21th?

    10. Re:Happened to My Wife by buro9 · · Score: 1

      Have you guys not tried the 2 factor authentication yet?

      http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html

      I was afraid that my girl might find it difficult to use or overly technical, but once I explained how it worked and supported her through the setup of it, it's been working brilliantly.

      Basically any new machine that you connect to Gmail from requires not just your password (something you know) but also the code generated from the supplied app (on our Android phones - something you have).

      The key to internet security is to always have 2 out of the 3 following things:
      1) something you know (passwords, answers to secret questions, etc)
      2) something you have (physical keys, dongles, RSA SecurID)
      3) something you are (biometrics, fingerprints, etc)

      Google as yet, are the only major provider of email offering security that can use 2 factor auth by the something you know and something you have.

      It's really worth turning it on, just for peace of mind.

    11. Re:Happened to My Wife by BrokenHalo · · Score: 1

      The collapse of civilization is at hand.

      ...which, of course reminds some of us that Mohandas Karamchand Gandhi, when asked what he thought of Western civilization, said he thought it was "a good idea".

    12. Re:Happened to My Wife by Anonymous Coward · · Score: 0

      Is there actually an official division of China's government tasked with waging cyber warfare against the US?

      I think this is not even in doubt. Their army has a division that is explicitly tasked with hacking foreign governments and businesses.

      http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article2409865.ece

    13. Re:Happened to My Wife by cavreader · · Score: 1

      I was sort of wondering about the proxy thing. People who are intelligent enough to initiate these types of attacks are surely capable of obsfucating the trail back to them. Hell it's not even that hard for a single person let alone a government.

    14. Re:Happened to My Wife by rgviza · · Score: 1

      happened to me too. This is more than just a phishing campaign....

      --
      Don't kid yourself. It's the size of the regexp AND how you use it that counts.
  6. Allegedly just phishing. by Anonymous Coward · · Score: 0

    Well, they say it's a phishing attempt, which I wouldn't lump together with a "data breach".

  7. Hypocrites by clampolo · · Score: 0, Redundant

    The real reason Google is upset about this is because China isn't paying them to get the information like everyone else. Google is pissed that China is cutting out the middle man.

    1. Re:Hypocrites by Anonymous Coward · · Score: 1

      The real reason Google is upset about this is because China isn't paying them to get the information like everyone else. Google is pissed that China is cutting out the middle man.

      [Citation Needed]

    2. Re:Hypocrites by SplashMyBandit · · Score: 1

      Wrong. Google is not pissed about revenue loss. If they were worried about revenue loss they would have stayed in China, collected the advertising dollars in the growing market, and not given a sh!t about compromised users. Instead, they spurned the money on principle and withdrew from that market when the Chinese Government gave them crap conditions to operate under. Google's Sergei is particularly sensitive to repressive totalitarian governments like China because he grew up in the Soviet Union - and understands how bad such governments are to their own people (even if the people are brainwashed into believing it is good for them, and the government presents a happy face to the world while having a corrupt and brutal face internally). One the Chinese Government was implicated in the breaches of Google accounts Sergei was able to convince Larry to ignore the money and pull out on principle. This is actually a case of a big company doing something ethical (better late than never). But don't let me rain on your little conspiracy theory that Google is somehow more evil than the Chinese Government (something becoming fashionable to believe in the West, despite being a patent falsehood).

    3. Re:Hypocrites by Anonymous Coward · · Score: 0

      google collected personal wi-fi data, and when this was uncovered, claims it wasn't aware the equipment it was using was doing so.
      google == "Ethical"? I think not.

    4. Re:Hypocrites by Anonymous Coward · · Score: 1

      You might think it's stupid for a big company to take a principled stand like that, and generally it is, but that decision lined up with Google's future potential in Europe/America: Google is nearly unique (meaning doomed to fail) in the tech world in that it relies almost entirely on the amount of trust users place with Google. Other corporations can survive overwhelming bad publicity; Google can't, and it hasn't had to.

    5. Re:Hypocrites by Anonymous Coward · · Score: 0

      1. Uncovered by Google you mean.
      2. Because the "equipment" actually does work that way (it's no surprise that a hacker-oriented software company like Google fucks up the impl).
      3. Corporations cannot be ethical or unethical.
      4. Sub-divisions, the people inside them, even higher-ups are often unaware how something is implemented on the details level.
      5. Public wifi data isn't private.
      6. Google had legitimate reason for sampling traffic (certainly not by that amount).
      7. While you're complaining, other people (and probably organizations) ARE logging traffic, unbeknownst to you, likely for nefarious purposes.
      8. Users who had private data affected were simply collateral damage of the router companies.
      9. The risk:reward value just isn't there for Google; what is this, a conspiracy?

      There, did I cover all the pro-Google talking points?

  8. Gmail passwords collected so far.. by Megahard · · Score: 4, Funny

    Password
    passw0rd
    123456
    hunter2

    --
    I eat only the real part of complex carbohydrates.
    1. Re:Gmail passwords collected so far.. by Anonymous Coward · · Score: 0

      Hilarious.

      FYI, hunter2 reference: http://bash.org/?244321

    2. Re:Gmail passwords collected so far.. by rritterson · · Score: 0

      How did you see my password? I thought it only came up as ***s?

      Oh, I get it, to you it shows up as ***s but to me it shows up as hunter2

      --
      -Ryan
      AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
    3. Re:Gmail passwords collected so far.. by Anonymous Coward · · Score: 0

      Hey I got the same combination on my luggage.

    4. Re:Gmail passwords collected so far.. by Anonymous Coward · · Score: 0

      That's the same as the combination on my luggage!

    5. Re:Gmail passwords collected so far.. by guybrush3pwood · · Score: 1

      Hilarious.

      FYI, hunter2 reference: http://bash.org/?244321

      Wait a second, sport... you have bookmarks to bash.org?

      --
      Perhaps I'm trolling, perhaps I'm not.
    6. Re:Gmail passwords collected so far.. by moniker127 · · Score: 1

      I has a 12 digit password with random characters, letters, and numbers interspersed throughout it, and I'm a victim of this, so it isn't a matter of the passwords being simple, its probably a cross-site exploit of some sort.

    7. Re:Gmail passwords collected so far.. by steelfood · · Score: 1

      hunter2

      FYI, for the few who didn't get the reference.

      --
      "If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
    8. Re:Gmail passwords collected so far.. by flimflammer · · Score: 1

      hunter2

      Shit. Time to change my passwords.

    9. Re:Gmail passwords collected so far.. by Anonymous Coward · · Score: 0

      U forgot gl0riousrevolution

    10. Re:Gmail passwords collected so far.. by Anonymous Coward · · Score: 0

      No, old man, in this day we have rapid access to 'search engine' technology.

  9. hooray for report phishing by drinkypoo · · Score: 1

    If only it didn't take so many clicks more people would do it.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  10. Maybe it's time anonymous... by AlienIntelligence · · Score: 1

    I'm just sayin, maybe turn the LOIC on China for a bit?

    I think Sony may have learned at least a partial lesson now.

    -AI

    --
    For me, it is far better to grasp the Universe as it really is than to persist in delusion
    1. Re:Maybe it's time anonymous... by Anonymous Coward · · Score: 0

      Not your personal army...

    2. Re:Maybe it's time anonymous... by AlienIntelligence · · Score: 1

      Not your personal army...

      Never claimed it was... but instead of JUST being
      outraged that a corporation is going after 1 individual.

      Or narrow-minded churches, et al.

      I'm saying that placing some anger on an entire country
      trying to hack our citizens seems like a good outlet
      for their 'creative energy'.

      -AI

      --
      For me, it is far better to grasp the Universe as it really is than to persist in delusion
    3. Re:Maybe it's time anonymous... by Anonymous Coward · · Score: 0

      Sony didn't learn anything from that. The LOIC attack was utterly ineffective.

    4. Re:Maybe it's time anonymous... by bbecker23 · · Score: 1

      I'm saying that placing some anger on an entire country trying to hack our citizens seems like a good outlet for their 'creative energy'.

      Anonymous doesn't have citizens.

      --
      cat /dev/random > sig.txt
  11. as well as notified... by Threni · · Score: 1

    "as well as notified the relevant government authorities.""

    "Yeah, we know.... Uh.. I mean really? Collecting passwords, you say?"

  12. Act of war? by Anonymous Coward · · Score: 0

    So with the recent US policy stating any hack done by a foreign body onto critical systems will be considered an act of war. Will this constitute an act of war? Also are politicians gmail accounts critical?

  13. Why South Korea? by Anonymous Coward · · Score: 0

    Why target South Korean officials?
    I'd be very disappointed if China was feeding this information to support North Korea. At the least, I would hope China knows that Kim Jong Il is a dirtbag and would only be doing things to appease them, but not directly support them.

    1. Re:Why South Korea? by Nethemas+the+Great · · Score: 1

      South Korea has a pivotal role in the whole North Korea issue. China is sort of like a "big brother" to North Korea and makes sure that no one is dealing unreasonably with it.

      --
      Two of my imaginary friends reproduced once ... with negative results.
    2. Re:Why South Korea? by bigpet · · Score: 1

      Well I think China quite likes the idea of a communist country with a huge army as a buffer between them and the US-allied south.
      But they are well-advised to not support them officially, since they don't want to get drawn in into a war with America currently as it supplies them with consumers for their products. Also in case they do supply North Korea with Intel they better do so under the condition that they not start a nuclear war since atomic mushrooms in your neighboring countries are never a good thing.

      So imo their best bet right now is to officially distance themselves but secretly support them under certain conditions. But having information about the nearest country with US Troops stationed sounds like something they could use themselves.

  14. China is in a cold war, but .... by Anonymous Coward · · Score: 0

    looking to take it hot one day. We in the west are way to complacent. It is time for western citizens to re-think what is happening.

  15. I'm confused... by Anonymous Coward · · Score: 0

    ... is this an act of war on China's part or not?

  16. We are at War by Anonymous Coward · · Score: 0

    The masses - and the majority of our elected leaders and small business owners across the country - just don't know it.

    It's a "soft" war(e) I suppose. No muskets involved.

  17. credit cards have a feature by circletimessquare · · Score: 2

    where they won't let you use your credit card account abroad unless you phone ahead and tell them you will abroad and its ok if they start getting charges from bangkok or antigua

    maybe it's time for email providers to do the same: "no logging into my account from foreign ip blocks unless i tell you its ok"

    and the default for this protection should be "on". your average user won't take the time to hunt for this menu item and enable it

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    1. Re:credit cards have a feature by Anonymous Coward · · Score: 0

      intellectual property law is philosophically incoherent. it is your moral duty to ignore it

      Absolutely nothing is philosophically coherent.

    2. Re:credit cards have a feature by hguorbray · · Score: 1

      Sounds like it would stop the most direct attacks, but unlike credit card transactions, which can't be anonomized or proxied, a slighly more sophisticated attacker could just use a pwnd machine or proxy and they could appear to be coming from a nominally local block.

      However, if this is state-sponsored, the PRC may be reluctant to allow use of those tools lest they become widespread enough to allow massive evasion of the Great Firewall...

      I think eventually some combination of biometrics (hello Big Brother!), one time pad generating crypto-keys or smartFOBS with some RFID-based authentication will end up becoming the norm as most people's password usage is too insecure.

      -I'm just sayin'

    3. Re:credit cards have a feature by Anonymous Coward · · Score: 0

      Yes, nothing is coherent. But many other things are as well.

      Another thought: What the heck does this have to do with the comment you replied to?

    4. Re:credit cards have a feature by DaleCooper82 · · Score: 1

      maybe it's time for email providers to do the same: "no logging into my account from foreign ip blocks unless i tell you its ok"

      How do you tell them once you have gone travelling abroad without telling them because you forgot/had no time/whatever reason? What happens if you connect to some wifi that has internet connection routed via foreign gateway (think some mega corp)?

      --
      :: There is no light at the end of a tunnel. There is a tunnel after a tunnel : Thom Y. ::
    5. Re:credit cards have a feature by malignant_minded · · Score: 1

      ^ mod up. This is also why blocking country codes using .htaccess or other web filtering is pointless. Many US people proxied around this when torrentspy blocked US connections and I'm sure people from China or other countries on average are much more familiar with how to get around these things for their own safety.

      mm

    6. Re:credit cards have a feature by OwMyBrain · · Score: 1

      I actually discovered that Facebook has something like this. I was in Romania for work last year, and when I tried to log into Facebook from there it said that I was accessing from an "unkown location". It then showed me pictures of my friends and required me to correctly name them before giving me access to my account. Privacy concerns aside, that's still a pretty interesting security policy!

      And yes, I'll turn in my geek card for admitting on /. that I have a Facebook account.

    7. Re:credit cards have a feature by Anonymous Coward · · Score: 0

      How about an "ask me more questions if I am trying to log in from somewhere outside my usual pattern," option, or, like credit card companies do, a "no transactions whatsoever from certain regions known for fraud unless pre-authorized by the user" option?

  18. google in my pants by Anonymous Coward · · Score: 0

    I have google in my pants.

  19. Desperate people do desperate things by currently_awake · · Score: 3, Informative

    The world is currently in the early stages of a great depression. The huge increase in computer crime and the revolts in arab countries are just symptoms of that.

    1. Re:Desperate people do desperate things by Anonymous Coward · · Score: 0

      The revolts in the Arab countries have been held on the back burner for years. You need oil to mobilize an army, and an organized Middle East has the capacity to leverage their resource and emerge dominant, should a Big War break out. A divided Middle East can be more easily controlled and consumed; that's why this is happening now. Now that China's upgraded/built their military industrial complex, there are fewer global economic hindrances to the possibility, it's time to get one's energy reserves up to speed.

    2. Re:Desperate people do desperate things by uofitorn · · Score: 0

      Right. And The World Is Going To End On May 21, 2011. Oh wait, that passed. And nothing happened.

      --
      "What kind of music do pirates listen to?" -Paul Maud'dib
      "Yeeeaaarrrrr n' Bee!!" -Stilgar, Leader of Sietch Tabr
    3. Re:Desperate people do desperate things by MBGMorden · · Score: 1

      I think there's a big difference in between saying "An guy is going to come on a cloud on a specific date and the faithful shall float off into the sky." and "The economy and world stability are in bad shape and some bad things are likely to happen in the near future.".

      --
      "People who think they know everything are very annoying to those of us who do."-Mark Twain
    4. Re:Desperate people do desperate things by xyphor · · Score: 2

      Right. And The World Is Going To End On May 21, 2011. Oh wait, that passed. And nothing happened.

      If I had mod points, I'd go with off-topic or troll, but since I don't I'll say this:

      People who ignore the graveness of the world economy, and especially the USA's, should read up on it. You may think it does not affect you. It will. This isn't a religion or cult, it is mathematics.

  20. damn chinks by larry+bagina · · Score: 0

    They also posted crotch pics of Anthony Wiener. Did you want to see or even think about his cock? Too bad motherfucker, it's all over the news. I think I'm going to throw up.

    --
    Do you even lift?

    These aren't the 'roids you're looking for.

    1. Re:damn chinks by Anonymous Coward · · Score: 0

      The gentleman will sit. ;D

  21. google doing deep packet inspection? by Anonymous Coward · · Score: 0

    Or how does it know what type of transaction certain users accounts are undergoing..
    I'm not sure I want Sergey and Larry to record that I deal with fattyBDSM websites.

  22. Happened to me by Anonymous Coward · · Score: 0

    I got an email from my own gmail account one day last week telling me to buy fake ipads in bad english. logged into my gmail account, whaddya know? The same email had been sent to everyone on my contacts list. I immediately changed my password and sent everyone an apology. A few days later i received a notice from google saying that they suspect something weird is going on because someone has logged into my account from china. I'm like, yeah, i figured that out. They didn't force me to change my password, perhaps because i'd already done it.

    The actual message:

    Dear:
    I have good news for you . Last week.
    I have Order china Quantity:26 Products New Apple 32GB IPAD2
    I have completed bank payment. I have received the product New Apple 32GB
    IPAD2!
    w e b: www.eoaroo.com
    It's amazing! The item is original, brand new and has high quality,
    but it's muc cheaper. I'm pleased to share this good news with you!
    I believe you will find what you want there and have an good experience
    on shopping from them
    Thank you!

  23. Social engineering attack? by Platinum+Dragon · · Score: 1

    Have any details been released? This sounds curiously like an e-mail-based phishing campaign, if the passwords weren't obtained from Gmail's own systems and they weren't exploiting a software vulnerability.

    --

    Someday, you're going to die. Get over it.
  24. How do they know it's from China? by voidness · · Score: 2

    If I were hacker, I wouldn't let you track and always pretend to be an easy target to blame, like China. Only fool can tell exactly where the hacker is.

    --
    Everything comes from nothing.
    1. Re:How do they know it's from China? by Anonymous Coward · · Score: 0

      One of the largest collectors of data on the face of the planet and you wonder how they figured it out? Are you serious?

    2. Re:How do they know it's from China? by Anonymous Coward · · Score: 0

      They have special packet sniffing dogs they release into the tubes.

  25. WW3 by Anonymous Coward · · Score: 0

    First we thought World War 3 would be between NATO and the Warsaw Pact. After the fall of the wall, we thought that it would be war between the US and China (or maybe NATO and the SCO).

    But we now can see the truth: World War 3 will be a war between Google and China.

    My god have mercy on our souls.

    1. Re:WW3 by arisvega · · Score: 1

      There cannot be a WW3 yet, because WW2 has not really finished- just diffused here and there. Like so, more or less.

      Let's hope it is going to be over soon, though I hardly think so- unless a world war is defined as a war between superpowers.

      --
      The three laws of thermodynamics:(1) You can't win. (2) You can't break even. (3) You can't even quit.
  26. Steps to nuclear pwnage by Datamonstar · · Score: 1

    1. Declare "cyber-crime" against the government officially a war crime.
    2. Release details on a not-so-friendly foreign nation's shady online behavior.
    3. Boom???
    4. Profit!!

    --
    The eternal struggle of good vs. evil begins within one's self.
  27. This happened to me by Charliemopps · · Score: 1

    This happened to me but it was about a year ago. I went to check my gmail and it said it had recently been accessed from China. I immediately reset my password on every account that I had everywhere. Not that my passwords are the same, but with access to my gmail the attacker could change or find out my password for almost every site I visit. I have no idea how they figured out my password, I didn't use it elsewhere, it was a made up word, 9 digits long, with 2 numbers and a symbol in it. If they could guess that... well, I just dunno.

    1. Re:This happened to me by Laser+Dan · · Score: 1

      This happened to me but it was about a year ago. I went to check my gmail and it said it had recently been accessed from China. I immediately reset my password on every account that I had everywhere.

      I had heard that gmail started notifying people if the account was accessed from china, so I was interested to see what would happen when I went to china for a conference a few weeks ago.

      Nothing.

      There were no notifications or anything when I got back. I changed my passwords anyway because access to gmail from within china was suspiciously intermittant (monitoring?) while other non-blocked sites were normal.

    2. Re:This happened to me by thoughtsatthemoment · · Score: 1

      I have no idea how they figured out my password,

      They probably tricked Google into sending the password to them through the password reset process. They might've also hacked google people first and those people might have access to internal data. The lesson is, if you host your data on someone else's site, password strength is just one small factcor in securing your data.

    3. Re:This happened to me by KiloByte · · Score: 1

      Even if they added such notifications, it is so trivial for the bad guys to connect from IPs from any country they want. As a private person, there are many proxies you can use -- and if you have a botnet, you have millions of those on your own. And for a good portion of these attacks, even just a single proxy would be enough.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    4. Re:This happened to me by satuon · · Score: 1

      When you're resetting the password, you have to provide it, and then give the new password. At no point would Google send you the original password.

    5. Re:This happened to me by thoughtsatthemoment · · Score: 1

      You are right about that. I meant to say the hacker could change your password of his/her choosing.

    6. Re:This happened to me by Anonymous Coward · · Score: 0

      This is why Google's added in the two-factor authentication. In theory the only way they can get by that is hijacking your computer (which already has the cookie and the IP address you authenticated) or your phone.

  28. They need advice, not security: Don't use webmail! by guanxi · · Score: 1

    These people need professional advice, or common sense: Don't store highly valuable (i.e., dangerous to people's lives), confidential information on a free public webmail service!

    Really, how hard is that to figure out? How many very well-publicized successful attacks has Google experienced, and they still haven't figured it out?

  29. Two factor authentication by shmurfect · · Score: 1

    Do it!

    1. Re:Two factor authentication by MBGMorden · · Score: 1

      I would if it didn't involve a cell-phone. My cell phone battery dies far too frequently to rely on it. Honestly, if Google let me buy one of the key-fob authenticators like Blizzard sells I'd attach one of those, as the battery lasts plenty long enough.

      --
      "People who think they know everything are very annoying to those of us who do."-Mark Twain
    2. Re:Two factor authentication by satuon · · Score: 1

      I wish there could be an opt-in for having two passwords - one for regular sign-in, and one which you could use to reset your ordinary password in case it's compromised. The second password would never be used unless your first password is compromised, so it can't be intercepted. If it's complex enough that it can't be simply guessed, then I don't think you need any more security than that.

    3. Re:Two factor authentication by Kamiza+Ikioi · · Score: 1

      It let's you print off backup verification codes in case you lose your phone or the battery dies which you can put in your wallet, safety deposit box, or caved in mine shaft. Also, you can authorize a computer/ip for up to 30 days. So, as long as your phone is good at least once every 30 days, you'll be fine.

      --
      I8-D
  30. Since it has to be said... by Anonymous Coward · · Score: 0

    Who Wanta some Wang!!!?!!?!?!!?!

  31. Why Gmail by He+who+knows · · Score: 1

    why do chinese political aktivists use gmail there are far more secure email systems they can use and why would miltiary and political officials use it when they have acces to government email systems except when they dont want their emails to be read and archived for the public intrest. Also why is it only Gmail that keeps on getting attacked by the chinese are they the only ones who mention it?

    1. Re:Why Gmail by recrudescence · · Score: 1

      I've witnessed hacked hotmail accounts sending spam to their contacts regarding chinese electronics shops for years now. Maybe Gmail just cares enough to point out it's a problem.

  32. your mailman is reading your mail by Anonymous Coward · · Score: 0

    So google is reading people's email, in order to warn people that the Chinese is trying to read their email?

    I like to politely suggest google to fuck off.

  33. Re:They need advice, not security: Don't use webma by Anonymous Coward · · Score: 0

    These are the same people responsible for the war on drugs, and the war on terror. Yeah, we're gonna have a war on an idea.

    Thoughtcrime.

  34. I doubt China is going to let this go out of hand by Danny0109 · · Score: 1

    Look at China's attitude towards everything going on in the world.
    The only thing China is concerned about is their own stability and economic growth.
    They didn't openly pick a side in the war on "terrorism".
    No reaction to the conflict in Libiya, or any other conflict going on in the world.
    Their only reaction was to shorten the leash on their own people. (I know because I live in Beijing).

    China wants nothing to stand in the way of their growth.
    They used to be North-koreas only ally, they still are. But they are now backing away from that as well. Asking Kim Jong ill to stop the nuclear projects.
    But still being friendly to North Korea, to not anger any side.

    I don't think they will risk foreign relationships by hacking people like this. Only if they feel it is justifiable.

  35. ICBMs by Anonymous Coward · · Score: 0

    ICMBs, or it didn't happen!

  36. Really? by yoshi_mon · · Score: 1

    Is anyone really surprised by this? I don't mean to cast aspersions on everyone in China but dammit if they don't have a huge right wing group of people who are hell bent on enforcing totalitarianism on not only themselves but the world at large.

    And the kicker is that we have had our own group of people who viewed 1984 as a manual rather than a cautionary tail working since the 60's.

    I'm sorry but for everyone that view the right wing slide as OK you are so wrong. So very wrong.

    --

    Really, I know what I'm doing...Ohhhh, look at the shiny buttons!
    1. Re:Really? by Anonymous Coward · · Score: 0

      And the kicker is that we have had our own group of people who viewed 1984 as a manual rather than a cautionary tail working since the 60's.

      Yes, they're called "progressives" and "Democrats".

    2. Re:Really? by Anonymous Coward · · Score: 0

      China ... a huge right wing group of people who are hell bent on enforcing totalitarianism

      Shitstorm in 3... 2... 1...

  37. Revolting arabs by Anonymous Coward · · Score: 0

    I noticed the revolting arabs too.

  38. Re:They need advice, not security: Don't use webma by Anonymous Coward · · Score: 0

    Err, one? http://googleblog.blogspot.com/2010/01/new-approach-to-china.html After that, gmail gained 2-factor authentication (not necessarily because of it). I honestly don't know if other popular webmail services have that, they might. Do other webmail services use https by default?

    The alternative is to use the private webmail service that you wrote in-house that has had no real security testing and rely on security through obscurity. Or were you suggesting we use the paid-for version of the exact same webmail service that everyone can get for free? If you're stupid enough to fall for a phishing scam, then you'll do so no matter what it is. "Oh, but this email I got in gmail on my mac totally looked like I was running in Lotus Notes on my windows PC, so I was, wasn't I?"

  39. Google technoloy by happinessme · · Score: 0

    Google search technology by relying on software that can simultaneously conduct a series of operations, and only a few moments to complete all operations. The traditional text search engine depends largely on the frequency appears on the page. Google uses PageRank? Technical examination of the entire link structure, and determine which pages are most important.Then hypertext-matching analysis to determine which pages are relevant to the specific search. After considering the overall importance and query-specific relevance after, Google can be the most reliable and most relevant search results first.

  40. I know about this FIRST HAND by masterjere · · Score: 1

    I had a few clients of mine experience this over the last few weeks. It has not been pleasant to say the least! It took me almost 3-4 days to recover the "password and account" on one of the Gmail accounts that had been "flagged" (so to speak) which I thought was RIDICULOUS. I mean if you "live and die" by your email - like I do, 3-4 days would be an ETERNITY. My thoughts anyhow. Nice post!

    --
    The Nerd Blurb - If a Nerd Doesn't Know, No One Knows!
    1. Re:I know about this FIRST HAND by qubezz · · Score: 1

      If the account was logged into from China, it was already Pwnd, it wasn't just "flagged". Getting the account back is a luxury - all the emails could have been wiped and the account deleted after child porn was sent to every contact in the contact list.

  41. Re:They need advice, not security: Don't use webma by Anonymous Coward · · Score: 0

    So, uh, I trust my security to... myself? Instead of someone whose job it is to keep on top of shit like this? Even my work offers webmail with their email addresses.

  42. Restrict access from other countries? by Anonymous Coward · · Score: 0

    When will google include an option to restrict access to your account from (a) your default country (b) any other countries you add to the whitelist?

    So simple, why haven't they done this already?

  43. It happened to my wife too couple of months back by Anonymous Coward · · Score: 0

    A couple of months back I noticed some suspicious activity in my wife's gmail account. I do not remember the exact details; it is possible that I received a mail from her account that did not make sense. When I checked the last account activity for her account, I was surprised to find that one of the IP addresses was from China. I did a reverse whois lookup and I could find the domain name, location and owner of the domain. It was decidedly from China.

    We are Indians, have nothing personal to do with anything Chinese, the password was non-trivial, the machine runs genuine OS and has up-to-date virus protection. I have no idea how the password got stolen. My wife is not computer savvy, but I do not think she would ever give away her password. It must have been a brute-force attack.

    Unlike democracies where the governance is amorphous by nature, China, given its Communist oligarchy, acts as a single entity. I have no doubt that the attack can be directly attributed to the Chinese Government. But why was it carried out against my wife's account? It is as disturbing as it is frightening.

  44. 2-Factor Auth probably would have stopped this by davide+marney · · Score: 1

    After harvesting your password, they would then try to change your forwarding and delegation settings. Since this would be done from their machine, they'd face a 2-factor challenge prompt from gmail which they could not meet, unless they had also stolen your phone.

    --
    "We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
  45. 2 Step Authentication by Kamiza+Ikioi · · Score: 3, Informative

    I use Lastpass (which got hacked recently, but my LastPass crypto password was pretty secure). I also use the Google 2 Step Authentication. Once Facebok implements this as well, I will switch immediately. I log in to most sites with either Google or Facebook. I prefer Google, because it's usually just confirming the email, whereas apps that log in to Facebook want access to data, my wall, my friends, etc. That's as stupid, imo, as an app or site asking, "Login with Google, and give us permission to read your email and send email as you."

    What many people don't know is that Google has some privacy features built in if you know where to look. At the bottom of the page it says something like:

    Last account activity: 4 minutes ago at this IP (127.0.0.1). Details

    Click Details and you'll see:

    This account does not seem to be open in any other location. However, there may be sessions that have not been signed out.

    Browser * United States (NY) (127.0.0.1) 5:45 am (0 minutes ago)
    Browser United States (NY) (127.0.0.1) 5:39 am (5 minutes ago)
    Mobile United States (NY) (127.0.0.1) 4:03 am (1.5 hours ago)
    Mobile United States (CA) (127.0.0.2) 6:19 pm (11 hours ago)
    Browser United States (NY) (127.0.0.1) Jun 1 (18 hours ago)
    Mobile United States (NY) (127.0.0.3) Jun 1 (20 hours ago)

    Now, unless you were in CA recently (or have a proxy), this shows that someone hacked your account 11 hours ago from California.

    Click the "Sign out all other sessions" button, then go change your password ASAP and enable 2 Step Authentication if you haven't already.

    --
    I8-D
    1. Re:2 Step Authentication by DJCater · · Score: 1

      I also use the Google 2 Step Authentication. Once Facebok implements this as well, I will switch immediately.

      http://tech.slashdot.org/story/11/05/13/0451222/Facebook-Adds-Two-Factor-Authentication

      --
      Sig Appended to the end of comments you post. 120 chars.
    2. Re:2 Step Authentication by Anonymous Coward · · Score: 0

      Facebook already has a form of 2 factor, called Login Approvals. You should be able to use it right now!

  46. Re:They need advice, not security: Don't use webma by LordSnooty · · Score: 1

    These people need professional advice, or common sense: Don't store highly valuable (i.e., dangerous to people's lives), confidential information on a free public webmail service!

    What evidence is there that the victims stored such information on public servers? A personal account with no work mails could still give enough info to compromise accounts elsewhere.

  47. Researcher says it was expected by michelcannu · · Score: 1

    BitDefender researcher says this is exactly what he was expecting: more and more companies that keep large amounts of personal/confidential/private data being attacked.
    "We believe that fraudsters are corroborating all these information (corporate hacks or leaks), malicious mobile and social network apps into creating profiles of people everywhere in the world, with the purpose of creating better social engineered attacks, and everybody is a possible victim." says Catalin Cosoi from the Online Threats Lab."
    And also: "Monitoring a political personality's email (especially a personal one) can lead to a really nice profit for an attacker, no matter if he is just a hacker or a bigger organization is involved. Besides personal information, monitoring the private conversations can lead to blackmail and extortion and/or manipulation of the individual into performing different actions."

  48. Beijing Bob by Kamiza+Ikioi · · Score: 1

    "Blaming these misdeeds on China is unacceptable," Chinese foreign ministry spokesman Hong Lei told a news briefing in Beijing, according to The Telegraph.

    "Hacking is an international problem and China is also a victim. The claims of so-called Chinese state support for hacking are completely fictitious and have ulterior motives."

    Here is a picture of the spokesman.

    --
    I8-D
  49. mod parent up by circletimessquare · · Score: 1

    i hate facebook, but i'll be the first to agree with you that facebook deserves praise and admiration for initiating this genius account policy. good job facebook

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  50. How Google uncovers Chinese government plot by Anonymous Coward · · Score: 0

    Google: "We discovered a plot to hack users' accounts originating from China."
    Chinese government: "We deny your claims that the Chinese government is trying to hack into Gmail accounts!"
    Google: "We never said it was the government--oh SNAP!"

  51. Linkedin teaching bad habits by leonbloy · · Score: 1
    Some days ago I tried to login in http://www.linkedin.com/ , using my gmail address as my id. I typed my linkedin password (as I remembered it) and an error appeared with this message:

    "Invalid username and/or password. Please enter your email password, not your LinkedIn account password"

    You can try that yourself, using any dummy email address.
    I saved a screenshot here.

    (notice that it's not even a secure -https- page!)

    Ok, I said to my myself, it seems I must enter my google password... I entered it, press "continue"... and two seconds later I though:

    "Wait a moment... What...? What I have done?? How can linkedin ask me to sent to THEM my Google password ? Are they nuts? Am I nuts?"

    I immediately went to my Google account and changed my password, just in case. But I still can't understand it.

  52. It doesnt seem to just be China... by Anonymous Coward · · Score: 0

    I have several gmail accounts, a couple I never check so I started logging into them to see and sure enough one of them had the alert from google and looks like Turkey Poland and Serbia all got a little action and sent e-mail messages each with single hyperlinks to what seems random people in that accounts contact list. fortunately everyone except one person no longer has/uses the addresses stored there so they all got bounced back.

    Recent activity:
    Access Type [ ? ]
    (Browser, mobile, POP3, etc.) Location (IP address) [ ? ] Date/Time
    (Displayed in your time zone)
    Browser * United States () () *:** am (0 minutes ago)
    Mobile Serbia (79.175.81.24) May 28 (5 days ago)
    Mobile Poland (89.73.249.63) May 13
    Mobile Turkey (78.165.210.9) May 13
    Alert preference: Show an alert for unusual activity. change

  53. China Password Theft, Collection by Anonymous Coward · · Score: 0

    This is pretty close to an act of war. If the U. S. were not so utterly deeply indebted to, dependent upon, and subservient to China, Saudi Arabia, etc., we could and would take action against this kind of attacks, but our current government won't do anything but empty protests because we're afraid to upset them.

  54. Re:They need advice, not security: Don't use webma by guanxi · · Score: 1

    I mean, don't use any webmail at all. Use your own local mail server.

  55. Re:They need advice, not security: Don't use webma by guanxi · · Score: 1

    So, uh, I trust my security to... myself? Instead of someone whose job it is to keep on top of shit like this? Even my work offers webmail with their email addresses.

    I think that is a valid issue (though I'm not sure what your workplace has to do with it, unless you work with top secret data). But I think it's overridden by the fact that Google and GMail are huge targets for attackers; that their service, by design, makes the confidential data accessible from any computer in the world via a web browser; that thousands of Google employees and contractors (I'm guessing at the number) have access to the data and/or physical access to the servers; and that you are putting life-and-death information in the hands of an outside company (Google).

    No security consultant would recommend that design for highly valuable confidential data. That's not how the military or NSA stores its most valuable data.

    They need private mail servers, with proxies and firewalls between the servers and the public Internet (and attackers), with proper security including minimized access, even for authorized users.

  56. Weiner by GWBasic · · Score: 1

    Let me guess? Weiner had his password stolen, and a private photo was leaked to twitter?

    --
    No, I will not work for your startup