I know you guys have been getting some bad press lately, and as an SEO I can understand why, but I can only compliment you in this move to alert people who are probably going to be hit by trying to be good, no scrub that, outstanding citizens by trying to bring the truth to the masses. It is hard enough for us to get the message across in the west, in places where state sanctioned violence is commonplace, say Syria for example, then this initiative by Google is invaluable. It does in my book keep you above Microsoft.
I'd imagine that the people who are targeted by these attacks will know exactly which state would be interested in hacking into their account. Good on ya Google.
If you see this warning it does not necessarily mean that your account has been hijacked. It just means that we believe you may be a target, of phishing or malware for example, and that you should take immediate steps to secure your account.
I had this happen a few months ago. I got a rather worthless message after the fact (I did have a secondary email registered for such reasons) stating that my account had been compromised and I was alerted that there were current sessions open (in the Eastern block of Europe - I'm in Canada).
What boggles my mind is that Google's "crack security team" here had really nothing to offer other than "close the sessions" and change the password.
What Google and you are telling the entire world is that Google's security team is lazy; rather than just detect and log the incident, how about block/ignore/redirect brute force requests/logins?
Seriously, you guys want us to trust you with something like Google+ and this is what you have to offer for security? Fail!
Wow... Are there enough people wearing white collars and eating Swanson TV dinners to strike the fear nuclear war into everybody?
June 5, 2012 at 9:51 PM
Anonymous said...
Since New York Times recently reported that Stuxnet is a US State Sponsored Cyber virus - which if you recall was accidentally released into the wild and affected and attacked innocent end-user machines as collateral damage, and with the ongoing US-Israeli state sponsored cyber warfare weapons of mass destruction (operation Olympic Games) including the more recent Duqu and Flame virus.... can Google clarify if through its detailed analysis as well as victim reports if Google will apply the same standards and warn end-users of these domestic state sponsored attacks as well? Or are exceptions of convenience made in these cases due to the close and special ties that Google has with the US intelligence agencies and the confirmed but secret and classified collaboration that the Google has with the CIA and NSA in regards to GMail and Google Accounts?
On a lighter note, hikingfan lives a more interesting life than I figured if he's attracted the attention of state actors.
June 6, 2012 at 1:19 AM
Anonymous said...
I believe it should be at a macro level by determining how many users will be affected by same pattern etc.. (using complex methods like geography, type of users, area of attack and so on..)
I think it's good to warn users of suspicious activities, but my guess is that there also are activities like US surveillance that will not be announced, because of local court orders. Google is in no way independent.
@Adrian: no, I'm pretty certain that this is simply identifying known or likely items within an email that you receive.
@eroei1021: given that Stuxnet, Duqu, Flame do not, to the best of my knowledge, rely on phishing emails as a delivery vector, this would not apply to them.
"We can’t go into the details without giving away information that would be helpful to these bad actors ..." and we would never dream of sharing and technical insights that might help the competition provide you the same level of security as we do, that would affect our bottom line. Right?
Oh, and could you please get one of your writers to pick a dictionary and use a slightly more specific qualifier than 'bad' for the actors? What is 'bad' anyway? Sure Google is a young high tech company, but dismissing 2000 years of research into human morality by using such childish language : 'the good guys vs. the bad guys' is way below the level of maturity we've come to expect out of google.
With Makaseh (makaseh.wordpress.com) this will not possible. Data can only be exchanged with the makaseh ids created. Data intercepted, copied or shared without authorization by the originator cannot be viewed and any attempt to break it, will send a cautionary note to the originator with the ip address, email details etc. Repeated attempts may even lead to the deactivation of the culprit userid.
Given that you provide a similar service for detecting improper email access, I'd be concerned. I've seen a quite definite fail of that service with my mother's GMail account. Apparently someone was remote accessing her account using an email program (not a browser) to comb her contacts and send spam. We are in the Central U.S.A. Her account IP log showed the two hits from someone in Mexico, yet the service did not detect, or flag, this irregular IP address.
@AvelWorldCreator: That is a good point. I am familiar with that light blue framed page from Google Gmail. It provides a record of IP addresses and approximate locations, at a country level (and for the U.S., at state but not city level) from where one's account was recently accessed. About a year ago, I received an email from Google Gmail, advising me that there may have been some unusual recent activity on my account. It was mildly worded, nothing about powers of a foreign nation or such. Indeed, there was multiple access from 2 different IP's in Iran via IMAP or POP, and 3 from Arizona, via browser. All were within a 24-hour interval. I have never accessed Gmail from anywhere other than Arizona, so it was a good catch by Gmail.
On the other occasion, I did not receive any warning. I had just happened to check the same unusual activity link, which often resides at the footer of my Gmail inbox screen, even when all is well. Reddit offers a similar feature, in fact. So anyway, I was curious, given the Arizona-and-Iran incident of a few weeks prior. I was surprised to find a pattern of access, in alternating sequence, at less than 60 minute intervals, between my Arizona IP address and one in Washington State. Once again, Arizona access was by browser, and the other IP via IMAP. I tracked the latter to Amazon dot com's legal department. I never found out why they (or someone using EC2 or AWS perhaps?) would be reading my email. Nor did Google flag this as unusual activity.
I took screen shots, both times, but have no idea who to send it to. Or if Google would even consider it pertinent. I can't imagine why anyone, whether Iran or Amazon dot com, would want to access my boring and inconsequential information. Botnet perhaps, for spam purposes? Well, not by Amazon!
@Eric Grosse of Google Security Engineering: What is the difference is between the IP notification screen that I just alluded (at excessive length) and this new notification? Yes, I realize that they appear in different places, and have different wording. But does the Gmail-related anomalous IP message have any relationship to, or is it indicative of, the same problems flagged by this new message i.e. if I am afflicted by one problem, am I also compromised by the other?
June 14, 2012 at 7:46 AM
Anonymous said...
This is great news. Thank you google for helping us combat these perpetrators.
August 20, 2012 at 11:09 AM
Anonymous said...
I saw this security warning the other day and i was baffled to say the least. It was right after I was looking at home security systems reviews online too. What a coincidence.
February 13, 2013 at 6:47 PM
Posted by Eric Grosse, VP Security Engineering
We are constantly on the lookout for malicious activity on our systems, in particular attempts by third parties to log into users’ accounts unauthorized. When we have specific intelligence—either directly from users or from our own monitoring efforts—we show clear warning signs and put in place extra roadblocks to thwart these bad actors.
Today, we’re taking that a step further for a subset of our users, who we believe may be the target of state-sponsored attacks. You can see what this new warning looks like here:
[Image]
If you see this warning it does not necessarily mean that your account has been hijacked. It just means that we believe you may be a target, of phishing or malware for example, and that you should take immediate steps to secure your account. Here are some things you should do immediately: create a unique password that has a good mix of capital and lowercase letters, as well punctuation marks and numbers; enable 2-step verification as additional security; and update your browser, operating system, plugins, and document editors. Attackers often send links to fake sign-in pages to try to steal your password, so be careful about where you sign in to Google and look for https://accounts.google.com/ in your browser bar. These warnings are not being shown because Google’s internal systems have been compromised or because of a particular attack.
You might ask how we know this activity is state-sponsored. We can’t go into the details without giving away information that would be helpful to these bad actors, but our detailed analysis—as well as victim reports—strongly suggest the involvement of states or groups that are state-sponsored.
We believe it is our duty to be proactive in notifying users about attacks or potential attacks so that they can take action to protect their information. And we will continue to update these notifications based on the latest information.
32 Comments
Close this window Jump to comment formI still wonder how. Some custom plugin or HTTP header?
June 5, 2012 at 3:42 PM
Except when it comes to USGov intrusion, which is where Google makes half its money.
June 5, 2012 at 3:53 PM
I know you guys have been getting some bad press lately, and as an SEO I can understand why, but I can only compliment you in this move to alert people who are probably going to be hit by trying to be good, no scrub that, outstanding citizens by trying to bring the truth to the masses.
It is hard enough for us to get the message across in the west, in places where state sanctioned violence is commonplace, say Syria for example, then this initiative by Google is invaluable.
It does in my book keep you above Microsoft.
June 5, 2012 at 4:37 PM
Does this include activity from government actors such as municipal and state police forces? how about federal agencies (or .gov IP blocks)? Thanks!
June 5, 2012 at 4:37 PM
Wow.
June 5, 2012 at 5:05 PM
I applaud this warning and would only hope that in cases where evidence is strong enough the state in question is identified to the user.
June 5, 2012 at 5:08 PM
This is helpful information, we will help spread the word.
June 5, 2012 at 5:25 PM
Why would an end user care? Surely this is state-sponsored propaganda?
June 5, 2012 at 5:29 PM
I'd imagine that the people who are targeted by these attacks will know exactly which state would be interested in hacking into their account. Good on ya Google.
June 5, 2012 at 6:25 PM
Any chance of a link to the page?
June 5, 2012 at 7:43 PM
If you see this warning it does not necessarily mean that your account has been hijacked. It just means that we believe you may be a target, of phishing or malware for example, and that you should take immediate steps to secure your account.
I had this happen a few months ago. I got a rather worthless message after the fact (I did have a secondary email registered for such reasons) stating that my account had been compromised and I was alerted that there were current sessions open (in the Eastern block of Europe - I'm in Canada).
What boggles my mind is that Google's "crack security team" here had really nothing to offer other than "close the sessions" and change the password.
What Google and you are telling the entire world is that Google's security team is lazy; rather than just detect and log the incident, how about block/ignore/redirect brute force requests/logins?
Seriously, you guys want us to trust you with something like Google+ and this is what you have to offer for security? Fail!
June 5, 2012 at 8:04 PM
Wow... Are there enough people wearing white collars and eating Swanson TV dinners to strike the fear nuclear war into everybody?
June 5, 2012 at 9:51 PM
Since New York Times recently reported that Stuxnet is a US State Sponsored Cyber virus - which if you recall was accidentally released into the wild and affected and attacked innocent end-user machines as collateral damage, and with the ongoing US-Israeli state sponsored cyber warfare weapons of mass destruction (operation Olympic Games) including the more recent Duqu and Flame virus.... can Google clarify if through its detailed analysis as well as victim reports if Google will apply the same standards and warn end-users of these domestic state sponsored attacks as well? Or are exceptions of convenience made in these cases due to the close and special ties that Google has with the US intelligence agencies and the confirmed but secret and classified collaboration that the Google has with the CIA and NSA in regards to GMail and Google Accounts?
June 5, 2012 at 10:52 PM
It's from the PRC
People Republic of China
June 5, 2012 at 11:29 PM
Google, I'm impressed by you going out on a limb so far. I applaud this warning and will help spread the word.
Well, you are not being evil, after all.
June 5, 2012 at 11:43 PM
Non US sponsored attacks - right ??
June 6, 2012 at 12:18 AM
I THINK THEY ARE TAKING ABOUT CHINESE GOVERNMENT
June 6, 2012 at 1:05 AM
On a lighter note, hikingfan lives a more interesting life than I figured if he's attracted the attention of state actors.
June 6, 2012 at 1:19 AM
I believe it should be at a macro level by determining how many users will be affected by same pattern etc.. (using complex methods like geography, type of users, area of attack and so on..)
regards
www.diaryfolio.com
June 6, 2012 at 2:30 AM
I think it's good to warn users of suspicious activities, but my guess is that there also are activities like US surveillance that will not be announced, because of local court orders. Google is in no way independent.
June 6, 2012 at 5:36 AM
Will Google alert users possibly infected by other types of malware than DNSChanger and not connected with certain .gov-targeted attacks?
For example i'm infected with some type of rootkit, which added my PC to botnet. My AV system doesn't alerts me - do Google system will alert me?
June 6, 2012 at 6:15 AM
...good step in the right direction, if and only if there would be no bias with respect to the states behind the attacks...
June 6, 2012 at 7:32 AM
@Adrian: no, I'm pretty certain that this is simply identifying known or likely items within an email that you receive.
@eroei1021: given that Stuxnet, Duqu, Flame do not, to the best of my knowledge, rely on phishing emails as a delivery vector, this would not apply to them.
June 6, 2012 at 10:28 AM
This entire page requires a premise that states do not act for our good -- but that they instead often act maliciously.
What steps can we take to insure that authorities and majorities are not able to trample on our rights to life, liberty, and property?
June 6, 2012 at 12:22 PM
"We can’t go into the details without giving away information that would be helpful to these bad actors ..." and we would never dream of sharing and technical insights that might help the competition provide you the same level of security as we do, that would affect our bottom line. Right?
Oh, and could you please get one of your writers to pick a dictionary and use a slightly more specific qualifier than 'bad' for the actors? What is 'bad' anyway? Sure Google is a young high tech company, but dismissing 2000 years of research into human morality by using such childish language : 'the good guys vs. the bad guys' is way below the level of maturity we've come to expect out of google.
June 6, 2012 at 1:10 PM
With Makaseh (makaseh.wordpress.com) this will not possible. Data can only be exchanged with the makaseh ids created. Data intercepted, copied or shared without authorization by the originator cannot be viewed and any attempt to break it, will send a cautionary note to the originator with the ip address, email details etc. Repeated attempts may even lead to the deactivation of the culprit userid.
June 10, 2012 at 12:37 AM
If self promotion is shameless, how about companies that intrude privacy, steal information from data stored and use it for profit.
June 11, 2012 at 2:59 AM
« state-sponsored »‽ Florida, Iran, North Korea‽
This captcha is not disability accessible.
June 12, 2012 at 8:25 PM
Given that you provide a similar service for detecting improper email access, I'd be concerned. I've seen a quite definite fail of that service with my mother's GMail account. Apparently someone was remote accessing her account using an email program (not a browser) to comb her contacts and send spam. We are in the Central U.S.A. Her account IP log showed the two hits from someone in Mexico, yet the service did not detect, or flag, this irregular IP address.
June 13, 2012 at 9:47 PM
@AvelWorldCreator: That is a good point. I am familiar with that light blue framed page from Google Gmail. It provides a record of IP addresses and approximate locations, at a country level (and for the U.S., at state but not city level) from where one's account was recently accessed. About a year ago, I received an email from Google Gmail, advising me that there may have been some unusual recent activity on my account. It was mildly worded, nothing about powers of a foreign nation or such. Indeed, there was multiple access from 2 different IP's in Iran via IMAP or POP, and 3 from Arizona, via browser. All were within a 24-hour interval. I have never accessed Gmail from anywhere other than Arizona, so it was a good catch by Gmail.
On the other occasion, I did not receive any warning. I had just happened to check the same unusual activity link, which often resides at the footer of my Gmail inbox screen, even when all is well. Reddit offers a similar feature, in fact. So anyway, I was curious, given the Arizona-and-Iran incident of a few weeks prior. I was surprised to find a pattern of access, in alternating sequence, at less than 60 minute intervals, between my Arizona IP address and one in Washington State. Once again, Arizona access was by browser, and the other IP via IMAP. I tracked the latter to Amazon dot com's legal department. I never found out why they (or someone using EC2 or AWS perhaps?) would be reading my email. Nor did Google flag this as unusual activity.
I took screen shots, both times, but have no idea who to send it to. Or if Google would even consider it pertinent. I can't imagine why anyone, whether Iran or Amazon dot com, would want to access my boring and inconsequential information. Botnet perhaps, for spam purposes? Well, not by Amazon!
@Eric Grosse of Google Security Engineering: What is the difference is between the IP notification screen that I just alluded (at excessive length) and this new notification? Yes, I realize that they appear in different places, and have different wording. But does the Gmail-related anomalous IP message have any relationship to, or is it indicative of, the same problems flagged by this new message i.e. if I am afflicted by one problem, am I also compromised by the other?
June 14, 2012 at 7:46 AM
This is great news. Thank you google for helping us combat these perpetrators.
August 20, 2012 at 11:09 AM
I saw this security warning the other day and i was baffled to say the least. It was right after I was looking at home security systems reviews online too. What a coincidence.
February 13, 2013 at 6:47 PM