|Google Thwarts Gmail Phishing Campaign|
Google Thwarts Gmail Phishing Campaign [googleblog.blogspot.com]
|Through the strength of our cloud-based security and abuse detection systems*, we recently uncovered a campaign to collect user passwords, likely through phishing. This campaign, which appears to originate from Jinan, China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists. |
The goal of this effort seems to have been to monitor the contents of these users’ emails, with the perpetrators apparently using stolen passwords to change peoples’ forwarding and delegation settings. (Gmail enables you to forward your emails automatically, as well as grant others access to your account.)
Google detected and has disrupted this campaign to take users’ passwords and monitor their emails. We have notified victims and secured their accounts. In addition, we have notified relevant government authorities.
It’s important to stress that our internal systems have not been affected—these account hijackings were not the result of a security problem with Gmail itself. But we believe that being open about these security issues helps users better protect their information online.
It appears that the Feds are now investigating this.
Feds investigate alleged attacks on Gmail accounts
The U.S. government is investigating reports from Google that hackers attempted to break into the Gmail accounts of senior government officials but at this point doesn't believe any accounts were actually breached.
"Speaking on behalf of the U.S. government, we're looking into these reports and seeking to gather the facts," Caitlin Hayden, deputy spokesperson for the National Security Agency, told CNET today. "We have no reason to believe that any official U.S. government e-mail accounts were accessed."
The FBI is taking the lead on the investigation, according to Hayden, "as part of an interagency mechanism that comes together to focus on these types of incidents when they occur."
Could hacking a senior official's email account be considered a cyber attack on the US? Since this appears to be coming from a Chinese city with a large military influence, I wonder if this is in any way related to the Pentagon's recent statement about such attacks being considered an act of war?
At least you got it right here, it's PHISHING, the press is calling it hacking.
If the top US officials who are supposed to be security conscious are too stupid to tell they're being PHISHed, which puts the whole act of divulging data on the unwary user, how to they expect the average joe not to get phished?
Seems like this little episode will put some serious efforts into anti-phishing detection because it's not that hard and stupid the email vendors aren't doing more to alert users.
Maybe the Chinese did it, maybe they didn't, but stupidity and insufficient software safety guards divulged the passwords, not the Chinese.
Yes incrediBILL, you are right on the money, it's phishing, just like the hundreds of other phishing attempts made every day.
What I found interesting is that Google's system seemed to indicate their was a problem and it seemed to have been stopped it before the user became aware. A sort of Anti-phishing for dummies.
All looks a bit different to what was in the UK press which was implying that the US Government was using Gmail accounts for sensitive official mail and that those accounts had been hacked.
Um, what do they mean, "likely through phishing"? Either it was or it wasn't.
:: uneasily wondering if any of those Feds spend their lunch breaks on Facebook, which really was mail-hacked recently ::