Spam

[Jonathan]

Lately I have been getting spam from people who seem to have access to my gmail contact list. Anyone else have this problem?

[VLSmooth]

Maybe it's the same thing that hit me today?

I'll investigate further when I get the chance. Immediate damage reduction has taken way too much time

I'm very sorry for the spam. The immediate issue has been addressed [1].

-Vincent





[1] Purely Optional Details

Background
* From ~8:08am EDT to ~8:32am EDT this account sent 305 unique e-mail addresses spam consisting of a short line and single link to email.about.com
* According to Google's 'Activity Information', a California IP (208.87.200.180) accessed my account at the time of the mailings and around 8 pm yesterday (2011-05-25)

Actions Taken
* Immediately changed my passwords and revoked IMAP access
* Requested fraud alerts from the big three credit bureaus

Notes
* It's likely that the spammer somehow got my password
* This does not seem like spoofing, since I have records of the sent e-mails
* I'm working through the Gmail Security Checklist
* Thanks to those that quickly responded which hopefully reduced the damage
* On the bright side, I've learned interesting characteristics of my e-mail thanks to this exercise and Perl.
* Ironically, my spam honeypot addresses were not compromised.

[Jonathan]

Well, I got spam from you twice, so yeah, probably the same thing.

[Jonathan]

How strong was your password? Do you think they brute forced it or not?

[VLSmooth]

My old gmail password was low-to-medium strength, 8-characters consisting of lowercase characters and numbers.

From responses to my spam, there's a decent chance my password was part of the massive PlayStation Network (PSN) leak. I don't remember what my PSN password was; I'll check when I get a chance.

Aside: I think my first sentence's punctuation is wrong. I'm not sure what I should've used instead of a comma since the latter part is a fragment.

[quantus]

Trying to connect to https://mail.google.com today, I get:

This Connection is Untrusted
You have asked Firefox to connect
securely to http://www.google.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely,
sites will present trusted identification to prove that you are
going to the right place. However, this site's identity can't be verified.

Probably just a coincidence in the timing. I get the same message accessing any secure page. I guess IT broke the internet

[quantus]

Yay, IT fixed the issue.

On your original question, my wife's yahoo account has had a similar issue to the one Vinny just had and I've shut off imap/pop access to compensate. However, the account's address book seems like it is still being used to send spoofed mails from her address to others. I'm not sure what to do about that...