4

We use GMail for our business email, we are a small company. I do the mail administration for our domain, and I was recently alerted by an email from Google that a colleague's account had some suspicious logins and was suspended.

Looking at the login audit report for this account, I can see that there have been about 27 suspicious logins over the past approx. 3 months, the first being on July 28 2015.

He unknowingly continued to use the account throughout this period right up until Google suspended it yesterday. We changed the password and enabled 2-factor authentication (in fact we've made it company policy for all staff). We then followed Google's checklist for administrators: https://support.google.com/a/answer/2984349?hl=en

I've been doing reverse lookups (ping -a) on the source IPs of the suspicious logins as recorded by GMail, and I'm getting a variety of rather concerning top-level domains returned e.g. .ru, .pl, .ly, .kg, .kz, .mx, .ar, .eg, .br, .tr.

They mostly appear to me to be residential ISP subscribers on dynamic IPs using DSL or similar.

He remembers having some temporary trouble receiving email around the time of the first suspicious logins, but we've noticed no other obvious suspicious activity in his email or any of his online services since then. He uses Outlook on a laptop to access GMail via POP3. We are not sure what vector was used at this stage. He did do some travel within South Africa around when it started, using hotel Wi-Fi, but he has never been to any of these other countries.

What I'd like to determine is:

  1. Given the pattern of suspicious access, what was the likely mechanism? E.g. were the unauthorised logins from individual hackers who were sharing my colleague's logon credentials, or were the source IPs likely to have been users unaware that they had malware on their machine sending spam or similar?

  2. Given that we are a software company that authors and administers websites, but has no reason to believe that any of our production hosting infrastructure has been compromised, what further action should we take, if any?

  • One thing I've discovered through this process is that the GMail admin console's alerts all defaulted to OFF when we set up the domain. Had we switched on the "suspicious login activity" alert, we would have known about this 3 months ago. It may pay to check this setting if you haven't consciously switched it on. – Michael12345 Oct 14 '15 at 3:54
3
  1. This is though to answer, it could be a single attacker hopping across VPNs or it could be multiple attackers.
  2. It would depend on what information the person had access to. If there is a single email with another password in there you need to review what that account and password had access to. Basically whatever your employer used that email and account for (e.g. Github or Bitbucket) the attackers will have had access to. So I'd carefully review the email box contents and see what else might be compromised.

You should also review on how the account was compromised in the first place (password re-use, weak passwords, common passwords, compromise of a local machine, ...). Because it will most likely give you an idea on where to start your investigation to see what else might be compromised. If you haven't done this yet then in my opinion it's still too early to say they haven't compromised the production systems.

A plausible scenario could for instance be including malicious source code or backdooring the compiler used for creating the binaries which are put into production.

  • 1
    Yes, we'll try to nail down exactly how this occurred. There was also some discussion about a virus or malware being reported on his laptop earlier in the year which I had believed was successfully cleaned off. MS Security Essentials is still reporting all OK, and no malware-like behaviour observed, but it could be time to try some other tools to scan in more depth. – Michael12345 Oct 14 '15 at 3:13
  • Thanks for all the suggestions, accepting this answer as the first responder and the additional notes about malicious source code modification. So far, we have been unable to determine how the credentials were compromised, but I have learnt the password was not very strong so I guess it could also have just been brute-forced. Will provide updates if we find any other info. – Michael12345 Oct 21 '15 at 20:48
4

Anyone including himself could be connecting through a service such as TOR. Through such a service you can switch exit nodes at will giving you a new IP and country that IP is coming from. Considering that forget about what countries the connections come from. They mean nothing. It's more important to establish what has fully happened. Remember that having gmail access also means Drive access and such. Have you looked into all the services that could have been compromised through google? It could be a much larger picture then just gmail being compromised. One could lets say change a file you store on Drive with a compromised one, it gets synced to your computer, and you run it.

  • 1
    Thanks. Fortunately he doesn't have anything in Google Drive and hasn't set up any sync. For him, Outlook is the primary mail tool and GMail is just the backend which he never logs into. I get that TOR could make one user's requests look like they originated in various countries, I just didn't expect it to have exit nodes on residential DSL connections with dynamically assigned IPs, but reading a bit more about it, maybe that's quite normal. – Michael12345 Oct 14 '15 at 3:42
2
  1. A likely situation could be that only one malicious user had access to the account, but was using some routing mechanism to access the account (like tor or proxies).
    That way if the attacker gets caught, has less chances to be discovered since he is hiding his real IP address. Google must have reported the suspicious behaviors based on the logins because that is a common practice to hide your trace.

  2. It can happen that malicious user didn't know what your company does, he just got the credentials through some untargeted fishing scheme, or by hacking a website database where your colleague had created an account with the same email and password, or by any number of ways, and was accessing the email account to find if the user stored other credentials (for other websites, or even bank credentials), or the malicious user could be using the email account to use as a spambot to send emails with viruses or fishing schemes.

  • 1
    Thanks. I am hoping that his credentials were just blindly harvested and used in a spambot somewhere rather than having his email inspected. I was hoping that if we found out what they were used for, we could make a judgement about the likely risk. – Michael12345 Oct 14 '15 at 3:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.