Sorry your browser is not supported!

You are using an outdated browser that does not support modern web technologies, in order to use this site please update to a new browser.

Browsers supported include Chrome, FireFox, Safari, Opera, Internet Explorer 10+ or Microsoft Edge.

Geek Culture / Chris Tate's Google Account Hacked. Do not read any emails from chris.bemade@gmail.com

Author
Message
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 4th Apr 2017 18:09
Link
Hi guys

Somebody managed to hack into my google account today , and has emailed a PDF file with 'Enjoy!!!' as the email subject. DO NOT READ this email, please delete it.

The PDF contains some kind of DropBox URL link which is likely to be harmful. do not take any chances.

My account was restored, and a new password was assigned.

I think the account was hacked via my mobile phone on a supposedly public WIFI internet server in an office I was visiting to install some networking equipment earlier.

My GMail account shows no sent messages from me today, yet a few people have said to have received this message. I know that I have used my personal email address to contact some of the TGC community in the past.

Sorry about all of this.
Back to top
Profile PM Email Website
Ortu
DBPro Master
16
Years of Service
User Offline
Joined: 21st Nov 2007
Location: Austin, TX
Posted: 4th Apr 2017 19:55
Link
Ouch sorry to hear. You might want to start using a vpn service on the phone, there are a number of decent free vpn apps that at least make it harder to get connected to you on public WiFi
http://games.joshkirklin.com/sulium

A single player RPG featuring a branching, player driven storyline of meaningful choices and multiple endings alongside challenging active combat and intelligent AI.
Back to top
Profile PM Email Website
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 4th Apr 2017 21:20
Link
Thanks for the tip.

My password was 16 characters and pretty strong so I am guessing they got hold of some salted hash code for the google account login or something. The thing is, they managed to send the mail without it getting placed in the Sent Items folder.
Back to top
Profile PM Email Website
easter bunny
11
Years of Service
User Offline
Joined: 20th Nov 2012
Playing: Dota 2
Posted: 5th Apr 2017 00:44
Link
Have you used that password for other websites? The most common way accounts get hacked is by hacking other less secure websites (some even store passwords in plaintext) and reusing the passwords.

These days I just use the same root password for everything, but append a few letters from the website domain name to it ie this site would be longpwd132@$#tgc, for gmail it would be longpwd132@$#gmail

My Games - Latest WIP - My Website: Immortal.Digital - FB - Twitter
130,000 installs with AppGameKit and counting
Back to top
Profile PM Email
Dark Java Dude 64
Community Leader
13
Years of Service
User Offline
Joined: 21st Sep 2010
Location: Neither here nor there nor anywhere
Posted: 5th Apr 2017 09:13
Link
Quote: "These days I just use the same root password for everything, but append a few letters from the website domain name to it"
You've just compromised the security of your method.
"I do quite enjoy quoting myself, and I do so often. It's very fun." - Myself
Back to top
Profile PM Website
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 5th Apr 2017 10:40 Edited at: 5th Apr 2017 10:45
Link
I use that password for my google account only; because I use Google for a lot of things. I use different passwords for different levels of security; upper case, lower case, numbers.

I think the hacker extracted the email addresses from the phone and used my GMail account as the sender. Some of my company email addresses and various email accounts auto-rejected the message, so the protocol used must be unusual.

I will be avoiding google account logins on public networks from now on; I will just pay an ISP for access. The phone I use for this particular job is on a cheap pay-as-you-go tariff.

Let this be a warning for anyone who needs to access the internet while on the go without their own ISP. Edit: Mind you, Boogie2988 and various celebrities got accounts hacked whether it be ISPs, Social Networks or game portals.
Back to top
Profile PM Email Website
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 5th Apr 2017 10:43
Link
I will get some advice from Google, and if necessary I will have to make a new email account; and terminate this one. Never been hacked in my life, this makes me very angry; and will change the way I write software. I felt I was being over the top with security, but now it's personal.
Back to top
Profile PM Email Website
Ortu
DBPro Master
16
Years of Service
User Offline
Joined: 21st Nov 2007
Location: Austin, TX
Posted: 5th Apr 2017 13:53
Link
Are these contacts saved to the phone or to Gmail?

This sounds more like address spoofing than someone actually logging in to your account.

At work I've seen malicious messages come in supposedly from an employee's address, but digging into it shows that it traces back to an external source and not to the address or domain that it is pretending to be.

Unfortunately there isn't much you can do to prevent someone from pretending to be you to others.
http://games.joshkirklin.com/sulium

A single player RPG featuring a branching, player driven storyline of meaningful choices and multiple endings alongside challenging active combat and intelligent AI.
Back to top
Profile PM Email Website
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 5th Apr 2017 22:14
Link
Interesting... It does seem to be a fake sender situation.

My email contacts are all on GMail; I do not store email addresses on my phone.
Back to top
Profile PM Email Website
easter bunny
11
Years of Service
User Offline
Joined: 20th Nov 2012
Playing: Dota 2
Posted: 5th Apr 2017 22:35
Link
It seems very strange indeed. AFAIK there should be no way for them to get your Gmail login details without physical access to your device.
If it were a simple rogue access point and sniffing attempt, you would get a certificate invalid error. Google has a lot of measures in place to prevent accounts being hacked easily.

Certainly seems like it's likely a spoofed email. Although how they got access to your contacts is the real question. Possibly something as simple as stalking your social media friends and identifying ones likely to have you left email.

Can you get a friend to forward on an email 'you' sent them so you can check the header info? (I don't know if that will work though... Will forwarding it change the header info?)

My Games - Latest WIP - My Website: Immortal.Digital - FB - Twitter
130,000 installs with AppGameKit and counting
Back to top
Profile PM Email
Chris Tate
DBPro Master
15
Years of Service
User Offline
Joined: 29th Aug 2008
Location: London, England
Posted: 6th Apr 2017 11:51
Link
Quote: " Although how they got access to your contacts is the real question"


I do not know. Maybe the android OS stores local copies of the email addresses or something.

Quote: "Can you get a friend to forward on an email 'you' sent them so you can check the header info? (I don't know if that will work though... Will forwarding it change the header info?)"


I'll try. Half the email recipients auto-rejected the message, and half of the others I have contact have deleted the message.
Back to top
Profile PM Email Website
Back to top

Login to post a reply

Server time is: 2024-04-19 11:39:37
Your offset time is: 2024-04-19 11:39:37