Slashdot Mirror
Google Uncovers China-Based Password Collection Campaign
D H NG writes "Google announced that it recently uncovered a campaign to collect users' passwords. The campaign, apparently originating from China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior US government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists. Google said it detected and has disrupted this campaign and has notified victims and secured their accounts, as well as notified the relevant government authorities."
it isn't a data breach, Google has uncovered a campaign to steal passwords. Well done Google.
My wife's Gmail account got caught up in this! Last weekend I received some spam from _her_ gmail account. We immediately logged in and Google said that it had detected suspicious behavior and made her reset her password. It then showed us the connection log... and everything looked normal except one particular connection: FROM CHINA!
We were pissed.... but it doesn't appear that anything else was compromised (she didn't have anything sensitive in her Gmail account luckily).
Things really seem to be escalating on the 'net lately... from PS Network to Lockheed and now to Gmail. I really have to wonder if China is _actively_ participating at this point...
where the hell have you been?
"In its first formal cyber strategy, the Pentagon has concluded that computer sabotage by another country could constitute an act of war"
http://www.msnbc.msn.com/id/43224451/ns/us_news-security/t/sources-us-decides-cyber-attack-can-be-act-war/
No, just a tighter grip on "Anonymous", whoever the fuck that is.
Grammar nazis are to this community what excrements are to gold.
Password
passw0rd
123456
hunter2
I eat only the real part of complex carbohydrates.
I think this falls under that lovely "espionage" blanket. You know the "other guys" are doing it, they know that you are doing it. But everyone pretends like it isn't going on and no-one bats an eyelid in public. However, behind closed doors, this sort of action is driving yet another wedge into the relationship - but at the same time also driving more funding into your own budgets for doing a similar thing to the "other guys" yet again.
My guess is that the fallout of this will be that there will be a project launched with some funny nondescript name that tries to get similar intel on the Chinese. They will likely get wind of it, but be unable to do anything about it as there will never be undeniable proof of the point of origin.
This sort of thing went on for decades (and still does) with the US/Russians, the middle east and just about every European country. It just (mainly) never sees the light of day. The Chinese seem to be getting caught more of late though - which can mean that either they are pretty poor at it compared to the rest (dubious) or their program is a whole heck of a lot bigger and more ambitious than the other players in the game - which I think is much much more likely.
Moved to http://soylentnews.org/. You are invited to join us too!
where they won't let you use your credit card account abroad unless you phone ahead and tell them you will abroad and its ok if they start getting charges from bangkok or antigua
maybe it's time for email providers to do the same: "no logging into my account from foreign ip blocks unless i tell you its ok"
and the default for this protection should be "on". your average user won't take the time to hunt for this menu item and enable it
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The world is currently in the early stages of a great depression. The huge increase in computer crime and the revolts in arab countries are just symptoms of that.
Who said it was the Chinese government?
---- Booth was a patriot ----
If I were hacker, I wouldn't let you track and always pretend to be an easy target to blame, like China. Only fool can tell exactly where the hacker is.
Everything comes from nothing.
There is a far more obvious version of what this means:
West is demonizing China for its population into next cold war opponent, therefore any and all negative news about China in relation to West will be published with reasonably big headlines.
Notably, it's not very different for Chinese either, same seems to be going on on their side as well.
The article says "The officials emphasize, however, that not every attack would lead to retaliation. Such a cyber attack would have to be so serious it would threaten American lives, commerce, infrastructure or worse, and there would have to be indisputable evidence leading to the nation state involved, NBC Pentagon correspondent Jim Miklaszewski said."
What that means in English is something like: If an hostile organization brought down the electric grid, or caused a meltdown in a nuclear plant, or caused airliners to crash, or did something equivalent, then that means that war is an option.
That makes sense IMHO.
"Liberals" (really "not quite evil bastards") have always resisted war on the basis of its inevitable civilian casualties. The US has avoided civilian casualties, even at the cost of missing out on really profitable wars, since the majority of Americans have resisted war's inevitable civilian casualties starting with WWI, but really after WWII: the wars in which many Americans actually saw some civilian casualties.
You, however, have never seen either war or its civilian casualties personally. Before you demand more, go see some. There's plenty in the world, including by American hands.
--
make install -not war
I use Lastpass (which got hacked recently, but my LastPass crypto password was pretty secure). I also use the Google 2 Step Authentication. Once Facebok implements this as well, I will switch immediately. I log in to most sites with either Google or Facebook. I prefer Google, because it's usually just confirming the email, whereas apps that log in to Facebook want access to data, my wall, my friends, etc. That's as stupid, imo, as an app or site asking, "Login with Google, and give us permission to read your email and send email as you."
What many people don't know is that Google has some privacy features built in if you know where to look. At the bottom of the page it says something like:
Last account activity: 4 minutes ago at this IP (127.0.0.1). Details
Click Details and you'll see:
This account does not seem to be open in any other location. However, there may be sessions that have not been signed out.
Browser * United States (NY) (127.0.0.1) 5:45 am (0 minutes ago)
Browser United States (NY) (127.0.0.1) 5:39 am (5 minutes ago)
Mobile United States (NY) (127.0.0.1) 4:03 am (1.5 hours ago)
Mobile United States (CA) (127.0.0.2) 6:19 pm (11 hours ago)
Browser United States (NY) (127.0.0.1) Jun 1 (18 hours ago)
Mobile United States (NY) (127.0.0.3) Jun 1 (20 hours ago)
Now, unless you were in CA recently (or have a proxy), this shows that someone hacked your account 11 hours ago from California.
Click the "Sign out all other sessions" button, then go change your password ASAP and enable 2 Step Authentication if you haven't already.
I8-D