Gmail account hacked - what was it used for?

Question

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some suspicious logins and was suspended.

Looking at the login audit report for this account, I can see that there have been about 27 suspicious logins over the past approx. 3 months, the first being on July 28 2015.

He unknowingly continued to use the account throughout this period right up until Google suspended it yesterday. We changed the password and enabled 2-factor authentication (in fact we've made it company policy for all staff). We then followed Google's checklist for administrators: https://support.google.com/a/answer/2984349?hl=en

I've been doing reverse lookups (ping -a) on the source IPs of the suspicious logins as recorded by GMail, and I'm getting a variety of rather concerning top-level domains returned e.g. .ru, .pl, .ly, .kg, .kz, .mx, .ar, .eg, .br, .tr.

They mostly appear to me to be residential ISP subscribers on dynamic IPs using DSL or similar.

He remembers having some temporary trouble receiving email around the time of the first suspicious logins, but we've noticed no other obvious suspicious activity in his email or any of his online services since then. He uses Outlook on a laptop to access GMail via POP3. We are not sure what vector was used at this stage. He did do some travel within South Africa around when it started, using hotel Wi-Fi, but he has never been to any of these other countries.

What I'd like to determine is:

1. Given the pattern of suspicious access, what was the likely mechanism? E.g. were the unauthorised logins from individual hackers who were sharing my colleague's logon credentials, or were the source IPs likely to have been users unaware that they had malware on their machine sending spam or similar?

2. Given that we are a software company that authors and administers websites, but has no reason to believe that any of our production hosting infrastructure has been compromised, what further action should we take, if any?

Answer 1

1. This is though to answer, it could be a single attacker hopping across VPNs or it could be multiple attackers.
2. It would depend on what information the person had access to. If there is a single email with another password in there you need to review what that account and password had access to. Basically whatever your employer used that email and account for (e.g. Github or Bitbucket) the attackers will have had access to. So I'd carefully review the email box contents and see what else might be compromised.

You should also review on how the account was compromised in the first place (password re-use, weak passwords, common passwords, compromise of a local machine, ...). Because it will most likely give you an idea on where to start your investigation to see what else might be compromised. If you haven't done this yet then in my opinion it's still too early to say they haven't compromised the production systems.

A plausible scenario could for instance be including malicious source code or backdooring the compiler used for creating the binaries which are put into production.

Answer 2

Anyone including himself could be connecting through a service such as TOR. Through such a service you can switch exit nodes at will giving you a new IP and country that IP is coming from. Considering that forget about what countries the connections come from. They mean nothing. It's more important to establish what has fully happened. Remember that having gmail access also means Drive access and such. Have you looked into all the services that could have been compromised through google? It could be a much larger picture then just gmail being compromised. One could lets say change a file you store on Drive with a compromised one, it gets synced to your computer, and you run it.

Answer 3

1. A likely situation could be that only one malicious user had access to the account, but was using some routing mechanism to access the account (like tor or proxies).
   That way if the attacker gets caught, has less chances to be discovered since he is hiding his real IP address. Google must have reported the suspicious behaviors based on the logins because that is a common practice to hide your trace.

2. It can happen that malicious user didn't know what your company does, he just got the credentials through some untargeted fishing scheme, or by hacking a website database where your colleague had created an account with the same email and password, or by any number of ways, and was accessing the email account to find if the user stored other credentials (for other websites, or even bank credentials), or the malicious user could be using the email account to use as a spambot to send emails with viruses or fishing schemes.