Suspected Chinese spear-phishing attacks continue to hit Gmail users
Researcher details more bids to hijack high-value email accounts
Computerworld - Months after Google said that Chinese hackers were targeting the Gmail accounts of senior U.S. government officials, attempts to hijack Gmail inboxes continue, a researcher said Thursday.
"Once compromises happen and are covered in the news, they do not disappear and attackers don't give up or stop. They continue their business as usual," said Mila Parkour, an independent security researcher based in Washington, D.C., on her Contagio Malware Dump website.
In early June, Google announced it had disrupted a targeted phishing campaign designed to compromise Gmail accounts belonging to senior U.S. and South Korean government officials, military personnel, Chinese activists and journalists. Google said it had traced the attacks to Jinan, China, a city in eastern China that has been linked to other hacking campaigns, including one in late 2009 against Google's own network.
Parkour had revealed details of the earlier phishing attacks months before Google's June announcement.
China denied accusations that its government played a role in the attacks that accessed hundreds of accounts.
And the attacks have not stopped.
"Attackers...continue their efforts with a very slight modifications to the original themes," said Parkour.
The latest campaign baits the scam with the promise of a report titled "Blinded: The Decline of U.S. Earth Monitoring Capabilities and its Consequences for National Security" from the Center for a New American Security (CNAS), a Washington D.C. think tank.
In fact, CNAS offers that report as a free PDF download.
The emails are customized for each recipient, a common tactic in targeting attacks -- dubbed "spear phishing" by security experts -- and apparently are aimed at people associated with political and international affairs.
"Victims get a message from an address of a close associate or a collaborating organization/agency, which is spoofed," said Parkour. "The message is crafted to look like a subscription form offering to enter Gmail credentials to activate it."
Parkour also dredged up evidence of a Chinese connection to this newest campaign. She noted that the email client that sent the bogus messages was Foxmail, a free program routinely used by China-based phishing attacks, and that the server delivering the messages is based in Taiwan and has sent malicious mail before.
If a recipient falls for the trick and enters his or her Gmail username and password in the emailed form, the information is sent to the attackers via a compromised server in Houston, Texas. The criminals then use the pilfered credentials to log into the account a few hours later, and check the inbox twice each day after that.
Parkour confirmed many of the details herself by creating a Gmail account, populating it with Google alerts about human rights and military issues, as well as with malicious documents and messages from Chinese discussion groups.
"The password thieves did not delay and logged in less than two hours after the compromise," she said.
Since June, Google has deployed some new anti-phishing features, including one that displays a message when email is forwarded to another address -- as in this case -- and another that automatically shows a sender's address for mail coming from people the recipient has either not sent mail to or are not in his contact list.
"Google are aware of this, [but] there is not much they can do to prevent these from coming in," said Parkour as she urged people concerned about security to use Gmail's two-factor authentication, which sends a second password to the user's mobile phone, and to change their primary password frequently.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
- Arrests made after international cyber-ring targets StubHub
- International police operation disrupts Shylock banking Trojan
- Spamhaus pushes for arrests of alleged DDoS participants
- Accused Russian point-of-sale hacker arrested, will face U.S. charges
- No-IP regains control of some domains wrested by Microsoft
- Microsoft legal action cramping other hacking campaigns, Kaspersky says
- Microsoft admits technical error in IP takeover, but No-IP still down
- QuickPoll: Why hasn't Windows XP come under attack from hackers?
- Cybercrime losses top $400 billion worldwide
- U.S., foreign agents disrupt Gamover Zeus botnet
Read more about Security in Computerworld's Security Topic Center.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!