3

We recently had an incident where two-factor authentication was enabled on a Gmail account but the account was sending spam messages. The device login activity shows no abnormal devices accessing the account. Is it correct to assume there is a piece of malware on one of the Macs accessing the account?

What is the best way to forensically search for the how the malware got onto the machine? What log files should I be checking to locate the ingress point?

Any and all ideas welcome.

  • 1
    Has the account in question ever allowed an app/extension to access it's inbox? – WorseDoughnut Mar 29 '16 at 17:22
  • 1
    Are you sure it came from the account, and they didn't just change the from: address in the header? Are the messages in Gmail's Sent folder? – Mike Ounsworth Mar 29 '16 at 17:24
  • Message aren't in the sent folder. The from address is the address of the account. Not sure how this would be spoofed. Strange that the email was sent to the email of the account. – MTC40 Mar 29 '16 at 19:54
4

I am reacting to your comment:

Message aren't in the sent folder. The from address is the address of the account. Not sure how this would be spoofed.

I think you just answered your own question: the "hacker" never got access to your account, they just sent an email and put your email address in the From: field in the header. That's like sending a letter and writing someone else's address in the Return Address section. There's no magic to it. See wikipedia/Email_spoofing for more info.

the From: header line is just text. Command-line email clients like sendmail allow you to set this when you send an email. Open your favourite linux terminal and try typing:

sendmail -f mtc40@gmail.com your.friend@gmail.com < email_contents.txt

and BAM! you just spoofed an email to your friend!

P.S. Another way to check if the hacker really got into your account is to look at the email in the receiving person's Gmail, open the details of the email and see if it looks like this:

enter image description here

If it was just a cheap spoof then there will be no encryption, and it won't be signed by gmail.com. If it was signed by gmail.com then your fears are justified.

  • PPS please correct my sendmail syntax if it's wrong, I just did a quick skim of the manpage. – Mike Ounsworth Mar 29 '16 at 20:33
  • 1
    Thanks to everyone and yes it was a spoofed message from a normally legit domain www.wright.edu. Should have checked the header more closely. What is the protocol for letting them know? or I assume they have already figured it out. – MTC40 Mar 30 '16 at 20:24
0

Usually with Google 2FA (and other similar systems) there is the concept of a "trusted" system and when you've authenticated to it once using 2FA, it lets you access the system after that either with a browser cached password or by re-entering your password.

Google do have some additional checks, which I don't believe they detail publicly, to see if the credential has been moved, which might trigger another request for the 2FA token, additionally it may be requested again after a period of time.

So malware which has compromised the system would be able to access the account and send mail as the user, so yes this may be a cause of your issue.

Another possibility would be just spoofing of e-mail address, i.e. the account/device hasn't been compromised at all, someone is just using the address as a "from" in spam mail.

More information about what makes you think it was account compromise would be needed to tell which is more likely.

  • In the case of the 2FA "trusting", the log in would still appear in the device login history for the account, which OP said was showing no signs of unknown access. – WorseDoughnut Mar 29 '16 at 17:26
  • hmm not sure that's true. from what I can see on a google account it shows when a new device or browser is added. If an attacker just "opens" an existing browser and uses the session that google handily sets for you, that won't trigger a new event. – A_Learner Mar 29 '16 at 17:32
  • If the malicious session never logs out, then sure it would only ever have appeared once, but it would still have shown up the first time an attacker checked off "Don't ask on this device again." Or are you assuming an attacker had physical access to the browser on OPs Mac? – WorseDoughnut Mar 29 '16 at 17:34
  • I'm assuming malware which has full control of the system, so can just instantiate the browser which is already installed... Without more details it's hard to be definitive, but that would fit the facts as presented..... although it could just be the spoof mail option which is somewhat simpler. – A_Learner Mar 29 '16 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.