My gmail account was hacked!

karim

At 3:50pm today, my Gmail got hacked into.

I received a few undeliverable email notification, which I found weird, as they came from old addresses in my Gmail contact list. I quickly gave a look to the account activity and noticed some activity from Austria! Check attached picture.

I immediately clicked the sign out all other sessions and changed my password.

First email was sent at 3:50pm, last email was sent at 3:56pm. Email was sent to 242 different email addresses until I noticed it.

Email only contained one of the following links (CLICK AT YOUR OWN RISK!!):

abishop.com.au/enterin.html
canalcoin.com/enterin.html
dancersdomain.com/enterin.html
adevarprezent.com/enterin.html
deckedoutapparel.netfirms.com/enterin.html

Uploaded with ImageShack.us

Georges

All the links mentioned above redirects to : http://greatwallsystem.net/ (91.66.6.226).

The website is located in Bremen, Germany.
You might want to check the WhoIs lookup.

Joe

I edited the links to make them non clickable as an extra security.
Don't go pasting malicious links on the forum ;=)

karim

You're right... I did post a warning though... :)

Anyways, the greatwallsystems.net then redirects you to sportsmedsrxpills.net, a Canadian website that sells Viagra and other drugs...

What I'm really concerned about is how they got access to my account...

I have a very strong password on Gmail, that is not shared with any other website.

I completely change it every few month, and change a letter or number every couple of weeks.

It is ~20 letters long, contains 3 unrelated dictionary words, with some random capital letter/symbol/number (it would look something like !rotating1kernel@waste)

I only check my email from my own computers at home or work, or from my iPhone, which are apparently all clean.

m0ei

Do you save your password using any web browser ?

rolf

It happened to me but with hotmail. My account was used to send hundreds of spam mail, until I changed the password.
I wonder how they managed to hack it. Maybe I used the same password to register somewhere, and they tried it on my email address. Since then I never use my email password anywhere else. But it might have been something else.
The hacker might not be in Austria. If you want to you can try tracing him and lodging a complaint or something, yet this might be the IP of a compromised computer or a proxy or something like that.
Since you have a secure password, it would be really interesting to know how they got it. Maybe your computer was infected.

nuclearcat

karim wroteIt is ~20 letters long, contains 3 unrelated dictionary words, with some random capital letter/symbol/number (it would look something like !rotating1kernel@waste)

I only check my email from my own computers at home or work, or from my iPhone, which are apparently all clean.

Do you have windows? :-)

m0ei

Usually this is a fake ip, either he's under a proxy, VPN or RDP. I doubt he's under a proxy or a VPN cause Austria Proxies and VPNs isn't that much available. As i said, if your password is that strong, he might logged you, but i think you save your password in your web browser, he got it it using a stealer binded to an executable that you downloaded before.
Please don't tell me that i have the best antivirus updated because any trojan stealer or keylogger could be simply crypted making it fully undetectable.

karim

My desktop runs on OSX, my laptop runs on Ubuntu, my password is saved in Google Chrome, but is not synched using Google Sync, or any other service for that matter. My work laptop run Windows 7, but it ONLY has work related, licensed software installed on it.

The dirtiest piece of equipment I have is my iPhone, it's jailbroken and has all kind of junk installed. But I doubt it comes from my phone as of the 5 mail accounts on it (of which 2 on Gmail), only this one was compromised.

I usually take really good care of my security, especially of my Gmail account, and not once have I had any account compromised. I have never even put in my Gmail password in Facebook/LinkedIn or whatever other friend/contact finder, I do not use this email address to register to websites or forums, and I do not share this password with other websites....

I use a very strong password for gmail a couple of strong passwords for other private stuff (fb, im & co) and a weak/regular password for everything else (forums, websites...)

I feel violated, as if I was e-raped....

kareem_nasser

Same thing happened to me on my Hotmail account. It was basically my fault because in the past i used to randomly input my email on suspicious websites. After i noticed the spam mails i knew i was hacked. So like rolf did i changed my password.

Note: I told some of my friends to monitor if i have sent a suspicious email to them.

P.S: One of my friends whom i know from this forum told me to change the password.
P.S2: Among the suspicious sites i have inputted my email are the French scams of detecting who blocked you on Windows Live Messenger.

proners

i got hacked a few weeks back but it was on secondary email with a weak password, they used it to send spam.
i never get hacked because i use firefox with noscript, adblock plus, running in a fedora virtual machine booting from my ubuntu live cd... kidding :P
Man you definitely need therapy to recover smoothly from this e-rape, i feel your pain.. not
[hijack]the ever debatable question: installing security software on mac or not?[/hijack]

karim

I enabled 2-step verification for my Google account. It shouldn't be an inconvenient since I virtually never login to Gmail on new devices unless they are new devices I have acquired.

I strongly suggest you do the same...

kareem_nasser

Detailing the log in IPs is the best feature about Gmail. So i use it to know if someone hacked my email.

MegaCool

Something similar happened on my Facebook account some time ago, they warned me of an unusual login activity from 'India'. So I had to change the password, that's it.

jadf24

even if a trojan is FUD (fully un-detectable) it only remains undetectable until it starts functioning.. then the antivirus will catch it. FUD will only work if you scan the .exe or wtv, only then the antivirus wont be of any effect