I received a message from Google saying someone entered my email account.

I confirmed that there were an access from an IP in another country.

I have noticed "You have new mail" message when I open a new tab in my Terminal in OS X, I can make this message disappear if I delete /var/mail/my_user, but this morning it appeared again. I don't know if this is related with the email attack.

How can I track down this vulnerability?

  • Are you using an Web Proxy server to access internet ? – Ali Ahmad Apr 27 '13 at 15:46
  • I don't know if I am using a Web Proxy – sites Apr 27 '13 at 16:08

"You have new mail" in a terminal is a very old Unix behaviour: the shell (the software which interprets the commands you type in the terminal) regularly checks whether the file /var/mail/username (where username is, you guess it, the name of the current user) has been modified (precisely, whether its last modification time is ulterior to its last reading time, the mark of a new but as yet unread data).

On a machine which is not an email server, reception of emails that way usually means that the email was generated locally. This is typical of cron jobs: you register some commands for regular execution, and when they get executed, their output is sent to you by email (that's purely local, the data never exited your machine).

See the contents of the file with: more /var/mail/my_user (in a Terminal window). This will give you some information as to the provenance of such emails. My guess is that they are totally unrelated with your Google story. Note also that I regularly receive (meaning several times per day) a lot of fake emails which purport an alleged security breach, and try to entice me into entering my login and password on some site which may or may not "look like" the genuine site for Google or a bank or whatever. This is common practice among attackers. Your emails might be of the same persuasion: fake emails which do not come at all from Google. Detailed inspection of the header and contents of such an email may reveal the foul play.

If unsure, reset your Gmail password (with a new, strong password); this won't make any harm.

  • You are right about cron, I was running commands with it. – sites Apr 27 '13 at 16:38

I have never heard of receiving an email from Google about someone entering an account. Are you sure the email is from Google? You may want to look at the full headers of the email and make sure. If you don't know how to interpret the headers, post them here and we'll have a look.

The "You have new mail" message from OS X probably has nothing to do with your Gmail issue. However it is unusual to receive local mail on an OS X system. You should not be deleting /var/mail/my_user before reading it.

  • Headers are ok, and email has a key sign. – sites Apr 27 '13 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.