Google Mail alert message. Hacker from China

Question

I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China:

IP Address: 117.70.121.33
Location: Xuancheng, Anhui, China

and two others.

Is this common?

Could this be done from anywhere around the world or just from China? I mean, if the Chinese firewall will block hackers e.g. from France, US or Israel to access some computer in Xuancheng, Anhui, China and act as a Chinese attack or the wall is preventing from this.

It seems IMO that attacks from China is the most common place of attack. Is this just a coincidence or purposefully doing because it is not easy to ask Chinese government for permission of logs when using China servers for attacks on EU or US targets.

---

This is in an email from Google:

derfder,

Someone recently tried to use an application to sign in to your Google Account, [email protected]. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

Tuesday, October 23, 2012 10:06:26 AM GMT
IP Address: 117.70.121.33 Location: Xuancheng, Anhui, China

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

Sincerely,
The Google Accounts Team

Answer 1

Well, there are actually a range of questions in there but the big one is your second last paragraph.

The Internet allows us to be attacked by individuals anywhere in the world.

Access controls help to prevent a lot of attacks, but all of them can be bypassed given enough effort, and this includes the Great Firewall of China along with every other device or application. The only way to be sure is to disconnect your computer entirely, then lock it in a room, and hide the key. And post guards. And watch the guards etc

So this is why security is really a business decision - you can get as much security as you pay for, but if you are a desirable target you need to buy much more security.

Various surveys by companies such as Kaspersky show the apparent sources of attacks, and China is high up there, but so are the US, Eastern Europe, Israel, the Philippines, and a wide range of countries. While some of this data is no doubt correct, some of it is likely to be spoofed by smart attackers routing through machines in other countries.

And the whole issue of getting logs from other countries - it is a nightmare. Many ISP's just won't divulge this info. Some countries block requests entirely.

Answer 2

I think there is a confusion on the "Great Firewall of China". Isn't the main purpose of this so called firewall to censor some websites ?

At least i wouldn't say the firewall is preventing any chinese hacker to hack all around the world.

Anyway, as RoryAlsop pointed, no firewall could really prevent someone from china to scan/hack someone anywhere in the world. Modern hackers oftenly use hosts all around the world as proxy to hide the real origin of their actions.

Then in that case, could hackers use proxies in china to make people less likely to trace them back ? It could be. It's sure possible to do so.

I would say there is a lot of malicious traffic coming from china more because of it's very important population rather than the protective country's policy on hacking.

Answer 3

While Google does send similar warnings, this one is clearly a phishing scam trying to steal your account.

Phishing scams include e-mails that request your login:password information, or links to fake web-sites that ask for your login:password. For web-sites, the printed link may look valid but the actual link could go someplace different. They often include threats of closing your account if you don't respond. If the message didn’t come from an @google.com address, it is fake.

You can ignore it, use the drop-down menu next to reply to "Report Phishing", or use the following form: http://mail.google.com/support/bin/request.py?contact_type=abuse_phishing picious messages: http://mail.google.com/support/bin/answer.py?hl=en&answer=29381