People are baffled when their Gmail account is re-compromised and often have no idea how it keeps happening. So I’ve laid out some of the more obvious items that need to be checked to ensure that your Gmail/Google account is locked down.
Mind your filtersThe best method for an attacker to get back into your account is to keep reading your emails even after you’ve changed your password. So the basics of any Gmail backdoor will be to setup some email forwarding rules that send him or her a copy of your messages as they arrive - including password reset messages. Make sure you disable these following any compromise.
Under Settings> Forwarding and POP/IMAP ensure that disable forwarding is selected and that your incoming email is not being forwarded to the attacker. Next, check your filters list in Gmail and make sure there are not any rules setup that forward email to the attacker.
Check the Password Recovery settingsThe next best method of a backdoor is for the attacker to have the ability to recover or reset your password. This is not the sneakiest of routes but it accomplishes the job well. Ensure an additional recovery email address was not added to your account.This will allow an attacker to get the password reset link straight to his email.
Go to settings> Accounts and Import > Google account settings> Change password recovery options> Email.
Make sure the SMS number has not been changed in Google account settings. Also, make sure your security question has not been changed to a question known by the attacker. Sneaky attackers will leave your question the same but change the answer to one they know. Go ahead and change your question and answer.
Watch out for rogue applications
Gmail isn't just an email program, its part of an entire Web based application ecosystem. Check your authorized applications to see if the attacker added their own malicious application to be allowed on your account.
Everyone today adds social applications and gives permission to their Facebook/Google accounts through third party applications. Most people don't even look at what permissions the third party applications have.
In Gmail applications can pretty much do everything an attacker would want to do. Even better, from the attacker's stand point, is that no one even knows where how to revoke or check permissions on these applications once they've been approved, they're forgotten.
There are open source applications will grant full IMAP/SMTP access using OAUTH. Once the Gmail account is hijacked, an attacker can run this script and grant access to the application for full privileges.
Even if you change your password multiple times, a rogue application can continue reading your email and accessing your personal data.
Think beyond e-mail
Not only back doors allowing full access to read email should be considered. Attackers have several options to obtain your data in the world of open social collaboration that is easier then ever.
If you have Google voice, go into voice settings and make sure voicemail and text messages are not being sent to additional email addresses.
If you have important Google documents in Google Docs, ensure the attacker has not enabled sharing. Google calendar is a very nice backdoor. I'm sure you don't want someone unexpectedly dropping in and listening on your next board meeting. If so, there are a couple areas you need to check.
In the Calendar Settings, click on your calendars to display the detailed view and make sure you click "reset private URLs" in the private address section. This will change the private address that can be used to retrieve your calendar feed.
As an attacker I can easily just copy this URL and monitor your calendar. Next, click 'Share this calendar' tab and make sure that no email addresses are added that you don't recognise.
Showing posts with label anti-Google. Show all posts
Showing posts with label anti-Google. Show all posts
Tuesday, October 5, 2010
Wednesday, February 24, 2010
Chinese Black Hat Security Consultant wrote anti-Google hack
US analysts believe a Chinese freelance security consultant with government ties was the author of the code used in cyberattacks on Google and other companies, the Financial Times reported on Monday.
The Wall Street Journal reported meanwhile that a prominent Asian hacking group that is likely Chinese may have been the perpetrators of last year's attacks on the Internet giant and as many as 33 other companies.
The FT, citing an unidentified researcher working for the US government, said a Chinese security consultant in his 30s wrote the part of the program that used a previously unknown security hole in Microsoft's Internet Explorer Web browser to break into computers and insert spyware.
The newspaper said Chinese officials had special access to the work of the author, who posted pieces of the program to a hacking forum.
The man is not a full-time Chinese government worker and did not launch the attacks, the newspaper said, adding that he would "prefer not be used in such offensive efforts."
"If he wants to do the research he's good at, he has to toe the line now and again," the US analyst said. "He would rather not have uniformed guys looking over his shoulder, but there is no way anyone of his skill level can get away from that kind of thing.
"The state has privileged access to these researchers' work."
The FT also repeated claims made last week in The New York Times that the attacks had been traced to computers at Shanghai Jiaotong University and the Lanxiang Vocational School located in the eastern province of Shandong.
Both institutions have denied involvement, as have the Chinese authorities.
The Wall Street Journal said Monday that the group that attacked Google and others may have been involved in previous attacks tracked by intelligence and law-enforcement officials.
"It is the same folks that have been behind a hell of a lot of other attacks," the Journal quoted a person familiar with probes into some of the affected companies as saying.
The Journal said the group investigators are focusing on uses Chinese computer systems to mount its attacks and has a history of primarily attacking corporations -- not the US military or other government agencies.
The Journal said it is not clear whether the hackers have connections to the Chinese government or whether they are a "patriotic" hacking group that acts in the government's interests.
China has repeatedly denied involvement in the attacks, which have strained US ties and prompted Google to threaten to leave the country.
Google vowed in January to stop bowing to Web censors in China in the wake of the cyberattacks aimed at the US firm's source code and at Gmail accounts of Chinese human rights activists around the world.
Google continues to filter searches as per Chinese law while trying to negotiate a compromise with officials there.
US President Barack Obama said last month that he was "troubled" by the cyberattacks on Google and wants answers from China.
The Wall Street Journal reported meanwhile that a prominent Asian hacking group that is likely Chinese may have been the perpetrators of last year's attacks on the Internet giant and as many as 33 other companies.
The FT, citing an unidentified researcher working for the US government, said a Chinese security consultant in his 30s wrote the part of the program that used a previously unknown security hole in Microsoft's Internet Explorer Web browser to break into computers and insert spyware.
The newspaper said Chinese officials had special access to the work of the author, who posted pieces of the program to a hacking forum.
The man is not a full-time Chinese government worker and did not launch the attacks, the newspaper said, adding that he would "prefer not be used in such offensive efforts."
"If he wants to do the research he's good at, he has to toe the line now and again," the US analyst said. "He would rather not have uniformed guys looking over his shoulder, but there is no way anyone of his skill level can get away from that kind of thing.
"The state has privileged access to these researchers' work."
The FT also repeated claims made last week in The New York Times that the attacks had been traced to computers at Shanghai Jiaotong University and the Lanxiang Vocational School located in the eastern province of Shandong.
Both institutions have denied involvement, as have the Chinese authorities.
The Wall Street Journal said Monday that the group that attacked Google and others may have been involved in previous attacks tracked by intelligence and law-enforcement officials.
"It is the same folks that have been behind a hell of a lot of other attacks," the Journal quoted a person familiar with probes into some of the affected companies as saying.
The Journal said the group investigators are focusing on uses Chinese computer systems to mount its attacks and has a history of primarily attacking corporations -- not the US military or other government agencies.
The Journal said it is not clear whether the hackers have connections to the Chinese government or whether they are a "patriotic" hacking group that acts in the government's interests.
China has repeatedly denied involvement in the attacks, which have strained US ties and prompted Google to threaten to leave the country.
Google vowed in January to stop bowing to Web censors in China in the wake of the cyberattacks aimed at the US firm's source code and at Gmail accounts of Chinese human rights activists around the world.
Google continues to filter searches as per Chinese law while trying to negotiate a compromise with officials there.
US President Barack Obama said last month that he was "troubled" by the cyberattacks on Google and wants answers from China.
Subscribe to:
Posts (Atom)
Posts
