Compromised Gmail Account

[Fearless_Shultz]

I am sure many of you have heard about all the hacking talk going on about China and Google recently....

I received a strange email from my housemate last night which looked like spam and sent him an email back to advise that his account might have been compromised in some way.

Turns out his account was being accessed from a number of Chinese ip addresses and there were a number of different sessions running.
Luckily he was able to close down the sessions and reset the password but obviously it is a concern, particularly with a service like gmail where people are encouraged to store years worth of email and never delete anything...

If you are alerted by any of your contacts that you seem to be sending out messages similar to the one below there is a good chance your account may have been compromised

Quote:Hello, I purchased promotional products from a business company:
vogueele.com , when I received and open it, loving too much,
very happy to share with you the company, I believe you will also like it. h--.

In keeping with general best practice computer security it is a good idea to regularly keep an eye out for suspicious account activity and make sure you use strong passwords that are updated regularly.

To check the recent activity on your account you can follow the steps below:

Scroll to the very bottom of the screen when logged into gmail and look for the text "Last account activity: xxx minutes ago at this IP " and click details next to it.

This brings up a window that shows you recent activity on your account, firstly whether there are any sessions for your account running in another location, unless you know that there should be it is best to close any that are.

Below this you can see the ip addresses that have recently accessed your account. If you see lots of foreign ip's this is probably a cause for concern and you should reset your password immediately.

Finally there is an option to receive an alert if there is any suspicious activity, if you don't have this turned on then it is strongly suggested that you do.

Finally, if your account has been compromised and you need to try and reclaim it you can find advice on what actions to take here

http://knol.google.com/k/the-c-man/how-t...ur_Account

Once you have reclaimed your account, make sure you follow the instructions in the article to update your security options.

I hope no one here has their gmail account compromised but I hope this information proves useful if it happens!

[Fearless_Shultz]

Bit of an update on this...

It seems likely that the security breach came as a result of an im chat client called pidgin that my housemate uses (probably now used) which apparently stores usernames and passwords in PLAIN TEXT on your computer.... I am not going to link to the site because it is such a shockingly bad thing to do... Just useful to be aware of.

More Details here http://en.wikipedia.org/wiki/Pidgin_(sof...Criticisms

[Techmonkey]

Very nice post Mr Shultz

Excellent tip on the GMail security as well