Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What does it suggest about a "hack" when people I know get emails from me, but my email password hasn't been changed to lock me out? (Not a spoofed sender - I see some in my sent folder). If my password is known to the attacker, why would they make themselves known (by sending emails like that) and NOT take over my whole account?

I've changed my passwords, verified my secondary email address (for forgotten password recovery) and reviewed my two-factor-auth-app-passwords. Nothing seemed amiss. What should I look out for? I feel like since they didn't lock me out they have some other trick. This is gmail, so I have a higher confidence in their application and password database security.

Thanks!

share|improve this question
    
Is it possible that an application (read: malware) is hijacking your current session towards gmail? –  Dog eat cat world Jan 30 at 11:01

1 Answer 1

up vote 1 down vote accepted

If you have confidence in the security of Gmail's servers, and since the communication between your machine and Gmail uses SSL, this leads to an unescapable conclusion: the vulnerability is on your side. Ill-intentioned people could took some control of your machine, or learned your password, or both. If they could run their nefarious code on your computer, then that computer must be considered as infected and corrupt, and MUST be cleansed. There is no amount of password changing which can heal a computer which has has tasted the foul taint of malware; only a reformat will purge it.

It is possible that the attacker learned your password and just used it from another machine, in which case changing your password would be sufficient to lock them out. However, this does not explain how the attacker learned the password in the first place, and the most plausible explanation again involves malware on your computer (a keylogger). Burn it !

share|improve this answer
    
Hmmm... Not sure if I would agree with the "KILL IT WITH FIRE" approach. Perhaps just an AV scan, remove the threat if it finds it, change the password, and see what happens? If they get your password again then you might wanna re-format or switch our your hard drive (and possible RAM too) –  KnightOfNi Jan 30 at 22:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.