Gmail Hacked?

[OrbitzXT]

I logged into my gmail account just now and was greeted to this message along the top bar:

Any thoughts on what happened and what I should do? I'm a very safe web browser and don't really do anything to compromise the security of my PC. I haven't actually downloaded anything recently and have only been playing a couple of games.

 

[PVTCaboose1337]

Looks like someone logged into your account from China. Unless you went through a proxy located in China, it might be time to change your password. That is very bad. (ALSO: heads up, thanks for all your ip's, might want to blur those).

 

[OrbitzXT]

Looks like someone logged into your account from China. Unless you went through a proxy located in China, it might be time to change your password. That is very bad. (ALSO: heads up, thanks for all your ip's, might want to blur those).

How would they have gotten my password though? I'm wondering if changing it will even help, maybe there is a key logger on my PC?

 

[Lampmaster]

How would they have gotten my password though? I'm wondering if changing it will even help, maybe there is a key logger on my PC?

Same exact thing happened to me, my account was accessed from China two days ago. I ran a full scan with MSE and didn't find any viruses. I'd say I'm fairly safe user, also.

 

[PVTCaboose1337]

How would they have gotten my password though? I'm wondering if changing it will even help, maybe there is a key logger on my PC?

Could be a keylogger (a software one), could be someone was at your PC and you don't have your web browser using a master password, could be dumb luck and brute forcing. If I was in your situation I would:

-Get another computer
-Change all my passwords from that clean computer
-Make sure I was not using a proxy (i once was and freaked out)
-Change your gmail password from the clean PC
-Delete all mail from paypal, banks, etc
-Delete all mail containing the word "password" and "login"
-Check your main PC for keyloggers, think did you download any files lately... hmm... don't believe in coincidences
-If KL found, reinstall OS
-Track down IP of attacker, report to authorities, get their internet cut off

 

[OrbitzXT]

I googled "gmail hacked china" and it seems to be extremely wide spread. I feel a bit better knowing I'm not alone.

 

[Lampmaster]

Do you happen to use an Android phone? That was my first thought when it happened to me.

 

[PVTCaboose1337]

I feel funny knowing that there is a technical college in china near where the IP is.

 

[qubit]

I once had my Facebook account hacked. Some turd wrote "I am gay" on my wall. They don't appear to have done anything else, however.

I immediately deleted the post and changed my password (which was already a decently safe one) to something even less guessable and I've not had any trouble since.

 

[PVTCaboose1337]

something even less guessable

If it is understandable english, it is guessable. If it is in "leet" it is guessable.

 

[OrbitzXT]

Do you happen to use an Android phone? That was my first thought when it happened to me.

Yes I do, that's the whole reason I switched from Hotmail to Gmail.

 

[Kreij]

Do you guys want me to write you a little portable utility that will generate extremely strong passwords based on a simple password and a simply key? It would be very difficult to remember the password(s), but I can make it completely portable so you can toss it on a USB stick and not have to ever install it anywhere to use it. You just type in the simple password and key, and it produces the same strong password so you can C&P it when you need it.

Most sites have a limit on password length, so I would make it so you could tell it the length and it would adhere to the limitions you give it for various sites.

For instance, Password="Kreij", Key="TPU", strong password="dF12rT%f99Zr7"
(Just an example)

 

[copenhagen69]

that would be kinda cool Kreij!!

 

[Kreij]

It would be easy enough to code, but I have no idea how to make it useful for smart phone users (mobile apps), and I don't own a phone that can use apps.

 

[PVTCaboose1337]

It would be easy enough to code, but I have no idea how to make it useful for smart phone users (mobile apps), and I don't own a phone that can use apps.

I use a notecard with a combination of letters, numbers, and symbols, in a gigantic 20x40 matrix. It serves as 100's of passwords for different sites on each side. I laminated it and have 10 copies. Pretty much, you get the card, check the row and column of the website, and without giving away too much, you get the password by that.

 

[Kreij]

That sounds excellent too. Whatever is easiest is my motto when it comes to trying to remember strong passwords.

 

[ctrain]

it already exists and it's called keepass, it's the pinnacle

also fun stuff ahead:
a password like: û$źK?h = 65 bits of strength, so roughly, 36,893,488,100,000,000,000 combinations.

something like: ²Ü¨?쵩ÈI[No¾°0ÎF7zÖØÓ<?qâ7Ô}ªÃ¬"e?ÝõÙpböðnéW¦Ñ=?R¤÷}=:îý?©Õ

is basically strong enough to potentially outlast trillions of guesses per second on every single computer in the world for over 100 years straight... actually it would probably survive past the heat death of the universe.

 

[CrAsHnBuRnXp]

Ive had this happen quite a bit actually. Made me install software firewalls again.

 

[Mike0409]

I use common sentences or sayings for my passwords. They are easy to remember and secure...Example: The Quick Fox Jumps Over the Lazy Dog.

caps, spaces, lower cases, special characters..and its easy enough that I can remember it.

And no thats not one of my passwords.

 

[RejZoR]

All this works great until you arrive at some dumb webpage that doesn't allow any spaces, doesn't allow only letters and they even limit you to for example max 12 characters. Who the hell thought of such nonsense should be shot. I mean limiting the max lenght of passwords lol...

Though this china thing is fairly common. I also had it. I have no idea how they got the password but it wasn't by guessing, that's for sure. Keylogggers were also not the case. All you can do is to just change the password asap.

 

[Mussels]

How would they have gotten my password though? I'm wondering if changing it will even help, maybe there is a key logger on my PC?

crappy password that they keygenned, imo.


even buying off ebay from a chinese seller will end up with them having your email address (happened to me), and then all they need to do is try logging into it with an automated script and password generator.

 

[copenhagen69]

this really makes me want to update all my passwords ... I thought they were somewhat secure but are nowhere near the ... ²Ü¨?쵩ÈI[N type password stuff

it already exists and it's called keepass, it's the pinnacle

also fun stuff ahead:
a password like: û$źK?h = 65 bits of strength, so roughly, 36,893,488,100,000,000,000 combinations.

something like: ²Ü¨?쵩ÈI[No¾°0ÎF7zÖØÓ<?qâ7Ô}ªÃ¬"e?ÝõÙpböðnéW¦Ñ=?R¤÷}=:îý?©Õ

is basically strong enough to potentially outlast trillions of guesses per second on every single computer in the world for over 100 years straight... actually it would probably survive past the heat death of the universe.

is keepass legit? they dont log your passwords and sell them do they?

 

[Wile E]

Somebody hijacked my account a few days ago too.

 

[CrAsHnBuRnXp]

When mine got hijacked the fuckers changed the password on me. Then when i tried to get help from Google all they could tell me is they coudlnt help because I may not be the person that owned the email account. Pissed me off. Finally got it back (dont remember how i did) now in case something like this happens again, i set it up so they can txt me a code.

 

[PVTCaboose1337]

When mine got hijacked the fuckers changed the password on me. Then when i tried to get help from Google all they could tell me is they coudlnt help because I may not be the person that owned the email account. Pissed me off. Finally got it back (dont remember how i did) now in case something like this happens again, i set it up so they can txt me a code.

Yeah the Google phone interfacing feature is a godsend. I can actually prove I own the account. In addition I can prove I own other accounts that the owner was too stupid to set up the feature.