1

Is it easy to access someone's gmail account without having that alert pop up to warn the owner?

So, for example, with gmail, if you log in somewhere different from your usual login, it alerts you that such and such ip address wants to access your email, how easy would it be to bypass that alert that goes to the owner and access someone's account? As in, is it a simple task to gain access to a gmail account without having that alert pop up to the owner? Would it be easy for someone to be able to live monitor what you're doing on your screen at all times?

I ask because my gmail has been accessed by someone unauthorized and I'm trying to figure out how it's being done.

1

One way this could be accomplished is by spoofing IP and MAC address information for the victim. You would build a website that phishs that information from them (could be a google clone and harvest creds too), and then using tools like macspoof or ipspoof, assume their identity and from Google's eyes, their computer. This would potentially allow you to hijack a Google account without alerting to the compromise of the user.

Edit:

Another potential attack vector is a rogue access point attack which ends up having the same outcome through a different methodology. A rogue access point is configured to decrypt SSL connections and extract plaintext credentials. Systems of this nature are widely available and easy to use. The Wi-Fi pineapple is a prime example of this.

  • 1
    Google also fingerprints the browser, as well. Might just be the cookies, but logging in while using Firefox after years of using Chrome on the same computer still triggers emails being sent. – Ghedipunk May 3 at 21:55
  • See I don't have that problem and I switch between work computers often, but I use chrome on everything. Perhaps another thing that needs to be spoofed is user-agent, using match&replace in burp suite. – leaustinwile May 3 at 21:57
  • hmm appreciate the answer, so my follow up would be, is what you're saying easy to do? i know the person who has accessed my gmail without permission is not a tech type of person, but would it be a matter of just googling a few things and watching tutorials in order to figure out to do this? It's either that or he's found someone that is able to do something like that – mph85 May 4 at 0:34
  • No, it requires an SSL downgrade attack which has the constraints that you must be in a Man-in-the-Middle position in the network (on your wifi with arp spoofing active). Have you considered that you may have used your credentials on their network/computer and they could've been saved in his browser cache? If you used them on his network, it's possible that since yours and his public IP would've been the same, that it didn't alert because of that. – leaustinwile May 4 at 1:10
  • 1
    IP spoofing for a TCP connection is a lot more difficult than you think, and there would be no need to spoof a MAC address. – AndrolGenhald May 4 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.