Is your Gmail being hacked from China? It's worth checking

  Monday 19 May 2014

You might recall that part of the fury with China that Google expressed in Januarywas over the hacking of Gmail accounts belonging to activists - that, and thediscovery of hacking into its source code repositories (though Google hasn't confirmed the latter, it's widely understood that was the reason for its reaction).

Well, don't think that just because Google has shifted its search engine to Hong Kong that things have eased up. IF you're on Gmail, and even if you're not an activist, it might be a good idea to check who else has been using your account recently. Ian Betteridge, who writes over at Technovia, got a shock the other day when he looked at the record of who had been accessing his Gmail account.

Screenshot by Ian Betteridge on Flickr. CC-BY licensed

There was an "unknown" access from a China Telecom IP - somewhere in the Beijing region. (The picture below is from GeoIPTool, which tries to map an IP address to a location. It's rough, but good enough.)

That's a bit of a jawdropper. Also in the list is access by an Amazon Web service apparently belonging to my6sense, which says it is "the sensational way to read and share your most relevant content from your RSS and social streams". (It's not Chinese-owned.) Possibly the hacker set up an RSS feed of new Gmail from the account to go to a My6Sense stream. If I were Betteridge, I'd be assuming that every email I'd had in my Gmail account had been copied and read, up to the time that I changed my password . (Which he has.)

Now, does this indicate Chinese government evil intentions? No, not necessarily; there's a long way to go to prove that. There are plenty of Chinese hackers around - last year I discovered a chunk of PHP code clearly written by a Chinese hacker on the Free Our Data blog which had been used to insert pharma spam. That doesn't either mean that the Chinese hacker inserted it - he might just have sold it to someone who then used it for pharma spam.

Even so, it's clearly a good idea to check your Gmail status from time to time.

To do that, log in, go to Settings on the top right, and scroll down to the bottom. There you'll find some text in green telling you how much of your allowance you're using; and below that a line saying "Last account activity: ... minutes ago at this IP.." and a hyperlink to Details. Click that for a view of your account access history. And make sure that your Alert Preference is set for "Show an alert for unusual activity."