Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on fabbricadeisogni2012.it. I checked activity on my account and found SMTP activity originating from some IP in NY which apparently is responsible for sending those e-mails. I warned all the contacts that received those malicious e-mail not to follow the link.

My questions:

  1. Do you think my GMail password has been stolen?
  2. Should I / can I report this activity to Google and/or any Internet security companies, communities, or government agencies?
share|improve this question
1  
Do you not have two-step verification? –  enderland Jan 14 '13 at 18:53

4 Answers 4

There is a chance that your password has been guessed by a bot. You should change your password as soon as possible and check the password recovery mechanism settings (phone number, security questions, alternative emails), to see if they were not changed.

You could report this activity to Google, but I don't think any other company or government agency would give it too much attention, as long as there is not too much harm done.

You should also try using Google's two factor authentication, beside using a strong password.

share|improve this answer
    
Also check for any changes to mail forwarding settings. –  Dan Neely Jan 14 '13 at 19:28
3  
I second enabling 2 factor authentication. It's free, take advantage of it. –  k1DBLITZ Jan 14 '13 at 21:05
    
Is phishing dead ? –  Novice User Jan 15 '13 at 19:14

Assume the worst, change your password and anything that had the same password. It's up to you if you want to notify Google, though they likely won't care too much unless the fraudulent e-mails are reported to them as abuse by someone else.

share|improve this answer
2  
In addition to this, it's a very good idea to follow Google's check list to secure your account from future compromises. –  Adnan Jan 14 '13 at 16:16

Yes, it is extremely likely that your gmail password has been stolen. Those emails wouldn't be in your outbox if they hadn't been sent through google's smtp servers or mail API, and Google requires your credentials to send emails servers, so unless there's an unreported bug that allowed it your account has been compromised. You need to change your password, and any other accounts that use the same or a similar password.

You should also put some thought into how your account details have been compromised, and take steps to prevent it from happening again. It could be:

  1. bad habits: you could have shared your password, written it down where it could be seen, typed it in where it could be seen, transmitted it unencrypted, chosen an easy to crack/guess password or used the same password on another site. You should do none of those things
  2. Your computer was compromised: if someone's cracked your computer you will need to rebuild the OS from scratch, the "nuke it from orbit" solution as favored by @Polynomial
  3. Google account information was compromised: this is the least likely, but still possible cause. If this is the case I'd expect it to come to light.
share|improve this answer
2  
It's the only way to be sure. –  Polynomial Jan 14 '13 at 16:22
    
He can't make that decision, he's just a grunt! –  GdD Jan 14 '13 at 16:24

Well it looks like you account has been compromised. Go ahead and change the pass and sec questions of you account. Also enable google two factor authentication to secure your accounts from such activities.

share|improve this answer

protected by Community Nov 11 '13 at 19:08

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.