1

A few days ago I received a Notification from my Android saying that it could not send mail because an attachment was too large.

I opened my Gmail App and found 5 messages in the Sent Mail folder that I had not sent.

The messages were all to people in my address book. Some had two year old timestamps. Most were empty with no subject or message. One had a large MP4 attachment which I deleted.

One of the messages looked like this:

date: 2014/09/30,12:37:00
to: johnwilson@example.com
subject: Try this
message: Maybe it needs message text

I ran Symantec Mobile Security, and it found no problems. I also scanned with Avast and with Dr. Web and found no problems.

My phone is not rooted. Nothing else looks suspicious about my phone: it runs fast -- no weird data usage. There are no strange apps installed, and nothing has been installed recently on the device.

Do I need to wipe my phone?

Is there some other check I can run on my Android to see if I've been pwned?

4

You should not only focus on your cellphone, as there are other possibilities how this can happen. If a mail is sent from a pc it will also be shown in you GMail App, so this is no evidence that your mobile phone is the root of the mails.

Look at your Google Account's recent activity, perhaps your password has been guessed or stolen from somewhere. There you can see the date and ip from all login activities related to your account. Further you should check all permissions you gave any software on your account.

I would strongly suggest to change your Google password and to take a look at two factor authentification for advanced security.

To your actual question:

There are plenty of scanners out there for Android, and according to a german IT magazine the best ones are:

EDIT:

GMail always shows these notifications, even if the action was taken on a computer (at least it works this way for me, I took a quick test)

With your new information, it strongly looks like one of your systems is compromised. It could be your cellphone or your PC. You really should check both. If you can swipe you cellphone without a loss of important Data it may be a good idea (But remember to get reserve codes for your two factor authentification, it may depend on your phone).

  • 1
    Thanks. I was assuming that it had to have come from my phone because I have already done the things you suggested: I already use two-step authentication, I've checked all my permissions, I've checked all my recent activity, my password has not been reset (but I changed it when this happened), I have never written my password down or shared it with anyone, and my password is unique to my google account. I am beginning to lose confidence in Google. – jsp Oct 5 '14 at 18:12
  • 1
    Also, the 'undeliverable mail' notification that I received appeared in the Notification Area on my phone -- as opposed to say an email notification. That is what led me to believe that the hacking had to have taken place on my phone and not through my google account. Maybe I'm wrong about that. – jsp Oct 5 '14 at 18:28
  • Thanks for providing the link to google's activity and permissions page. Used it for some cleanup. – Marcel Oct 6 '14 at 11:26
3

As Tokk said it is possible that your mail account is compromised from some place else but as you said you are using two factor authentication I believe it is more likely your phone is infected.

Check your recently installed apps. Look at comments of the app and installation count. Sometimes they make a clone of an app to spread malware. If you find something strange uninstall it.

If you find nothing try on of the other virus scans but keep in mind they are not 100% reliable. Wiping the phone might not be a bad idea. If you backup your data it should not be to much trouble to get a clean start.

  • +1 for mentioning (recently) installed apps. – Marcel Oct 6 '14 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.