0

This question already has an answer here:

Yesterday I got back home from an overseas trip to Germany only to find that my Gmail was logged in from China. Now I'm not tech savvy and believe I might have made some mistakes regarding security but how in god's name did someone from China access my Gmail account? I could not login to my account while in Germany due to Gmail blocking it as a suspicious login but it allowed someone from China?

marked as duplicate by PwdRsch, DKNUCKLES, Steve, Xander, CaffeineAddiction Mar 8 '17 at 7:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Did you log in to your gmail on a computer that was not your own (cyber cafe, friends computer, etc)? – DKNUCKLES Mar 7 '17 at 20:27
  • I'm not 100% sure the answer I flagged this as a duplicate of is asking the same question, but I'm also not entirely sure what answer Aakusti expects us to provide. – PwdRsch Mar 7 '17 at 20:58
1

Remote attacks can be from anywhere in the world and are rarely in the same geographic vicinity as the target.

This said there are a LOT of different ways your account could have been compromised and it may have nothing to do with your recent activities. If you use a patterned, or similar format, password on multiple websites your e-mail and password pattern could have been gathered from another site being breached. For example, if you use the following password on Yahoo:

123yahoo

and I know your e-mail address is with Google I might suspect your Gmail password is:

123google or 123gmail

simply from looking at another password you've used and your e-mail address. The timing could be a coincidence.

As another example of where it may have nothing to do with your activities, and I do NOT think your situation is a result of the following, but a while back Google was breached by Chinese Hackers (or at least that's who it's attributed to in the following article):

https://www.washingtonpost.com/world/national-security/chinese-hackers-who-breached-google-gained-access-to-sensitive-data-us-officials-say/2013/05/20/51330428-be34-11e2-89c9-3be8095fe767_story.html?utm_term=.794baab6ca8e

So right off the bat get rid of any thoughts that attackers need to be physically close to you to attack you on-line. Humans evolved to only be concerned about threats in their immediate proximity and it causes us problems when perceiving threats in the correct context on-line.

There isn't enough information in your post to step through all the activities you have done in the past with your account for anyone to really answer exactly how you were attacked but browser attacks, especially if you have used an older browser, and malware on all the systems you've used is certainly a possibility. If you've used any computers that you don't normally use those would also be likely candidates. Again there are thousands of potential possibilities but those are things I think most people would tell you to look at first.

1

It is possible that one of the wifi routers you connected to, one of the computer you used (cyber cafe), or your laptop left unattended for a few min was compromised.

When you attempted to visit google.com it routed your request to a non-google server (because compromised) that looked exactly like google.com ... and you diligently entered your username and password. It is then likely that the non-google server logged your username/pass in a database somewhere and put up the message of "Nope, cant access your account cause shady".

It is then possible that your username/pass where then sold to someone in China who has plans on using your account for nefarious means.

  • But how did they login . As I have highlighted , Gmail did not let me login from a computer other than my own . So , how was a chinese hacker able to outsmart Gmail ? I mean , if Gmail's location thingy is that easy to crack then its not really that secure – Aakusti Mar 8 '17 at 4:18
  • As I said ... how sure are you that it was in fact Gmail that didnt let you login? If you where on an un-trusted connection, it would have been very easy for an attacker to host there own server pretending to be gmail ... and if you didnt notice you might have just handed them your username and password. – CaffeineAddiction Mar 8 '17 at 4:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.