My gmail account hacked, how?

[Diver]

My passwords are varied and complex.
Thankfully I have a very good memory for figures too (Hi cojak). and mix with upper and lower case letters.

Never had a password or account hacked and hopefully never will.

My PC protection is also top notch (Purchased) and well maintained.

 

[fullyautomatix]

I remember Hotmail being hacked like this and emails sent out en masse to all contacts but no emails were to be found in the sent items folder. Searching online for the virus responible for this was not easy. Seems Gmail has been affected too. I would love to know how this is done.

 

[d000hg]

My guess is they rip your contacts and then send as your email from their own servers?

I still reckon getting your password+email from a vulnerable site might be one obvious attack vector, every site you use wants you to regsiter and lots still store passwords in plaintext

 

[BrilloPad]

I remember Hotmail being hacked like this and emails sent out en masse to all contacts but no emails were to be found in the sent items folder. Searching online for the virus responible for this was not easy. Seems Gmail has been affected too. I would love to know how this is done.

Dont they just get your contacts and use a mass emailer? I did alot of mass emailing during my f4j days. A great pity that all 100k emails I sent were to 1 contact.....

 

[MrMark]

and lots still store passwords in plaintext

Even hashed passwords, particularly if a salt is not used, can be relatively easy to crack.
All extremely basic stuff for security purposes, which is why it's annoying to see developers who don't even use basics, jump the queue for work based on cost criteria.

 

[Sysman]

My passwords are varied and complex.
Thankfully I have a very good memory for figures too (Hi cojak). and mix with upper and lower case letters.

For general web accounts I use pwgen on Linux and OS X, and generate a new password per site. I see there's something similar for Windows with PWGen for Windows.

For anything financial or confidential I go for longer passwords, again one per site.

All my email accounts have unique passwords.

 

[SueEllen]

Is it just one of those things that happens somehow?

I had one of my many accounts hacked about a year ago.

I was using firefox and looked at an alternative health site in another tab when I had that particular gmail account open.

The account was used for 7 hours to send out spam email to random addresses.

Unfortunately for the account hijackers I was notified by the fact I didn't receive a standard daily email on my phone in the morning and so when I couldn't log in recovered my account.

I know they were spamming because I found lots of junk in the sent folder, and gmail lists the IP addresses that last used your account.

There weren't any contacts for them to spam apart from some old agencies that I hadn't removed from the contacts list.