2

My google account was compromised recently, and I'm trying to go through all details to understand how. Maybe you guys have ideas.

I discovered a few days ago that my gmail account had the following settings:

  • Filters to automatically delete certain incoming messages
  • IMAP setup
  • Application Specific Password (not sure when created, Google does not tell me)

I have a strong password that I use for google kept in a password manager. I also use 2FA on this account. In addition, I access my account through a Linux machine and a windows machine that run Malwarebytes. I have not seen any warnings or notifications of malware on those machines. The browser is Google Chrome, but uses a limited set of addons. I have not installed any new plugins for months.

My theory is that something I did allowed an application specific password to be created in the Google account. I recall about a week ago using single sign on to access a new site that I now think was very sketchy. During this time, I noticed that I should probably not use single sign on for my main account. Instead, I created a temporary fake gmail account to perform the single sign on, and I used that instead. Keep in mind that I maintained the browser session with my main google account, but the permissions were given for the fake account.

Is it possible that using single-sign on (even with a different account) can add an ASP to my main google account just because I had a browser session opened at that time? Are there any vulnerabilities in single-sign on that I need to be aware of here?

|improve this question
  • With SSO the concern isn't vulnerabilities but permissions. If you're not careful and just click through the request, you can give an app full control over your account. Note I'm not claiming this is what happened: just figured it was worth pointing out – Conor Mancone Feb 8 at 22:16
  • @ConorMancone That's probably what happened. The site requested a permission that I shouldn't have granted. – bad_at_security Feb 8 at 22:18
  • this could be the same case as this other one: security.stackexchange.com/questions/224553/… – Virgula Feb 9 at 7:43
1

Based on the information you've provided I can make the following notes:

I discovered a few days ago that my gmail account had the following settings: Application Specific Password (not sure when created, Google does not tell me)

Adding an Application Specific Password requires you re-authenticate, even in an existing session. This has me believe that the attacker who made these changes, either had your password, or had access to your machine and just used the password manager to fill in the password fields.

Go to Account Security and check Recent Security Events to review any suspicious activity. This will tell you when that Application Specific Password was created. It will say "Password allowing app to access account created" and the date and location. With that information, you may be able to identify where you were when you were hacked and figure out if your machine could have been vulnerable.

Check also, Third-party apps with account access to see who has access to what.

I also use 2FA on this account.

The most likely explanation is still that your machine had an existing session open so the attacker would not need to 2FA. Otherwise they would need to have access to your other 2FA device as well.

I recall about a week ago using single sign on to access a new site that I now think was very sketchy....I created a temporary fake gmail account to perform the single sign on, and I used that instead....I maintained the browser session with my main google account, but the permissions were given for the fake account.

Was there a redirect to Google for the sign in? Can you remember if you verified the url was Googles? Many phishing attempts use a 'real' looking auth page to grab your creds. The url is a giveaway. Your 2FA setup should squash any attempt to login using the creds though (good work having 2FA!)

Is it possible that using single-sign on (even with a different account) can add an ASP to my main google account just because I had a browser session opened at that time?

Not likely. It is possible you thought you were authenticating using the fake account but were in fact using the main account. Check your Google activity here: My Activity and confirm.

Are there any vulnerabilities in single-sign on that I need to be aware of here?

Not impossible but not the most likely explanation. But no, no known vulnerabilities of Google's Sign In that are relevant here.

Using the resources I pointed to:

you should be able to answer a few of your own questions (or it may result in more questions!)

|improve this answer
  • "Recent Security Events" does not show me when the app password was created. This may be because I have a lot of security events that I generated such as "removing x device", or "removing app password", etc. – bad_at_security Feb 10 at 16:00
  • There was possibly a redirect to Google, but at no time was I required to enter a 2FA code. However, I will say that on my home machine I have the setting "do not require 2FA" enabled, so if it utilized my current session to add the app password, then that would make some sense. – bad_at_security Feb 10 at 16:02
  • It could also be that it is not 'Recent'. I'm sure you've already removed the suspect App Password but within those setting, one of the columns says "created" and the other is "last used". – Kyle Fennell Feb 10 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.