12 ms·
Gmail security warnings for suspected state-sponsored attacks
- jonknee 14y agoGoogle has stepped it up against China. First warning users about search terms that trigger the Great Firewall and now this. Very interesting. (Of course China wouldn't be the only one, but they have a history hacking into people's Google accounts and I have to imagine are a major motivator in this feature.)
- Achshar 14y agoAnother one that comes into mind is probably author or Flame and Stuxnet?
- forgotusername 14y agoWhat kind of productive, actionable result can this notification lead to for a regular user? "Oh, my government may-or-may-not be attacking me, I'm not even sure because it doesn't say, in any case I better just push this magic fix-it-all-up button I have right here." I can't see how this can be differentiated from simple underhanded FUD-driven political activism.
- wmf 14y agoMaybe you could stop using Gmail or stop discussing next week's protests.
- usefulcat 14y agoOr even start including deliberately misleading information in your communications.
- agravier 14y ago> What kind of productive, actionable result can this notification lead to for a regular user? The users may make their account more secure and take more care of their physical security? I don't understand what makes you so upset. I find this nice. Are you saying that Google will be misusing this to make some states look bad? If you were at Google, what would you propose? Do nothing with accounts that you know are being attacked by states?
- Estragon 14y agoPotential productive responses are detailed in the OP.
- babar 14y agoHow about the steps noted in the post? Make sure you have a good password, use two-factor authentication, and be careful about clicking on any login links? It could also be incentive to change accounts, or change to a different communication mechanism. As long as this warning is triggered by actual data, I am not sure how you could categorize it as "FUD" or even political activism. Hacking into accounts should not be political - it should be criminal.
- forgotusername 14y ago> Here are some things you should do immediately: create a unique password that has a good mix of capital and lowercase letters, as well punctuation marks and numbers; enable 2-step verification as additional security; and update your browser, operating system, plugins, and document editors. Attackers often send links to fake sign-in pages to try to steal your password, so be careful about where you sign in to Google and look for https://accounts.google.com/ https://accounts.google.com/ in your browser bar. These warnings are not being shown because Google’s internal systems have been compromised or because of a particular attack. How does any of this differ from regular user advice? And note the last sentence, they are explicitly admitting the warning relates to nothing in reality beyond the normal environment. Do we suppose that people in China aren't aware their government spies on them? Do you suppose your own government does not? I don't understand why this banner isn't shown to all users - China or otherwise, or why show it at all. Do something actionable and meaningful - introduce password complexity requirements, mandatory 2 factor authentication, require use of a signed browser with pinned SSL certificates - anything but non-specific nonsense that does little but promote unactionable fear in the hearts of thousands of users.
- TeMPOraL 14y agoDon't forget that government officials, defense contractors, etc. also use Google products. Not all hacking is criminal or local. Some of it is geopolitical in nature.
- vladd 14y ago2-factor logins require, in addition to 'knowing' the password, to prove that you 'have' a token (e.g. mobile phone possession). It makes your account significantly harder to crack.
- liamondrop 14y agoApart from this being very empowering to the individual user, it is also a wake up call to states who have any interest in participating in an international community that they cannot act without consequences, potentially making it an effective deterrent to this kind of behavior in the future.
- trotsky 14y agoThey can stop downloading attachments. That's a 99% fix to the problem google is reporting.
- jcromartie 14y agoaka China, right?
- its_so_on 14y agowell this coincides nicely the the confirmation that Stuxnet was state-sponsored. This is Google taking a stand. (Not against the creators of Stuxnet, just in general.)
- duskwuff 14y agoMostly! I believe there's been some tampering noticed in various Middle Eastern countries (such as Iran and Syria) as well, and I suspect this warning is targeted at them too.
- pooriaazimi 14y agoI guess so. A couple weeks ago I experienced something spooky (like session hijack) in Iran and contacted them...
- ph0rque 14y agoI wonder if google will be just as open if the state sponsoring the attack was US.
- dfc 14y agoWhy the emphasis on state sponsored attacks? (I am aware of stuxnet/flame/sanger's book) If google knows I am being targeted by a non-state actor are they choosing not to notify me? Are we going back to a cold war mentality where the only credible attacks are state sponsored?
- twoodfin 14y agoPresumably if it's a serious attack by a non-state actor, Google's lawyers are on the job in the relevant state(s) getting police involved, for whatever that's worth. In the state actor case, there's little or nothing they can do to make it stop happening, hence the special warning. It's also a high-profile jab at the unnamed state actors, which is nice.
- dfc 14y agoSo its not worth letting me know I am 0wned because google's lawyers are on the case?
- trotsky 14y agoI assure you that the grandparent is misinformed, the chance of google's lawyers and/or the police being involved if some individual is sending you targeted malware (aka spear phishing) is essentially 0%.
- jahmed 14y agoAFAIK you do get warned if Google thinks your account has been compromised by normal pishers and what not. This is just a more detailed message that I'm sure most people will never see.
- jff 14y agoState-sponsored attackers have access to much better resources. I do wonder how they determine who gets these things; do they look for keywords in your email, or do they monitor where login attempts are happening, or do they look at phishing messages that arrive at your account?
- sneak 14y agoToo bad they are legally prohibited from doing this when the state-sponsored attack is a PATRIOT NSL from the US government. http://en.wikipedia.org/wiki/National_security_letter http://en.wikipedia.org/wiki/National_security_letter China reading your mail: Big red flag. USA reading your mail: Business as usual.
- w1ntermute 14y agoWell, Google doesn't really have a choice but to follow the laws of the country it's based in. Do they at least explicitly explain this caveat somewhere?
- sneak 14y agoGoogle is a huge multinational, operating on the internet, which is (at least historically) devoid of specific jurisdictions. They could, at the expense of profits, sidestep this issue - but they don't. Unfortunately the US is trying to deny that, with less and less success, but that's where we're at today. I just think it's shitty of them to make such a noise about non-US state-sponsored surveillance, but remain relatively silent on the thousands and thousands unconstitutional USA PATRIOT wiretaps they get every single month.
- brown9-2 14y agoHow could Google sidestep compliance with US laws? They are incorporated in the US, are they not?
- taliesinb 14y agoI imagine in ways analogous to how they avoid paying US taxes, even though they are incorporated in the US.
- brown9-2 14y agoThat wouldn't work. Their tax avoidance strategies are legal with respect to US law. If they operated in the US without honoring DMCA requests, Patriot Act etc, they'd quickly be sued or arrested by the US govt.
- 3pt14159 14y agoThey should have included the words "if at all possible, format your compute and reinstall a new operating system with latest updates immediately. If someone has a keylogger on your computer it is game over anyways. (Since they can "read" the mail you send just by recording the keystrokes)
- cmelbye 14y agoI think this warning is referring to MITM hijacking attacks and things along those lines, not key loggers.
- s_henry_paulson 14y agoFYI, rootkits can survive a HD format.
- Toshio 14y agoI like how "state-sponsored" is pretty much an euphemism for "we're pretty confident it was the Chinese who did it but we can't say so on our official blog".
- markerdmann 14y agoLive from the scene: my partner just found that she wasn't able to log in to her Gmail account because her password was suddenly invalid. Luckily she was able to reset it quickly and regain control of the account. When she checked the recent activity, though, it showed that all logins in the past 12 hours came from her IP.
- utlanning 14y agoSounds like a setup to a thriller movie, but the relevance to the article is lost on me. Am I just missing something?
- markerdmann 14y agoHer account was affected this morning by the attack reported in the article.
- rdl 14y agoI wonder if anyone on HN has gotten this warning yet.
- deleted 14y ago[deleted]
- dreamdu5t 14y agoHow do we know this isn't state-sponsored propaganda!?
- saraid216 14y agoBecause we already know that Gmail has been hacked by the Chinese in order to obtain information about their dissenters?
- eroei2012 14y agoSince New York Times recently reported that Stuxnet is a US State Sponsored Cyber virus - which if you recall was accidentally released into the wild and affected and attacked innocent end-user machines as collateral damage, and with the ongoing US-Israeli state sponsored cyber warfare weapons of mass destruction (operation Olympic Games) including the more recent releases of Duqu and Flame virus.... can Google clarify if through its detailed analysis as well as victim reports if Google will apply the same exacting standards and warn end-users (both in the US and abroad, example: Iranian users) of these domestic (US) state sponsored attacks as well? Even if Google was to choose to go the higher route, wouldn't this kind of undermining and subterfuge (however unintentional) really go unnoticed by its host nation? Or are exceptions of convenience made in these cases due to the close ties that Google has with the US intelligence agencies and the confirmed but secret and classified collaboration that the Google has with the CIA and NSA in regards to GMail and Google Accounts? No doubt there is a clear conflict of interest going on here. To me this smells more like Google catering to State Sponsored Propaganda than really caring about the security and privacy of their end-users.
- dguido 14y agoPeople that have received this warning so far: * @gesa, Obama campaign web developer says an infosec staff member got one: https://twitter.com/gesa/status/210184075149979649 https://twitter.com/gesa/status/210184075149979649 * @dandrezner, international relations professor: https://twitter.com/dandrezner/status/210103984881549312 https://twitter.com/dandrezner/status/210103984881549312 * @TomLasseter, Bejing Bureau Chief for McClatchy Newspapers: https://twitter.com/tomlasseter/status/210210259019640835 https://twitter.com/tomlasseter/status/210210259019640835 * @JeffreyCarr, CEO of Taia Global and author of Inside Cyber Warfare: https://twitter.com/jeffreycarr/status/210227611912257537 https://twitter.com/jeffreycarr/status/210227611912257537 * @snowfl0w, malware analyst for Contagio Dump: https://twitter.com/snowfl0w/status/210207958376779776 https://twitter.com/snowfl0w/status/210207958376779776 * @w7voa, Voice of America Bureau Chief covering Korea and Japan: https://twitter.com/w7voa/status/210194791479250946 https://twitter.com/w7voa/status/210194791479250946 * @marcambinder, national security reporter for The Atlantic and GQ: https://twitter.com/marcambinder/status/210184141180911617 https://twitter.com/marcambinder/status/210184141180911617 * @DDysart, web developer?: https://twitter.com/DDysart/status/210183540535590912 https://twitter.com/DDysart/status/210183540535590912 This is not looking good... some people on this list have gone and installed Google 2FA after realizing their computer might be compromised. Enabling two-factor auth WILL NOT resolve this issue if your computer has been compromised. If you get this warning, you need to bring your computer to someone with real security expertise and have it checked out. Strongly consider cleanly reinstalling your OS, then enable two-factor authentication. EDIT: Here's the message that Google is giving to people that have been affected: http://support.google.com/mail/bin/answer.py?hl=en&ctx=mail&answer=2591015 http://support.google.com/mail/bin/answer.py?hl=en&ctx=m... It looks like they're detecting exploit code sitting in people's accounts, mostly in the form of PDF and Office docs and inside RARs. This might explain why snowfl0w is on the list, since he handles a lot of this stuff daily and some of it likely goes through his e-mail (on purpose). It's unclear if this means that your account was successfully compromised. It's more likely that it means someone is attempting to get into your account.
- Intermernet 14y agoI personally don't care if it's an individual attack or a state sponsored attack. An individual can be sponsored by a state after the fact. With the price of 0day vulns as high as it is, it's quite likely that "states" are playing the field as much as "traditional" attackers. Drawing a line between the 2 is treating a grey area as black and white.
- seanp2k2 14y agogroan so we live in /this/ era now, where politicians try to weaponize the Internet. Kill me now.
- NathanKP 14y agoI think this is a great idea. I would be interested if it could tell you what state though, and/or what group.
- thetable 14y agoSince Google doesn't tell you why they're showing this warning to you, and only tell you to follow standard security guidelines ("don't get phished"), I suspect people will quickly be trained to ignore this message. My girlfriend received the warning message today. She has already activated 2-factor auth, so I'm really not sure what she's supposed to do with this information.