God damn chinese email hackers

Buttcleft

God damn Chinese assholes hacked into my gmail account.

I dont check my email very often, because this happened on the 15th and I just noticed today, because I couldnt access it, had to reset the password to log in, then saw the big red warning bar at the top saying my account was recently accessed from china.

Looks like they just used it to send out the atypical WoW account harvesting spam, Which is stupid as hell since i dont even play WoW so I have no clue how my account even hit their radar.

My password was strong to begin with, so I dont even know how they managed this, but I've made it even stronger in response.

This is the first time I've ever been violated like this, of course I changed my password, and I guess I have to change the passwords of anything linked to my email, like my forum account, for safety sake.

Is there anything else I need to do? Am I overlooking anything?

L Ron Howard

Change your p/w from another computer.
Scan your hdd for spyruses.
Check your other accounts.
Hell, just go to another computer and change all your online p/w's from there, because who knows what else they've gotten into.

Buttcleft

I noticed news stories from last year that Chinese hackers were using a US mandated back door to get into gmail accounts.

Has that vulnerability been fixed? Could that be how my account got compromised?

Wonder how I even got on their radar.

No i'm not using this an excuse to lower my guard or not to security minded things in the wake of this.

Farout Foolio

I hate to mention it, but with the tenacity of rootkits, you may have to consider drastic solutions.

Buttcleft

Farout Foolio wrote: »

I hate to mention it, but with the tenacity of rootkits, you may have to consider drastic solutions.

thats all been taken care of already.

RadicalTurnip

Also, if you can, change your password every now and then. Big Hypocrite sign here, my gmail has had the same password since I made it.

Just...for those of us less informed...
What are rootkits and what sort of measures may have to be taken?

Crashtard

This actually happened to me a few months back, and for pretty much the same reason (although I had played wow a while back). I nuked from orbit, changed passwords, etc and have been fine since.

Rikushix

@Turnip: A rootkit is software that, while running, actively hides its presence from your computer. It won't show up on task manager as a process, for example.

Gabriel_Pitt

RadicalTurnip wrote: »

Also, if you can, change your password every now and then. Big Hypocrite sign here, my gmail has had the same password since I made it.

There's really no reason to. If something like your e-mail account password is compromised, the hacker is going to use it for whatever it is they want to do. So unless your random password change is on the same day your old one is compromised, and whatever compromised it in the first place is not something that's going to grab your new password too, changing it accomplishes nothing.

Infidel

Gabriel_Pitt wrote: »

RadicalTurnip wrote: »

Also, if you can, change your password every now and then. Big Hypocrite sign here, my gmail has had the same password since I made it.

There's really no reason to. If something like your e-mail account password is compromised, the hacker is going to use it for whatever it is they want to do. So unless your random password change is on the same day your old one is compromised, and whatever compromised it in the first place is not something that's going to grab your new password too, changing it accomplishes nothing.

That is not why you change passwords over time.

You change passwords over time so that you prevent your account being compromised via cracking. Cracking takes time and the idea is by the time they have a working password it is outdated already.

Buttcleft

Infidel wrote: »

Gabriel_Pitt wrote: »

RadicalTurnip wrote: »

Also, if you can, change your password every now and then. Big Hypocrite sign here, my gmail has had the same password since I made it.

There's really no reason to. If something like your e-mail account password is compromised, the hacker is going to use it for whatever it is they want to do. So unless your random password change is on the same day your old one is compromised, and whatever compromised it in the first place is not something that's going to grab your new password too, changing it accomplishes nothing.

That is not why you change passwords over time.

You change passwords over time so that you prevent your account being compromised via cracking. Cracking takes time and the idea is by the time they have a working password it is outdated already.

its more likely they exploit a security hole in the email service or use a keylogger to get it as opposed to old fashioned brute force cracking it.

I have to admit I am freaking out over this a little bit, IP logs say they only accessed my account once, so they probably just used it to drop a mass spam out then went on to the next one.

But that intellectual side does not make my stupid, reactionary, fear driven side feel any better.

L Ron Howard

Depends on the security you have in place.
If you're Blizzard, and have horribly archaic security practices, then you could probably sit there and brute force all day long and eventually get in.

But since it's Google, I'm sure they just keylogged you somehow.

Buttcleft

L Ron Howard wrote: »

Depends on the security you have in place.
If you're Blizzard, and have horribly archaic security practices, then you could probably sit there and brute force all day long and eventually get in.

But since it's Google, I'm sure they just keylogged you somehow.

I Dont see how they could have, I'm extremely security paranoid, and highly cautious.

I mean, anythings possible, sure, but I can not fathom how something could have gotten in.

TetraNitroCubane

Rikushix wrote: »

@Turnip: A rootkit is software that, while running, actively hides its presence from your computer. It won't show up on task manager as a process, for example.

Rootkits can also hide any other programs they want from your system. They typically load early on during boot, sometimes hiding in the Master Boot Record of your computer. Effectively, this means that they can convince Antivirus software that they don't exist, and additionally, that they can sometimes survive reinstallation of the operating system if you don't thoroughly format the disk to rebuild the MBR.

Rootkits are nasty, disgusting stuff. If you've got one, it can be tricky to figure out that it's there, and even harder to remove it without nuking from orbit.

Buttcleft wrote: »

L Ron Howard wrote: »

Depends on the security you have in place.
If you're Blizzard, and have horribly archaic security practices, then you could probably sit there and brute force all day long and eventually get in.

But since it's Google, I'm sure they just keylogged you somehow.

I Dont see how they could have, I'm extremely security paranoid, and highly cautious.

I mean, anythings possible, sure, but I can not fathom how something could have gotten in.

Most of the time people aiming to crack passwords won't sit there online all day spamming the login page. They'll try to get into the server and steal the password database, which they can then attempt to crack at their leisure, trying thousands of passwords per second without hitting the server over and over. This is how Gawker recently got cracked wide open.

Buttcleft, you didn't have an account at Kotaku, or any other Gawker site, did you? If the password was the same as the Gmail account, it might've been compromised that way. Otherwise, the 'once and gone' situation sounds like someone may have just hijacked a session... but given the low usage of the account I'd say it's unlikely that someone hit you with an XSS attack. It's difficult to say where the compromise occurred. I will admit that I'm completely baffled at the number of people who report the same thing, though. People I know who are VERY tight on their security have had their accounts compromised in the same way. It may be something lingering since the Aurora attacks on Google, though Google insists that no user credentials were stolen then.

It's a jarring sensation, and I know it'd make me go crazy not knowing, definitively, why it happened... But chances are that changing your password should be enough for now, since you've done a thorough sweep for malware and your machine is secure.

Buttcleft

All this talk of rootkits is making me want to reformat again to nuke my mbr.

would be nice if someone would come up with a way to detect them easily.

Satsumomo

Strangely, Gmail isn't very secure, this is at least the 3rd person I've read about having their Gmail account compromised. However the other 2 people were active targets, you seem to be a randomly chosen one.

TetraNitroCubane

Buttcleft wrote: »

All this talk of rootkits is making me want to reformat again to nuke my mbr.

would be nice if someone would come up with a way to detect them easily.

There are a few rootkit detectors out there you can try, if you want a bit of peace of mind on the issue. Obviously they're not 100% effective at detection, but they tend to be pretty good. Hitman's the easiest to use, but if you're on a 32-bit system there are more options you can toy with.

I wouldn't get too worked up about it, though. Rootkits are damned scary, for sure, but there's no sense in getting too paranoid about them... A little more than a year ago I was getting some really, really freaky false signs about a rootkit on my machine. Turned out that it was just a Spybot malfunction, but I nuked from orbit because of it. It wasn't a necessary move, and was something of a hassle, since my backups weren't terribly current.

Buttcleft

TetraNitroCubane wrote: »

Buttcleft wrote: »

All this talk of rootkits is making me want to reformat again to nuke my mbr.

would be nice if someone would come up with a way to detect them easily.

There are a few rootkit detectors out there you can try, if you want a bit of peace of mind on the issue. Obviously they're not 100% effective at detection, but they tend to be pretty good. Hitman's the easiest to use, but if you're on a 32-bit system there are more options you can toy with.

I wouldn't get too worked up about it, though. Rootkits are damned scary, for sure, but there's no sense in getting too paranoid about them... A little more than a year ago I was getting some really, really freaky false signs about a rootkit on my machine. Turned out that it was just a Spybot malfunction, but I nuked from orbit because of it. It wasn't a necessary move, and was something of a hassle, since my backups weren't terribly current.

Well I just did my second reformat today to nuke the MBR to settle my paranoia.

If I even had anything on my system to begin with, I still think it had to be something server side but I'm not taking any chances cause its a pain in the ass to do this shit.

Rikushix

Satsumomo wrote: »

Strangely, Gmail isn't very secure, this is at least the 3rd person I've read about having their Gmail account compromised. However the other 2 people were active targets, you seem to be a randomly chosen one.

Count me as the fourth. A few months ago I got an email from Blizzard saying that my WoW account had been suspended for gold selling - which doesn't make any sense because I haven't played WoW in three years - and I stupidly didn't bother changing my Battle.net logins, which are exactly the same as my gmail, and pretty much everything else I have.

Later I found that someone tried to change the password to battle.net so I reset it back and initiated the mobile authenticator for android so it's virtually impossible for anyone who doesn't have my cell phone to log in to SC2, WoW, etc.

Thank god for gmail - the only reason I found out was because Google sends you an alert if someone has used your account recently from an IP address suitably far off from where you last logged in at. Traced it to some region of China but that was it.

Fig-D

This recently happened to me as well, but Hotmail instead of Gmail. The only reason I knew is because several of the email addresses in my address book aren't good anymore, so a few of them came back. All that was sent was a single link to a site on a compromised server in China in one set of emails, and a compromised Indian server in the other batch. My password wasn't the strongest on that account, so it may have just been a brute force hacking.

Bloody Jack

You should really turn on two-factor authentication for gmail and anywhere else that uses it.

Inquisitor77

Blizzard also supports two-factor authentication with mobile apps, so there's no reason that you should be getting your account hacked even if you haven't logged in for ages.

I'd also recommend using a password manager - there's another thread here where someone asks about this as well.