Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China:

IP Address: 117.70.121.33
Location: Xuancheng, Anhui, China

and two others.

Is this common?

Could this be done from anywhere around the world or just from China? I mean, if the Chinese firewall will block hackers e.g. from France, US or Israel to access some computer in Xuancheng, Anhui, China and act as a Chinese attack or the wall is preventing from this.

It seems IMO that attacks from China is the most common place of attack. Is this just a coincidence or purposefully doing because it is not easy to ask Chinese government for permission of logs when using China servers for attacks on EU or US targets.


This is in an email from Google:

derfder,

Someone recently tried to use an application to sign in to your Google Account, --------------@gmail.com. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

Tuesday, October 23, 2012 10:06:26 AM GMT
IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

Sincerely,
The Google Accounts Team

share|improve this question
3  
The Chinese Firewall is not really a firewall, the way it is usually meant. It is actually more of a massive outbound content filter. –  AviD Oct 23 '12 at 12:13
1  
I'm not sure what you mean by the fourth paragraph. Could you clarify what security policy you expect the Chinese Firewall to implement? Are you asking whether the attribution of an attack to an IP is high confidence, or are you asking something about the Chinese firewall? –  Mark C. Wallace Oct 23 '12 at 12:43
1  
I should point out, in many cases I have discovered that Google claims access from a particular country, only to find out said access was not possible. So there is no guarantee that somebody actually in China accessed your account. –  Ramhound Oct 23 '12 at 16:31
1  
Well, i had the same situation and It really can be from China, but hacker could also use IP changer. Anywhere, you better change your password and save your mail-box. –  Daruntim Oct 24 '12 at 12:47

3 Answers 3

up vote 2 down vote accepted

Well, there are actually a range of questions in there but the big one is your second last paragraph.

The Internet allows us to be attacked by individuals anywhere in the world.

Access controls help to prevent a lot of attacks, but all of them can be bypassed given enough effort, and this includes the Great Firewall of China along with every other device or application. The only way to be sure is to disconnect your computer entirely, then lock it in a room, and hide the key. And post guards. And watch the guards etc

So this is why security is really a business decision - you can get as much security as you pay for, but if you are a desirable target you need to buy much more security.

Various surveys by companies such as Kaspersky show the apparent sources of attacks, and China is high up there, but so are the US, Eastern Europe, Israel, the Philippines, and a wide range of countries. While some of this data is no doubt correct, some of it is likely to be spoofed by smart attackers routing through machines in other countries.

And the whole issue of getting logs from other countries - it is a nightmare. Many ISP's just won't divulge this info. Some countries block requests entirely.

share|improve this answer
    
+1. I don't think there is much more to tell.. These things happen. –  Henning Klevjer Oct 23 '12 at 12:14
1  
You forgot the underground concrete bunker with a Faraday cage lining the walls. And is that disconnect also from power, or do I need a generator in that room with it? –  ewanm89 Oct 23 '12 at 12:29

I think there is a confusion on the "Great Firewall of China". Isn't the main purpose of this so called firewall to censor some websites ?

At least i wouldn't say the firewall is preventing any chinese hacker to hack all around the world.

Anyway, as RoryAlsop pointed, no firewall could really prevent someone from china to scan/hack someone anywhere in the world. Modern hackers oftenly use hosts all around the world as proxy to hide the real origin of their actions.

Then in that case, could hackers use proxies in china to make people less likely to trace them back ? It could be. It's sure possible to do so.

I would say there is a lot of malicious traffic coming from china more because of it's very important population rather than the protective country's policy on hacking.

share|improve this answer
2  
What do you mean by "very important population"? –  user13779 Oct 23 '12 at 12:28
    
This answer would be stronger if (a) the question were clear and (b) it included references/citations. –  Mark C. Wallace Oct 23 '12 at 12:48
    
@MarkC.Wallace by references/citations you mean screenshot of my Google Mail Account? –  user13779 Oct 23 '12 at 12:58
    
No, but a reference to the firewall would help; the discussion indicates that there is some confusion over the goals/purposes/security policy of that firewall, and I think a citation would transform the discussion away from assertions and into research. The answer could also include a reference out to how hackers use proxies - again, at the moment that is an assertion, but it would be stronger with evidence. Plus "important" vice "large" . I'm not saying this is bad I'm saying that the valuable answers have cites. –  Mark C. Wallace Oct 23 '12 at 14:56
    
@MarkC.Wallace - user15324 can't provide more details because they have no idea what they are talking about. Besides its pretty clear that the Great Firewall of China is an advanced content filter ran at the nation state level. ISPs all over the world filter content, its nothing new, the ISP is just ran by government in this case. –  Ramhound Oct 24 '12 at 15:57

While Google does send similar warnings, this one is clearly a phishing scam trying to steal your account.

Phishing scams include e-mails that request your login:password information, or links to fake web-sites that ask for your login:password. For web-sites, the printed link may look valid but the actual link could go someplace different. They often include threats of closing your account if you don't respond. If the message didn’t come from an @google.com address, it is fake.

You can ignore it, use the drop-down menu next to reply to "Report Phishing", or use the following form: http://mail.google.com/support/bin/request.py?contact_type=abuse_phishing picious messages: http://mail.google.com/support/bin/answer.py?hl=en&answer=29381

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.