[OT] Gmail account compromissed.

[Diego Diaz]

Hi all,

Seems that my gmail account has been infected and many of you have received a faked mail from this account pointing to a forged link.

First of all I want to express my apologies for such circumstance and my hope that none of your PC's have get infected as a consecuence.

I do have an AV active permanently but it seems that this has not been enough protection.

In the event of any further messages arrive from this account "clonix41"(at)"gmail"(dot)"com", please note that I never send messages without "subject", and without a explanatory text in the contents.

In the meantime, if you happen to contact me, please use "sulaco2000"(at)"hotmail"(dot)"com" instead.

Again my apologies to all of you affected by this pest.

Thanks for your patience and best wishes.

Diego Díaz.

[Marcus von Cube, Germany]

It's not necessary to hack someone's account to forge an email address. Looking at the email's headers or source can tell you if the mail was sent from the legit mail servers. Most forged emails are send from very suspicious servers (e.g. from .ru or .cn domains). Look at the "received" headers.

[Lode]

Look at the bottom of your Gmail for a "Details" link that brings you to "Activity on this account".

Do you see any IP adres that cannot be yours listed there?

[Diego Diaz]

Hi Lode,

Thanks a lot for your hint. Yes I've found a suspicious access from a US IP address, by the time the fake emails were sent, from 13:22 to 13:28 (ET).

I changed my security settings immediately after I received the first reply, so it takes just about 6 minutes.

39 addresses were reached before I disconnect.

This is the first such issue on my record and hope this is also the last.

Thank you all for your comprehension and my best wishes.

Diego Díaz.

[sylvandb]

I recommend also changing password and other security information on any other account which the miscreants might associate with your gmail account either because of similar name or because any mail in your gmail account refers to the other account(s).

Also watch for unexpected email into that gmail account, especially such type as password change requests, and similar.

Running a service on the Internet that requires authentication (like e-mail or ssh or a discussion forum) can be a real eye opener as to the effort expended to break that security. Combine the high profile of google mail (or hotmail or yahoo mail) with anything else that might attract attention to your account, and I expect incessant attempts to compromise that account.

sdb

[Diego Diaz]

Hi, and thanks for the advice.

I already did. :-)

Best wishes from Caribbean.

Diego.

[Kerem Kapkin (Silicon Valley, CA)]

Hi Diego,
Long time no talk.
So you are saying the email that you send me about my long lost uncle leaving his HP calculator collection with several $M, and asking me my account number so you can transer the funds and ship the calculators WAS NOT REAL!!. :)

[Diego Diaz]

Hi Kerem,

Nice to read from you... I must say however that your uncle shows an outstanding health and will more likely outlive us all... :-)

All the best ocean to ocean.

Diego.

Edited: 18 Jan 2013, 10:41 a.m.