Gmail hacked - Evo is number one suspect

[EarlyMon]

Yes. Let's say i want a new keyboard on my evo. I find one in beta. Well, most beta keyboards will require internet access and recording of keystrokes to further improve their product. If one has malware hidden, I wouldn't know till it was too late.

Personally, I don't care one iota about them improving their products.

Keylogging is - by definition - spyware.

Now, some would argue that there are good spies and bad spies - just think of Illya Nickovetch Kuryakin or James Bond.

Or, you could think of Secret Agent and what happened to him - or read Tinker, Tailor, Soldier, Spy for another view.

In other words - those beta keyboards with their benign keyloggers - how are they not also logging passwords?

A little wrongepedia to give a overview of the pernicious issue:

Keystroke logging - Wikipedia, the free encyclopedia

All this security talk is getting serious and bumming me down - how about a little tune to lead us into a secure and way fun holiday weekend, gang?

YouTube - JOHNNY RIVERS - Secret Agent Man 1966

 

[Deleted User]

Yes. Let's say i want a new keyboard on my evo. I find one in beta. Well, most beta keyboards will require internet access and recording of keystrokes to further improve their product. If one has malware hidden, I wouldn't know till it was too late.

No, there's never a reason to be recording keystrokes, beta or not. As a developer, you want to know about crashes and the reasons behind them. What keys you pressed when, above that keys in general were being pressed, is not relevant.

I wouldn't download any app that proposed recording keystrokes.

 

[EarlyMon]

That's not even true. There are some viruses but mostly there are trojans (there is a difference.) The old "you can't get a virus on a mac" adage died years ago, just that fanbois and Apple themselves didn't want to admit to it.

But now they do. Apple sells Norton Anti-Virus right in the Apple Store. Unless Apple are pushing software that does absolutely nothing, there must be something out there.

You must be new to what gets marketed for computers.

Or, take a look at all these OS X security updates. These aren't feature fixes, these aren't simple bug fixes, these are security updates. Each patch fixes a security hole that could (and may have) been used by malware, viruses and trojans.

There are plenty of security holes in OS X, they get fixed, and then as new features are introduced, new holes come along - true for all OSes.

However - let's be very clear - a virus is not anything that you want it to be - it's its own specific thing.

A virus is a malware with two key additional features:

• it is self replicating
• its replication process is intended to not only fight off its removal from the infected system, but to also spread it to others
  • either by automated means
  • or by the user helping to spread it with normal user actions fully compromised by the virus, without the user's knowledge

Once upon a time, the only security compromises were via direct attack by a dedicated human or process exploiting entry into a system - the entry was key, preferably entry into a secure account. It was at that point that the attacker would do damage - by spying, by erasing, by tunneling.

Then came viruses.

Then came spyware and malware.

Most all of the security holes you and others cite are targets for the first and the last in that list.

Direct attack still exists, but because everyone loves to force multiply their evil, the latter 2 - viruses and (spyware and malware) - are the more popular attacks that everyday people are targeted by.

As htcevolee points out, spyware and malware are easily delivered by simple vectors - browsers and weak apps such as Adobe Reader.

If you think that any OS is immune to phishing, spyware or malware, you're nuts - but - that's at the application level that can be controlled, and while terrible, those things are not viruses.

Unix systems do have a natural immunity to viruses - OS X is a unice, so it, too, has that natural immunity.

I do not say that unices are guaranteed foolproof against viruses - I do say (and have said earlier) they have a natural immunity and are simply much, much tougher.

Unix - including OS X - viruses are extremely rare, they are not everyday occurances, and it is security FUD pushing ideas to the contrary.

I have often noted that as security software sales went up, so did the number of threats in the wild.

I'm also often told that I have that backwards.

After all, what security software vendor would ever engage in helping to create bad things, even when they get money to maintain subscriptions to keep killing them? That's just crazy talk. I'm sure that each and every security software vendor has nothing but knights on white horses working for them, myself.

On the other hand - you can avoid malware and spyware without ever spending a dime.

And there's no excuse for any operating system to NOT be naturally immune to viruses because that systems programming technology has been available for a very long time.

By the way - whether we like it or not, any program that crashes a whole computer, or crashes hard - should be considered malware, even if it's canonically not.

Mal means bad, mmmk. Software that does that is bad, mmmk. Always complain about bad software, mmmk. It's the right thing to do, and I'm 100% serious on that point.

PS - Now that I think of it, maybe malware and spyware came first. In fact, I was so thinking of PCs when I wrote that, I forgot about what had already happened years earlier to some CDCs, IBM minis, and Vaxen, to name but a few. Sorry about that! Even monkeys fall out of trees, sometimes! Malware (including trojans) and spyware (including trojans) came first.

 

[IOWA]

Well we've also agreed on things before, and that is the beauty of healthy debate =). Your one of the few on here I take seriously, so take that as a complement.

K, backatcha.

Now yes the *nix can usually keep it contrained to the user and not su. But since osx is only based on unix and BSD, it has exploits other *nix's don'

It's not that it's based on BSD - it IS (almost) BSD, with all of the eye candy layered on top of it. One can (and I have, at times) strip away the aqua eye candy, and run straight X - I prefer my own implementation of tom's windows manager - and you're strictly in BSD land. Or - strictly a Gnome desktop. A bunch of us were leading others on the web on how to do that back in the 10.0 days - just because we could (and - we weren't entirely sure of this newfangled OS X, despite living through beta).

The singular thing that keeps it from being a straightforward BSD is the non-BSD kernel - Mach. And I point that out as a Mach kernel programmer in my earlier life. While Mach is indeed a *nix kernel, I always found it odd that that choice was made.

So - once under the aqua layer, and above the non-standard (for BSD) kernel - it's very much a very nice BSD implementation - right down to the Open Firmware (shades of Ultrix!!).

Now that being said, let's fast forward to today, and win7 is still the most secure os to date.

I'm not being a fanboy - I sincerely do not know how you arrive at that, nor what evidence supports it.

I'd go along with "most secure MS OS to date" - but most secure? When my absolute safety depends on it, I'd choose OpenBSD.

Just like *nix, most infections are trapped in the user domain, and unless they are complete idiots with their sytem, and run full admin all the time,

ok. But - it's only fair to point out that OS X users have enjoyed that protection for nearly a decade - and further, rather than relying on ACLs, even privileged users had to sudo first before being granted the access to that damage.

Now about my "hacking" days. I really wasn't a real hacker per se, as most (probably not you) people have the definition of a real hacker completely wrong.

Ja wohl.

What I was, is more along the lines of a script kiddie/program cracker, making modifications to sub7 servers to be undetectable, port scanning, packag

It's only fair to warn you that up until that time, and for nearly two decades before it, I used to read raw hex dumps of memory, xlate portions into op codes mentally, and inject fixes to defective code from there. (thank you, Ward Christensen)

And until broadband was fully established, I could whistle (unassisted) modem codes into a handset at 1200 baud and connect to whatever I needed to when hardware was p*ssing me off. (thank you Capt Crunch)

I've written symmetric multiprocessors completely in assembly, whole cloth, from bare metal.

You might give that a go, then move on to stripping away parts of Windows, transparent to the user, and replace its entire i/o and job processing for data acquistion or the like, reassembling the OS on your way out, leaving no trace - and then see what you think of Windows' process management and security.

That said, they gained my respect in Win2k, XP sp2, and now Win7 - but - it's still Windows.

This was also during my early teen years, and even single digits. Once I started reading stories of people getting caught, and tossed in jail, I immed

Good boy - seriously, no downcasting nor sarcasm. 2600 is no way to live. No way at all.

Keep in mind all of this is 100% self taught, and my actual education is in liberal arts lol... but now I'm at a crossroads. I really like the mobile

There's not a thing wrong with being an autodicact so long as you remember this maxim:

Don't believe everything you think.

You'll find to your chagrin that things that are making perfect sense today need to be deconstructed and reassembled to be seen for what they really are. Mark these words.

But back on topic. When mac does get hit, it'll be just like most windows users. 100% user error, either an email or porn site they shouldn't have ope

We'll just have to see.

And to blow us all away, the scariest thing is, they are inching closer and closer to quantum computing. And when that happens, no networked computer

I think you'd do well to also read by Stephenson, In The Beginning Was The Command Line (now available as a free PDF download(yeah, great, they're charging for it again - but not if you know where to look), and also his Snow Crash - not to mention Gibson's Neuromancer.

And if you'd like to know the epigenesis of the title, Burning Chrome (one of Gibson's best short stories, that begins, "It was the night we burned chrome...") - that's a reference to fusing nickel chromium (nichrome) junctions from the only tech we had available when we used to burn our own ROMs, prior to UVPROMs, EEPROMs and the like.

Seriously - cut OS X and Linux a bit more slack and trust me - they're mighty secure indeed.

Actually the big OS's these days would take some serious programming and machine power to crack from outside these days, all of them. Most of it always boils down to something the user did. So it can happen on any OS. And my winxp setup is still very secure, with two backup admin accounts, and my user profile. All my important files are stored on RAID server TB drives(awesome for my home network access!) And that's the way it should be done. Then again, I don't go around trying to steal program licenses and visit questionable sites, too.

EDIT: ALSO! Since iOs is really just a stripped down OSX, the safari exploits would be just as dangerous on iPads/iPhone etc... and I would presume they'd be more numerous.

Tapatalk. Samsung Moment. Yep.

 

[EarlyMon]

Geez - I just realized that I've assumed all Mac owners have socialized this info, but maybe not:

If you use OS X read this!

The biggest source of malware is the quality control behind the Apple software update process.

Here's your survival guide:

1. Never auto-update and never update the day it becomes available. Wait at least two days for all updates from Apple for the OS.
2. Always run Applications -> Utilities -> Disk Utilities ... Repair Permissions

I'm sure that's all fixed years ago and you don't need to follow my advice.

Unless you want to be safe from a bad update.

I think Microsoft may be superior in this regard - but I don't trust any of them - I advise to always wait a few days before updating. Even for security threats - because you're getting those late from all commercial OS vendors (Apple's just been the tardiest, usually) - and a few more days isn't as likely to kill you as a screwed update package.

 

[Caloy]

I'm no hacker, nor am I a computer whiz, but I haven't had a virus in almost 20 years. I would guess that the majority of Windows users would be in the same boat. If this is true, then would it be safe to assume that all this vulnerability issue with Windows really just sensationalized?

And eversince AVG came out, I've never paid for an Anti-virus program since.

 

[IOWA]

Geez - I just realized that I've assumed all Mac owners have socialized this info, but maybe not:

If you use OS X read this!

The biggest source of malware is the quality control behind the Apple software update process.

Here's your survival guide:



[*] Never auto-update and never update the day it becomes available. Wait at least two days for all updates from Apple for the OS.
[*] Always run Applications -> Utilities -> Disk Utilities ... Repair Permissions


I'm sure that's all fixed years ago and you don't need to follow my advice.

Unless you want to be safe from a bad update.

I think Microsoft may be superior in this regard - but I don't trust any of them - I advise to always wait a few days before updating. Even for security threats - because you're getting those late from all commercial OS vendors (Apple's just been the tardiest, usually) - and a few more days isn't as likely to kill you as a screwed update package.

Agreed. Early adopting anything is dangerous. And I felt my hand to the frying pan when I foolishly early adopted my samsung moment, but it serves as a good reminder. However, given the choice again, and the same circumstances, I probably would have gone with another touch pro 2 as a replacement. But the samsung moment has still been fun to work with, none-the-less.

Tapatalk. Samsung Moment. Yep.

 

[EarlyMon]

I'm no hacker, nor am I a computer whiz, but I haven't had a virus in almost 20 years. I would guess that the majority of Windows users would be in the same boat. If this is true, then would it be safe to assume that all this vulnerability issue with Windows really just sensationalized?

Yes and no.

I believe that the popular press and especially the security software vendors sensationalize it.

But - I question your idea about the majority of Windows users being similarly safe.

First, and this is the OCD mathematician in me, we can't know about the majority. That's minor. I got it out of my system. Now ignore it.

But really, the problem is that Windows is hugely the number one OS, in the country, and I'd assume still worldwide.

That doesn't go to supporting the point about things like OS X being lesser targets because of the numbers.

It goes to the following point: Years ago, Windows crept into financial systems at the worst possible point in time. The selection was made for popularity and because "you could do everything" and first and foremost for cost considerations - not with regard to getting what you pay for and stopping to notice what security luxuries were being given up as many mini-computers fell by the wayside. [*]

We pay attention to viruses especially because our business systems tend to be tied together through Windows. And when the business community gets hit - and it does, (what? help me out somebuddy) every few years - it causes serious trouble for everyone. Those cases are truly sensational, not gratuitously sensational.

In my (weak) estimation, business is the real target - anywhere that economic harm can be doled out seems to be the real thrill (my opinion).

And eversince AVG came out, I've never paid for an Anti-virus program since.

ThankYouThankYouThankYou! - I wanted to mention it in my rant above, I forgot its name, I'm away from a Win computer.

Yes - I like and always recommend AVG. It's interface has a been a bit obtuse at times, but the price is right for home users, and it seems to do the job for me.


[*] Those systems, however, were always targets of direct attack. Ironically, it's still direct attack that we should really worry the most about.

And - having lived through duck and cover drills and watching the Berlin Wall get torn down and the implosion of the Soviet Union - I cannot believe that in 2010 I'm actually saying this (shades of Dylan's 115th Dream):

Beware of the Russians.

SEC Accuses Russian Hacker of Manipulating Stock Prices

Russian Hacker Sentenced to Four Years in Prison for Supervising Criminal Enterprise Dedicated to Computer Hacking, Fraud and Extortion and Victimizing Glen Rock Financial Services Company (July 25, 2003)

Russian hackers attacked U.S. Central Command's networks | Homeland Security News Wire

Hackers Take Down the Most Wired Country in Europe

Lions and tigers and bears and China and Russia, oh my!

 

[IOWA]

I'm no hacker, nor am I a computer whiz, but I haven't had a virus in almost 20 years. I would guess that the majority of Windows users would be in th

Yes and no.

I believe that the popular press and especially the security software vendors sensationalize it.

But - I question your idea about the majority of Windows users being similarly safe.

First, and this is the OCD mathematician in me, we can't know about the majority. That's minor. I got it out of my system. Now ignore it.

But really, the problem is that Windows is hugely the number one OS, in the country, and I'd assume still worldwide.

That doesn't go to supporting the point about things like OS X being lesser targets because of the numbers.

It goes to the following point: Years ago, Windows crept into financial systems at the worst possible point in time. The selection was made for popularity and because "you could do everything" and first and foremost for cost considerations - not with regard to getting what you pay for and stopping to notice what security luxuries were being given up as many mini-computers fell by the wayside.
[*]

We pay attention to viruses especially because our business systems tend to be tied together through Windows. And when the business community gets hit - and it does, (what? help me out somebuddy) every few years - it causes serious trouble for everyone. Those cases are truly sensational, not gratuitously sensational.

In my (weak) estimation, business is the real target - anywhere that economic harm can be doled out seems to be the real thrill (my opinion).

And eversince AVG came out, I've never paid for an Anti-virus program since.

ThankYouThankYouThankYou! - I wanted to mention it in my rant above, I forgot its name, I'm away from a Win computer.

Yes - I like and always recommend AVG. It's interface has a been a bit obtuse at times, but the price is right for home users, and it seems to do the job for me.


[*] Those systems, however, were always targets of direct attack. Ironically, it's still direct attack that we should really worry the most about.

And - having lived through duck and cover drills and watching the Berlin Wall get torn down and the implosion of the Soviet Union - I cannot believe that in 2010 I'm actually saying this (shades of Dylan's 115th Dream):

Beware of the Russians.

SEC Accuses Russian Hacker of Manipulating Stock Prices

Russian Hacker Sentenced to Four Years in Prison for Supervising Criminal Enterprise Dedicated to Computer Hacking, Fraud and Extortion and Victimizing Glen Rock Financial Services Company (July 25, 2003)

Russian hackers attacked U.S. Central Command's networks | Homeland Security News Wire

Hackers Take Down the Most Wired Country in Europe

Lions and tigers and bears and China and Russia, oh my!

Id be more afraid of china personally.

Tapatalk. Samsung Moment. Yep.

 

[amw1972]

happened to me a couple of months ago...and a cousin of mine a few months before that.

its not the EVO

 

[bbenny]

Mine was hacked too. On Sunday just 2 days after getting EVO. Viagra emails sent to a few dozen people, then Gmail finally locked my account. I had barely even used the phone up to that point, but i'm about 99% sure it was hacked through the EVO because I rarely use the gmail account email.

thx for helping the cause. I'm not crazy, and am not dumb enough to get a virus or be "phished", i'm sorry. it has to be evo related, the coincidence it far to clear.

I've had that gmail account for years with no spam, and no security issues. i switch to android, and am spammed all day, plus the account hacking. idk, can't say for sure. Just wanted to get a feel for this happening to others.

thx.

 

[EarlyMon]

thx for helping the cause. I'm not crazy, and am not dumb enough to get a virus or be "phished", i'm sorry. it has to be evo related, the coincidence it far to clear.

I've had that gmail account for years with no spam, and no security issues. i switch to android, and am spammed all day, plus the account hacking. idk, can't say for sure. Just wanted to get a feel for this happening to others.

thx.

I'm wondering how many of you are using facebook. Just to see some pix a buddy insisted on uploading there, I got a facebook account - it warned me that my password would be sent in the clear on login. I used a dummy email account, and sure enough, that one was cracked.

Buh bye, facebook.

I've no doubt something is going on - a rogue app or something.

But the EVO or Android per se - not enough of us are suffering - and this is a vocal community, and there have been a LOT of views of this thread - so I'd have to think you were taken in by a scam.

Assuming you guys aren't drive-by posters, I wonder if you wouldn't mind saying what extra apps you've installed?

Maybe working together the culprit can be found. If I'm right, you have an app in common....

 

[Braaainz]

Okay, i wonder if the facebook app might be a problem. I'm not getting spam on gmail, but my hotmail account that is synced is suddenly being beset by friend invites from Windows live... and they happen to share the same names as former Facebook friends (i closed my Facebook account a few months ago).

The thing is, that hotmail account is totally separate from Facebook... those friends shouldn't even be aware of it and they didn't send the invites.

 

[thegabrielj]

mine was sent from my old hotmail account the only place i used it was to log into my facebook thru the ally so something must have access thru it... i didnt make the connection untill u just mentioned it

 

[Ravensthief]

Which app is this? The HTC friend stream, the Facebook for Android? The app published by Facebook themselves, or something else? Could it just be Facebook and not related to the Evo at all?

 

[newone757]

today my gmail account was hacked and spam was sent from me to my entire email contact list.

here were the suspect IP's, and the message was about viagra pills. embarrassing to say the least.

Mobile Romania (89.37.187.9) 5:47 pm (1 hour ago)

Mobile United States (CA) (173.117.223.143) 12:16 pm (6 hours ago)


I have a very complex password and am a web developer that is very anal about privacy and security. had gmail for years, and just got the evo, and then this happens days later. not pleased at all.

has this happened to anybody else?

I had this happen a couple months before i even got the Evo so stop trying to blame the Evo. It is common now and pretty widespread, tighten up google

Hacked Gmail Accounts Hawking Viagra

Personally i think i was exposed using google chrome, happened to me right around the time i finally gave in a tried chrome. changed my password and it was still happening. Uninstalled chrome and it hasnt happened since. Prolly has nothing to do with chrome, Im thinking googles getting hacked server side, prolly china lol

 

[EarlyMon]

Which app is this? The HTC friend stream, the Facebook for Android? The app published by Facebook themselves, or something else? Could it just be Facebook and not related to the Evo at all?

I was accessing FB via Firefox on my desktop, fwiw.

Personally i think i was exposed using google chrome, happened to me right around the time i finally gave in a tried chrome. changed my password and it was still happening. Uninstalled chrome and it hasnt happened since. Prolly has nothing to do with chrome, Im thinking googles getting hacked server side, prolly china lol

Could be.

 

[EarlyMon]

How Android, Chrome, and the iPad are shielding us from malware. - By Farhad Manjoo - Slate Magazine

 

[newone757]

I personally dont think android is all that secure. I mean, it is, but the end users arent. How many people actually read the permissions when downloading an app from the market? How many people actually let those permissions deter them from installing that app?

How easy is it for a trusted established app, to release a new update to the market with a new permission added that users wont even read, and then start stealing all kinds of log in and personal info?


I appreciate the apps letting you know what they access, just wish there was an option to deny some of those permissions but still use the app (obviously some features of it being crippled, thats fine)

 

[IOWA]

I'm wondering how many of you are using facebook. Just to see some pix a buddy insisted on uploading there, I got a facebook account - it warned me that my password would be sent in the clear on login. I used a dummy email account, and sure enough, that one was cracked.

Buh bye, facebook.

I've no doubt something is going on - a rogue app or something.

But the EVO or Android per se - not enough of us are suffering - and this is a vocal community, and there have been a LOT of views of this thread - so I'd have to think you were taken in by a scam.

Assuming you guys aren't drive-by posters, I wonder if you wouldn't mind saying what extra apps you've installed?

Maybe working together the culprit can be found. If I'm right, you have an app in common....

Yeah it seems facebook is getting cracked left and right. Hence the purpose for what I call junk email accounts, totally unrelated to my important stuff. I use it for forum signups, engadget commenting, facebook, etc.

I personally dont think android is all that secure. I mean, it is, but the end users arent. How many people actually read the permissions when downloading an app from the market? How many people actually let those permissions deter them from installing that app?

How easy is it for a trusted established app, to release a new update to the market with a new permission added that users wont even read, and then start stealing all kinds of log in and personal info?


I appreciate the apps letting you know what they access, just wish there was an option to deny some of those permissions but still use the app (obviously some features of it being crippled, thats fine)

Yeah, with any OS these days, it almost always boils down to user error.

 

[GadgetGator]

That's not even true. There are some viruses but mostly there are trojans (there is a difference.) The old "you can't get a virus on a mac" adage died years ago, just that fanbois and Apple themselves didn't want to admit to it.

But now they do. Apple sells Norton Anti-Virus right in the Apple Store. Unless Apple are pushing software that does absolutely nothing, there must be something out there.

Or, take a look at all these OS X security updates. These aren't feature fixes, these aren't simple bug fixes, these are security updates. Each patch fixes a security hole that could (and may have) been used by malware, viruses and trojans.

Yes...let's take a look at the Apple site shall we...and what do we find?

The reason Apple sells Norton is to quiet all the windows switchers that ask for an Anti-virus program when they are buying the computer. Not some real threat. And hey..they make some money on it too. But clearly it is not needed. If it were, millions of Macs would be infected since most do not have Norton (or similar) installed. If there were real threats, not only would Macs be infected all over the place, but Apple would be pre-installing an Anti-virus program with every Mac sold. Since they don't, and since they even crow about the lack of virus susceptibility right on their website, what you are saying just isn't the case.

If you (mistakenly) think that the you can't get a virus on a mac" adage died years ago, then you need to go visit Apple's site:

Apple - Why You?ll Love a Mac - It has a better operating system.

 

[JOFOX]

today my gmail account was hacked and spam was sent from me to my entire email contact list.

here were the suspect IP's, and the message was about viagra pills. embarrassing to say the least.

Mobile Romania (89.37.187.9) 5:47 pm (1 hour ago)

Mobile United States (CA) (173.117.223.143) 12:16 pm (6 hours ago)


I have a very complex password and am a web developer that is very anal about privacy and security. had gmail for years, and just got the evo, and then this happens days later. not pleased at all.

has this happened to anybody else?

While im reading this post now, i was checking my email and checked the spam folder i have one email sent from my account to myself about Viagra pills!!!

 

[GaryColeman]

While im reading this post now, i was checking my email and checked the spam folder i have one email sent from my account to myself about Viagra pills!!!

Maybe you're trying to tell yourself something. Next one will be hacked from your girlfriend's account sent to you regarding "enlargement" pills. Well at least she will claim her account was hacked.

 

[CriticalMass]

What makes you think it had something to do with the EVO other than that it was coincidental timing?
Spammers are usually pretty good with proxies too, those addresses probably aren't anywhere close to the truth

I just got my droid x. and 2 days later my gmail account was hacked after owning the account for 5 years. However I do not believe it had anything to do with the phone itself as for the last 12 months someone has been running a brute force program as I've been getting messages about attempts here and there. i changed the PW 2 weeks ago and blam. hacked.

Waiting for recovery now.

Then spam that was sent from my account was that I was in London and got robbed. lol.

 

[Traceamount]

waste time with Macs.

Exactly.