Heads up (hacked)

[SkyHog]

I dunno how, but a gmail account that I haven't used in months (if not over a year) suddenly sent out spam to every address it could scrape from the inbox.

If you received email from [email protected] please delete it. Do not respond, and do not open anything sent from that address.

Thanks.

 

[SkyHog]

BTW, if anyone got one of those emails, please post the header here (not to that gmail account), so I can try to find some info.

 

[SkyHog]

Bastards!!!

Mobile China (58.19.197.157) 9:22 pm (20 minutes ago)

Anyone know this guy:
person: Zhenchao Wang
nic-hdl: ZW1386-AP
e-mail: [email protected]
address: +86719 8010015
phone: +86719 8010015
country: CN
changed: [email protected] 20080819
mnt-by: MAINT-CNCGROUP-HB
source: APNIC

 

[SCCutler]

I got one... deleted already.

Viagra, indeed!

 

[RJM62]

Bastards!!!

Mobile China (58.19.197.157) 9:22 pm (20 minutes ago)

Gee, there's a surprise...

Anyone know this guy:
person: Zhenchao Wang
nic-hdl: ZW1386-AP
e-mail: [email protected]
address: +86719 8010015
phone: +86719 8010015
country: CN
changed: [email protected] 20080819
mnt-by: MAINT-CNCGROUP-HB
source: APNIC

Both names are rather common, especially Wang. There probably are tens of thousands (if not more) Zhenchao Wangs.

CNCGROUP is China Telecom, a major ISP and Web hosting company in China.

-Rich

 

[flyersfan31]

Could you set up a gmail (or whatever free service) and return the favor to Mr. Wang???

 

[RJM62]

Mr. Wang may be one of the good guys. He may work for China Telecom and have nothing to do with the attackers. Or maybe not.

The IP is also listed in a few RBLs, but at least two of the listings seem to be for configuration problems rather than known spamming, one is from someone like me who blocked the whole country (although I didn't announce it to the whole world), and one of them seems to be of the whole netrange. The IP may be owned by a hosting company and shared by multiple users.

http://www.mxtoolbox.com/SuperTool.aspx?action=blacklist%3a58.19.197.157

-Rich

EDIT: It was added to another RBL since I posted...

 

[ScottM]

The entire Google password database, including admin passwords, was hacked not too long ago. This is not surprising at all.

 

[AuntPeggy]

The entire Google password database, including admin passwords, was hacked not too long ago. This is not surprising at all.

But, they say that gmail passwords were not hacked.

 

[rpadula]

Saw on slashdot a couple of days ago that the source code to Google's authentication system had been stolen in the Chinese break-in.

Oh, and while searching for that story, there's a more recent one on the rise in Gmail spam, particularly through the mobile interface, which seems to jive with Nick's header posted above.

Google's answer page on what to do.