3 ms·

> most distressing to me is that I am still unable to explain how those guys were able to get access to the account twice after I changed the password, security

by sorbus 15y ago

> most distressing to me is that I am still unable to explain how those guys were able to get access to the account twice after I changed the password, security questions and backup email address from my Mac that does not seem to be compromised. It sounds very much like the hackers were also using the "last chance form." Consider that all of the information it requests is available through Gmail - account registration data, names of tags, most emailed people, and verification code (which was apparently emailed to him, and therefor present in the compromised email account) (Note: I haven't used the form myself, I'm going on the information in the article). Also, the title is a bit link-baitish.

saool 15y ago
I think the windows xp box he says he had his wife turn off had a trojan in it.
- sorbus 15y ago
  That doesn't make sense. He changed the passwords, as well as using Gmail's ability to end all other sessions. Unless he was giving his SO (he never calls her his wife) the password and she was logging in on that computer, there should have been no way for a trojan on it to access the account.
  - yaakov34 15y ago
    They were probably using the "last chance" form to reset the password. That form checks the IP address; if they had control of the XP machine, they could have been using it to submit the form with a reasonable IP address and get the account again. Once they lost that, no go. At least that's the only thing that I can think of.
    - sorbus 15y ago
      Ah, that makes sense. I didn't realize that the form checks IP addresses, though, in retrospect, that's an extremely obvious security feature to have.
mgurlitz 15y ago
My impression is that these hackers would have much of the scamming process automated. Maybe it was a real person filling out the recovery form, but I doubt the initial scheme (set up redirecting, send spam mail) was performed by a human. Perhaps the hackers had saved every email in the account and were able to extract the necessary information to do the recovery. But the author admits the Gmail account isn't valuable - the marginal gain from recovering the hacked account seems negligible for the hacker to intervene himself. It seems more plausible that the recovery form has been gamed. The initial hack was programmed to extract the information in advance and possibly even perform the account recovery if necessary. They know exactly what and how much information is needed for Gmail to accept the recovery, whereas the author had to call his s.o. to fill out all the fields. Either way, it sounds like the Gmail recovery form should be revised. The author argues recovery is already difficult for the true owner to perform. Google could, while keeping the automated process, make it harder for an algorithm to recover the account than the real owner.

by sorbus 15y ago

saool 15y ago

I think the windows xp box he says he had his wife turn off had a trojan in it.

sorbus 15y ago
That doesn't make sense. He changed the passwords, as well as using Gmail's ability to end all other sessions. Unless he was giving his SO (he never calls her his wife) the password and she was logging in on that computer, there should have been no way for a trojan on it to access the account.
- yaakov34 15y ago
  They were probably using the "last chance" form to reset the password. That form checks the IP address; if they had control of the XP machine, they could have been using it to submit the form with a reasonable IP address and get the account again. Once they lost that, no go. At least that's the only thing that I can think of.
  - sorbus 15y ago
    Ah, that makes sense. I didn't realize that the form checks IP addresses, though, in retrospect, that's an extremely obvious security feature to have.

mgurlitz 15y ago

My impression is that these hackers would have much of the scamming process automated. Maybe it was a real person filling out the recovery form, but I doubt the initial scheme (set up redirecting, send spam mail) was performed by a human. Perhaps the hackers had saved every email in the account and were able to extract the necessary information to do the recovery. But the author admits the Gmail account isn't valuable - the marginal gain from recovering the hacked account seems negligible for the hacker to intervene himself. It seems more plausible that the recovery form has been gamed. The initial hack was programmed to extract the information in advance and possibly even perform the account recovery if necessary. They know exactly what and how much information is needed for Gmail to accept the recovery, whereas the author had to call his s.o. to fill out all the fields. Either way, it sounds like the Gmail recovery form should be revised. The author argues recovery is already difficult for the true owner to perform. Google could, while keeping the automated process, make it harder for an algorithm to recover the account than the real owner.