Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I received a message from Google saying someone entered my email account.

I confirmed that there were an access from an IP in another country.

I have noticed "You have new mail" message when I open a new tab in my Terminal in OS X, I can make this message disappear if I delete /var/mail/my_user, but this morning it appeared again. I don't know if this is related with the email attack.

How can I track down this vulnerability?

share|improve this question
    
Are you using an Web Proxy server to access internet ? –  Ali Ahmad Apr 27 '13 at 15:46
    
I don't know if I am using a Web Proxy –  juanpastas Apr 27 '13 at 16:08

2 Answers 2

"You have new mail" in a terminal is a very old Unix behaviour: the shell (the software which interprets the commands you type in the terminal) regularly checks whether the file /var/mail/username (where username is, you guess it, the name of the current user) has been modified (precisely, whether its last modification time is ulterior to its last reading time, the mark of a new but as yet unread data).

On a machine which is not an email server, reception of emails that way usually means that the email was generated locally. This is typical of cron jobs: you register some commands for regular execution, and when they get executed, their output is sent to you by email (that's purely local, the data never exited your machine).

See the contents of the file with: more /var/mail/my_user (in a Terminal window). This will give you some information as to the provenance of such emails. My guess is that they are totally unrelated with your Google story. Note also that I regularly receive (meaning several times per day) a lot of fake emails which purport an alleged security breach, and try to entice me into entering my login and password on some site which may or may not "look like" the genuine site for Google or a bank or whatever. This is common practice among attackers. Your emails might be of the same persuasion: fake emails which do not come at all from Google. Detailed inspection of the header and contents of such an email may reveal the foul play.

If unsure, reset your Gmail password (with a new, strong password); this won't make any harm.

share|improve this answer
    
You are right about cron, I was running commands with it. –  juanpastas Apr 27 '13 at 16:38

I have never heard of receiving an email from Google about someone entering an account. Are you sure the email is from Google? You may want to look at the full headers of the email and make sure. If you don't know how to interpret the headers, post them here and we'll have a look.

The "You have new mail" message from OS X probably has nothing to do with your Gmail issue. However it is unusual to receive local mail on an OS X system. You should not be deleting /var/mail/my_user before reading it.

share|improve this answer
    
Headers are ok, and email has a key sign. –  juanpastas Apr 27 '13 at 16:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.