Escalating Gmail/Spamming Attacks 139
We've been getting submissions about an uptick in compromised Gmail accounts in the last few days, but nothing that could be substantiated. Robert McMillan did a bit of digging and now reports in PC World that "Google is investigating a growing number of reports that hackers are breaking into legitimate Gmail accounts and then using them to send spam messages. The problem started about a week ago but seems to have escalated over the past few days. ... [I]n forum posts, Gmail users note that the hackers appear to be sending spam via Gmail's mobile interface — which gives mobile-phone users a way to check their Gmail accounts — and wonder if there may be a bug in the mobile interface that is allowing criminals to send the spam. ... Google says there's no Gmail bug. ... 'Spammers may sometimes use a mobile interface to access accounts they have already compromised because it's simpler for bots to use this method at large scale.'" Here's how to tell if your Gmail account has been accessed by bad guys, and what to do about it.
Recent Security Theft at Google (Score:5, Interesting)
This happened to my significant other (Score:5, Interesting)
Re: (Score:2, Funny)
She had a pathetic password, so I wasn't too surprised.
Was it "penis" or "hunter2"?
Re:This happened to my significant other (Score:5, Funny)
She had a pathetic password, so I wasn't too surprised.
Was it "cravf" or "*******"?
I don't understand your post. It appears to have been garbled on the way in. Can you repost?
Re: (Score:2, Funny)
Re: (Score:1)
Check it out, heres my visa: XXXX-XXXX-XXXX-XXXX
Re: (Score:2)
Password: This_is_slashdot_and_some_people_really_are_that_stupid***
Re: (Score:3, Informative)
Here's my password: Nicefuckentryyoustupidassholethisisslashdothowstupiddoyouthinkweare?
Which actually means: "I have never read bash.org [bash.org]."
Re: (Score:2)
Re: (Score:2, Funny)
The slashdot feature is really cool, this is why I see:
orly?
Here's my password: Whoooooooooooooooooooooooooooooooooooosssssssssshhhhhhhhhhhh!!!!!!!!!!!
Re: (Score:2)
In retrospect, hitting the submit button was a poor decision.
It always is my friend... it always is.
Re: (Score:2)
Nah, post without caring. THis is the Internet and it's okay to be wrong. I already did.
actual problem is using the same password (Score:5, Interesting)
Apparently this happened to someone I know. She created a third-party web account (in her case, I think it's LinkedIn), entered her Gmail address, and used the same Gmail password for that account. I had to remind everyone I know that some websites *always* check to see if they can log into your e-mail with the password you supplied. Or it could be that the third-party account database was compromised. Either way, always use a different password. A lot of websites apparently store password in clear text, or in non-salted SHA1 or MD5 form so you can easily perform an inverse lookup [sha1-lookup.com].
After she changed her password, her account is clean again.
Re: (Score:2)
I had to remind everyone I know that some websites *always* check to see if they can log into your e-mail with the password you supplied.
[citation needed]
Re: (Score:2)
Clearly not all websites do that, it's an exaggeration. It's a damned useful one though, one should always assume it is the case.
Re: (Score:3, Interesting)
Which is why I use Password Composer [xs4all.nl]
Lets say my 'password' (mor of a salt) is hunter2.
For google.com my password is: 9594ab73
For facebook.com my password is: e288ff0e
You don't even need to use that form, sha1 or md5 (or even doubled up) should work fine.
md5(sha1("slashdot.org"+"hunter2")) should provide an adequately uncrackable password.
Re: (Score:2)
Re: (Score:2)
They have a point (Score:2, Interesting)
It makes sense bots would use the mobile interface. Its lighter so it uses less bandwidth, so more spam-per-bots == profit.
Re: (Score:3, Interesting)
Not to mention the security on a mobile device is about as strong as a wet paper bag, I wouldn't be surprised if they managed to infect mobile devices instead of just using the mobile interface.
Re: (Score:3, Informative)
There's been quite a bit of talk on this lately. See for instance this post at Sophos (not exactly a no-name company) http://www.sophos.com/blogs/sophoslabs/?p=1156 [sophos.com]
Re: (Score:3, Interesting)
ah, but you did notice that Sophos is in the business of selling anti-virus software? It should not come as a surprise then that they tell you you need it on your phone. They'd try to convince you you need anti-virus on your washing machine and your microwave.
Re: (Score:2)
Got mine too (Score:5, Informative)
And I had a pretty secure password. Now it is much more secure.
I got lucky, noticed the odd activity (from Texas no less) and jumped all over fixing it.
Re: (Score:2)
Re:Got mine too (Score:5, Funny)
new pass: Eyjafjallajökull
Re: (Score:3, Funny)
Thank you, i'm here all week!
Re: (Score:2)
Re: (Score:2)
Yeah but what's weird for me is seeing the ATT traveling through one of the ATT-partner networks coming out of PA. So 99% of my gmail access tends to be from 2 local IP addresses, but the iPhone shows up as a PA geo-IP.
Go figure.
Point is, people may not realize that their phone is showing up as coming from somewhere not-local and they'll think they've been had. Well, hopefully this group is smarter than that.
Re: (Score:2)
I know several people whose mobile phone access shows up as coming from Texas, though they don't live in Texas. Google just uses someone's geolocation database, but carriers like AT&T don't have to follow that... for a while my friend thought his account had been hacked as well, but it was repeatable - clear the list of sessions, then connect from his phone, and a Texas entry would show up.
Have you checked whether that was the case for you?
Re: (Score:2)
Yep, and nope, it wasn't the phone connection. The phone connects via IMAP, and its connections all source from my home state (when I am not traveling). The TX connections were POP3 (I do not ever use POP3) and had odd times of access.
my only sin was that I haven't cycled the gmail password in a couple of years (lazy). Now it is a randomly generated 20 character password from KeePass. Took me 10 minutes to memorize it.
Re: (Score:2)
Well, that isn't my only sin, but the only related one... :-)
Re: (Score:1)
Re:Got mine too (Score:5, Interesting)
This type of thing happened to a friend of mine. At 1 in the morning I got an e-mail from him advertising Viagra. After some decent analysis we concluded that his illegal copy of Windows 7 was probably to blame. My belief is that the ISO came with a rootkit gratis.
I'm writing this half as a "me-too" and half as a note of caution ... illegal operating system downloads are probably the easiest way someone can infect you. If you're running under such a configuration, I'd re-evaluate the cost ... or consider a better option [ubuntu.com] :)
Re: (Score:2)
Very true. (Score:5, Funny)
Re: (Score:2)
I can verify this trend. Several of my aunts have switched to Gmail lately, decreasing the spam I get from Hotmail/Yahoo and being replaced by Gmail-based spam.
I have turned to a whitelist policy when it comes to Gmail. All @gmail.com e-mails go directly into the trash unless I have witelisted that particular address...
Re: (Score:2)
Doesn't help in this case. I've had two friends get compromised in the last week. In both cases, since I was in their address book, I got V1agra spam from their accounts. The messages were from legitimate white listed Gmail addresses sent from legitimate Google servers.
Re: (Score:2)
Doesn't help in this case. I've had two friends get compromised in the last week. In both cases, since I was in their address book, I got V1agra spam from their accounts. The messages were from legitimate white listed Gmail addresses sent from legitimate Google servers.
Duh! Of course... And I even read TFA! Guess I forgot to connect my eyes to my brain.
Re: (Score:2)
You'd think that, being a
Breaking in? (Score:3, Interesting)
Re: (Score:1, Informative)
breaking, or more accurately to break and enter does not actually refer to the process of causing damage to enter a property. It is simply the act of breaking or passing through the defined boundary of a house or property you are not supposed to be in. As such you can break and enter a building by walking through an open door.
Re: (Score:2)
And once again, Slashdot blames the victim.
Re: (Score:2)
Re: (Score:1, Flamebait)
Re: (Score:3)
Having a weak password is more like having a dinky combination lock on your front door, not like leaving it open. If someone comes up to your house and cracks your $2.98 Walmart combo lock, they're still robbing you.
Also, how can you call someone who's ID is well over 600,000 lower than yours a junior? It defies all reason! By common sense, DerekLyons is 3 times your age.
Re: (Score:2)
That would probably depend on your current residence. In the United States it *is* breaking and entering if you enter another person's home without permission whether your door is locked or not.
Your original analogy is shortsighted. Having a simple password is more akin to having an easily copied house key and not permission to enter a domicile. Your condescending belligerent attitude (relax junior) betrays your lack of intelligence and ability to think critically.
Re: (Score:2)
Re: (Score:2)
I didn't Google it and I'm not a lawyer or work with law enforcement. I had this explained to me by the police after a robbery. If the intent is theft you can be charged with burglary; if not, at the least you can be charged with criminal trespass. It may be more complicated, or not, but the bottom line is it's not okay to enter another person's private residence (and it's not limited to private residence) without permission. Blaming someone for having an easily copied key or weak security doesn't and s
Re: (Score:2)
And as your own cited sources point out, if a person uses no force to enter, and no unlawful activity is intended, it's *not* B&E.
And it certainly *is* okay to enter a persons private residence without permission (as long as zero force is used and your permission has not been revoked by the owner). For example,
Re: (Score:1)
The New York Times reported Monday that Google's centralized login system, code-named Gaia, was compromised by hackers in late December.
Re: (Score:2, Insightful)
The problem with that analogy is that the vast majority of door locks have complexity equivalent to 'password123'.
Re: (Score:3, Informative)
Is that a reference to the antique method of springs and tumblers which can be easily displaced with a pick and a tensioner, or the fact that most residential locks have up to 6 pins cut to one of ten depths (10^6 combinations or less) or the fact that a bump key will open almost any lock that you may encounter?
Re: (Score:3, Interesting)
My other gmail account just got yoinked and I'm in the process of recovering it. This account is just fine atleast right now. I use alphanumerics mixed with upper and lower case. And a unique pass on each account. Something...odd is going on.
Re:Breaking in? (Score:5, Interesting)
Re: (Score:1)
Re: (Score:2)
That sounds like a keylogger would be the only (client-side) way to have compromised your password. Do you happen to use flashblock or similar to prevent flash running in the background? AFAIK flash advertisements are the main way flash keyloggers work, so I assume flashblock is a pretty effective way to remove that risk.
Re: (Score:2)
Re: (Score:2)
But this is definitely a major break-in - I didn't have any spam posted from my account, but I did get password reset requests from Twitter and Facebook. By the time those had occurred, I had already changed the passwords to all involved accounts.
Where are your filters now? (Score:5, Interesting)
Maybe it is time to start thinking about how to actually address the spamming problem now, instead of just dealing with the spam itself. Your filters aren't going to help you forever...
Re: (Score:3, Insightful)
Except that many did, and those solutions were dismissed because they won't work.
Re: (Score:3, Interesting)
Maybe it is time to start thinking about how to actually address the spamming problem now, instead of just dealing with the spam itself.
Except that many did, and those solutions were dismissed because they won't work.
First, your assertion of "they won't work" is false. Groups have managed to disconnect botnets from their controllers during spam floods, and that does effectively stop spam from being sent. It is far more effective than any filter could ever hope to be at reducing spam-driven network traffic. And when people start pooling their resources to take the proper steps to remove spammers from their profit motives, we will see the real difference.
And second, are you actually trying to either defend scaling u
Re: (Score:2)
Except that it has been shown to be irrelevant on a long-term basis;
Re: (Score:2)
First, your assertion of "they won't work" is false. Groups have managed to disconnect botnets from their controllers during spam floods, and that does effectively stop spam from being sent. It is far more effective than any filter could ever hope to be at reducing spam-driven network traffic. And when people start pooling their resources to take the proper steps to remove spammers from their profit motives, we will see the real difference.
Except that it has been shown to be irrelevant on a long-term basis; it's no less of a cat-and-mouse game than filtering.
That is untrue. When you stop a botnet from sending spam, you making spamming slightly more expensive for the spammer. And when you take more direct proactive economic steps against spam you will do even more to hurt the spammer's bottom line. The only way to get spammers to stop sending spam is to drive them out economically, because the only reason they do it is to make money.
So no, going after the botnets - and eventually the profit motive itself - is not a cat-and-mouse game. Going for the profit
Re: (Score:2)
I never fucking said that! What I said it's filtering is indispensable *until* another solution works, and that people *are* coming up with solutions, unlike what you said ("instead of just dealing with the spam itself.")
Re: (Score:2)
Groups have managed to disconnect botnets from their controllers during spam floods, and that does effectively stop spam from being sent.
Your post advocates a
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect
Re: (Score:2)
Can your filters respond to an avalanche of spam from an increasing number of throw-away email accounts when it is relayed by legitimate email servers? Can your filters handle spam email that changes body, subject, header, relay, and source address? How much time are you putting into these filtering configurations to do that?
Mine can. I give every contact a different @myDomain.com address. One gets compromised, I disable that address and give the contact a new one.
Bonus: I know who compromised my address to the spammers.
This happened to a family member . . . (Score:3, Interesting)
And I reviewed her security protocols. She has a Mac and uses Firefox or Chrome exclusively. This leaves out attacks based on Microsoft security holes (un-updated Microsoft installations, etc).
She visits sites while still logged into Google. I wonder if there is some way to do that. The only other thing I can think is that she used her email address to create an account at a compromised or fake website and used that email account's password as the account password.
Nevertheless, I can confirm the unauthorized access was through the mobile interface. In fact, the access point was Portugal.
The only other thing I can think of is somehow her use of Google's software for accessing her email or syncing her calendar through her iPod Touch might have been compromised. Then again, she only connects to the network here. (Unless she left it roaming.)
On a side note, GMail, by default, does not require an SSL connection. I wonder if anyone who was hacked had their settings set to require that.
Anyway, the point is that Google's assertions that accounts are compromised is bogus. If my family member's account was compromised, it was because of an insecurity in Gmail. Either browsing while logged into Google, or by not requiring an SSL connection to access Gmail, I don't know -- but I feel confident the insecurity was not the typical social engineering or browser/chat hole.
As some have said above -- Gotta love the Cloud!
I think I'll keep predominantly to old-fashioned email. After all, Google went and picked a fight with the Chinese. Maybe it isn't state-sponsored hacking, but that doesn't mean it's not Chinese hacking.
Re: (Score:3, Informative)
On a side note, GMail, by default, does not require an SSL connection. I wonder if anyone who was hacked had their settings set to require that.
This used to be the case, but they've changed now. http://www.wired.com/threatlevel/2010/01/google-turns-on-gmail-encryption-to-protect-wi-fi-users/ [wired.com]
Re: (Score:2)
Re: (Score:2)
I have posted about it previously, but there are very strong indications that googles account system suffers from one or more bugs. There have been dozens of reports of users who have accidentally been logged into other users accounts. It is definitely possible that crackers and spammers have figured out how to exploit the security holes by now.
See http://answers.yahoo.com/question/index?qid=20100321162016AAZnwCC [yahoo.com], http://talk.maemo.org/showthread.php?t=48382 [maemo.org], http://www.google.pl/support/forum/p/gmail/threa [google.pl]
Happened to one my accounts as well (Score:4, Interesting)
Re: (Score:2)
Mobile Algeria (41.103.164.236) Apr 14 (6 days ago)
Mobile Serbia (94.189.168.76) Apr 14 (6 days ago)
Mobile Saudi Arabia (77.64.47.176) Apr 9
Mobile United States (TX) (208.54.171.181) Apr 7
From people describing that they see Texas and Serbia activity. It sounds almost like it's all the same "entity"?
Re:Happened to one my accounts as well (Score:4, Informative)
GMail shows a captcha after a few tries.
Almost, but not really (Score:1)
As soon as I read this I went to my account, and saw a lot of mobile activity from California. I freaked! Then I had a thought - so I went to my WM6 cell phone and had it synchronize with gmail. Aha! I knew it - my cell phone is really in California. (And some mobile activity may be legit, and the state may be wrong, as I'm in Texas, T-Mobile must route it out there.)
Funny (Score:2, Interesting)
Re: (Score:2)
Probably.
Happened to me last week (Score:4, Informative)
Yeah this happened to me last week and had a secure 8 character password made up of random letters and numbers. I'm not sure if it was a hack or maybe I just got sloppy and used that same password on some other site were I also provided my e-mail and they somehow got it that way. I'm not sure if I had the SSL setting enabled because when I went to set it, neither the http or https radio button was set. I had also just written up an automated perl server monitoring script a few days before that would use the account to send an automated message (via SSL) but that could have been coincidental, who knows? All they did was send Viagra spam to all the contacts. I immediately changed the password and also made the security question/answer nonsense since I can remember my damn password. Only check the mail from my Macbook or iPhone.
GMail's Security is Crap (Score:5, Interesting)
My friend had her gmail hacked recently. The hackers locked her out, changed her private info, and then sent this email to every single one of her contacts:
"i'm sorry for this odd request because it might get to you too urgent but it's because of the situation of things right now,We are stuck in london right now,we came down here on vacation
The hackers then sat logged-in to her account pretending to e her, and chatted with her contacts via gmail chat begging them to Western Union cash ASAP.
Over the course of many hours, we tried to regain control of the account via Google's automated system, but we were repeatedly denied. There was no way to contact an actual human being at Google. After a day of pleading on Google forums, control was finally returned to the accounts rightful owner, but the damage was already done.
Google encourages people to trust gmail with their most sensitive personal data. I think their negligence and lack of response regarding their own products' defects borders on criminal.
Re:GMail's Security is Crap (Score:4, Insightful)
Yet 30 seconds on the phone if you were a Google Apps customer and - BANG! - that email would be back under your control. I guess it's the "you get what you pay for" thing.
And yes, I do recognise that your personal info and email messages to datamine is in fact worth something (and therefore a form of payment) but I guess Google doesn't.
Re: (Score:2)
Re: (Score:1)
I am, however, delighted to learn that none of my friends would possibly fall for such a scam were my account to be hacked. This is thanks to my past email communications with them; henceforth, I shall cite my ridiculous pedantry as a security measure.
Recovery Options Slim to None (Score:4, Interesting)
Re: (Score:3, Insightful)
This is why I don't like having the same cookies/login for multiple sites. I use a Yahoo email for Google Calendar and Google Voice for exactly that reason. But this reminds me to download/archive my calendar. (I know someone who lost their gmail account and there calendar went bye-bye too.)
I wonder if sharing it with another account would insure against that risk?
In my case, I don't put all my eggs in one basket.
Re: (Score:2)
It's happening to quite a few.. (Score:2)
I posted the info last night in the thread about someone stealing google's auth code. I don't think it's a dictionary attack. I think it's related to using the password on other sites. Happend to my wife right after setting up a Nike account. No malware detected. I guess it could be fishing sites.
i got more spam at my non-google account (Score:1)
although i also recently started getting Nigerian offers for my craigslist posts from ppl with gmail accounts..
compromised (Score:3, Interesting)
Re: (Score:1)
/me too (Score:3, Interesting)
happened to me on sunday. and six other friends. 25 people i know since sunday have gotten hit as well.
obnoxiously there's no way to report the incident to google. all the help stuff is self-serve and the "send feedback" link is a closed beta.
i had a 28 character password of numbers, letters (upper and lower case) and punctuation that I only used for gmail, so it's highly doubtful they were able to guess at that.
somehow i feel like this is linked to the theft of their security software
Re: (Score:3, Informative)
obnoxiously there's no way to report the incident to google. all the help stuff is self-serve and the "send feedback" link is a closed beta.
It's irritatingly hard to find, but there is a way to report it. http://mail.google.com/support/bin/answer.py?hl=en&answer=50270 [google.com] My significant other's account got hijacked yesterday and Google did react less than half an hour after we filled out the form.
Re: (Score:1, Interesting)
Instead of starting my own me too I'll just respond to one. I was hit as well. Incidentally, it was on a gmail account I go to paranoid lengths to keep secure. It was on my gmail account I specifically use for my online banking, broker account, etc. I've never sent a single email on it. The password was 20 characters long of random characters, letters, and upper and lower case. The password was not in any way related to any other password I use. Also, I only ever log into this account from an old, tight
Interesting choices in software (Score:2, Interesting)
From the page where Google talks about keeping your account secure....
"We can tell you, though, that trying all of these programs often makes a difference, as does having the latest versions.
* Google Pack - Norton Security Scan, Spyware Doctor
* Kaspersky Free Virus Scan
* Spybot Search and Destroy
* Lavasoft Ad-Aware
* MacScan"
Norton is not part of the Google pack. Be
Keepass And Complex Passwords (Score:2)
I have found that my Google Account password is my most important password. Not only does it have my Gmail since 2004, it also has my Calendar, Voice, Documents, and Checkout. It's pretty freaking terrifying. Interesting question: do I need to split it up amongst different providers? Putting your eggs in one basket is a pretty stupid idea but having everything together is so freaking convenient. Ugh.
Anyway, I use Keepass. I have a 60 character password with symbols, letters, numbers, and the like. That mean
GMail has always had extremely lax security (Score:3, Interesting)
Although this isn't directly related to this particular occurrence, I think Google has some serious security issues to deal with on the entire gmail platform. I am a forum admin, and I find that the vast majority of spammers who sign up for accounts do so with a gmail account. most of these appear to be bots, they are only marginally slowed down by our captcha, so I suspect they have no trouble with google's either. The fact that such a large percentage of the spam comes from accounts set up through gmail tells me that spammers find it to be the easiest email system to break in to with automated tools.
If I had the option I would simply ban all registrations from gmail accounts, it would eliminate the vast majority of our forum spam. Unfortunately though too many of our legitimate users also use gmail accounts.
This is why (Score:2)
happened to my better half (Score:2, Interesting)
she clicked on a link sent by one of her friends, and it asked for her gmail password, which she duly filled in.
Luckily for her, she was online on gmail when the hacker started sending mails and phishing links to her other friends,
and we immediately changed the password, and forced signed out all other sessions [yes, that little feature on gmail recent login details came in handy.]
The account is safe now, and more importantly.. she learned her lesson, not to give away her passwords to any random site.
google has been breached (Score:1)
Investigation on Google forums (Score:2, Informative)
Interesting investigation work on the Google forums:
http://www.google.com/support/forum/p/gmail/thread?tid=77127463d8f40cb6&hl=en
Re: (Score:1)