The perils of email: My Gmail account hacked

It was, I suppose, when, not if, one of my email accounts was hacked. I was in office with a colleague when he said that I had sent the most unusual email that went,

Wonderful shopping! How are u doing these days?Yesterday I found a web of a large trading company from china,which is an agent of all the well-known digital product factories,and facing to both wholesalers,retailsalers,and personal customer all over the world. They export all kinds of digital products and offer most competitive and reasonable price and high quality goods for our clients,so i think we you make a big profit if we do business with them.And they promise they will provide the best after-sales-service.In my opinion we can make a trial order to test that. Look forward to your early reply! The Web address: {some URL}

Guessing what had occured, my first fear was that I was locked out of my account. Tried to log in, was elated when I could and immediately changed my password and deleted all of my contacts. Unfortunately it was too late to stop this email going to around 600+ contacts.

Many friends and colleagues wrote or called in to say that something was awry with my email. Later in the evening, I sent an email to everyone who may have got the spam email apologising, though everyone was very nice and good humoured about it. From a few I learnt that spambot attacks on email accounts as well as Facebook and MySpace accounts are on the rise.

Doing a spot of research on the web, I came across this excellent post (which I strongly encourage you to read in full) that mirrors precisely what I experienced and did after my Gmail account was hacked. It also saves me from going into detail about the remedial measures I took after the attack. One thing I did that’s not mentioned in Tiffehr’s post was to log out of all other sessions on Gmail (Remote Logout is a new Gmail feature).

I want to underline and reaffirm concerns flagged in Tiffehr’s post,

• There is very little reassuring documentation or steps to rectify a frozen account.  An e-mail form that lets you indicate the number of hours you’ve been waiting between last reporting your frozen account.  You can fill that out to your heart’s content, but there is no message confirming your issue has entered any kind of queue.
• There is nothing in the help documentation about a hacked account for which you have control.  It seems the majority or reported cases are hijacked accounts, not one-time-hacked accounts.
• Google’s help system is not at all reassuring about the security of your other google services when an account is hacked.  In fact, there is not one word about how to report or escalate hacked activity in other services.  I find that an egregious oversight that now puts me much more toward the school of thought that google’s combined account is a terrifying thing to be feared.
• The help forums are shallow.  So are general google searches about hacked accounts.
• Google is in fact of little help when it comes to looking up information about a hacked Google account.

My Gmail account is still frozen and I hope they keep their word and unfreeze it after 24 hours. Far as I can tell, there’s simply no way to tell Google to speed things up. 

Finally, it’s a strange, unnerving feeling to have your email account hacked. I’ve used email for over 12 years and this is the first time a spambot has managed to crack my password. It’s all the more surprising and worrying because I always log into Gmail securely and my passwords are robust.

There’s also the associated paranoia of my other email accounts being compromised in the same manner, which has led me to change all my passwords of all my emails, Facebook and other online accounts. Which is a lot and a lot of work. Not to mention a bloody pain in the arse. 

I’m seriously thinking in investing in 1Password, which also has a delectable iPod Touch / iPhone version. Does anyone know of a comparable / better product?

At US$ 35, 1Password isn’t cheap, but the cost of a hijacked account and the havoc it can create is incalculable, so I think I’m going to go ahead and purchase this ASAP.

UDPATE

Went ahead and bought 1Password, which works precisely as advertised and after a couple hours of use is something I can recommend for users who want a robust password generation / management tools for their Mac.

The only shortcoming at the time of writing is that there is no way to access my passwords or manage them online. There are several workarounds for this though. Syncing 1Password with my iPod touch gives me access to the passwords on the go if I’m not on my Mac. The only problem with this workaround is that the new passwords I’ve generated are a mix of alpha-numeric and other ASCII characters which are rather tedious to type in manually and impossible to remember. The other solution is more elegant – a password protected web page that I can create using the programme which opens in Safari, with the ability to copy and paste my passwords.

There’s also a web based version of 1Password in the works which needs an invite to participate in.

The 1Password iPhone / iTouch app is extremely functional and beautifully designed to boot. I wish there was a way in which it integrated with native iPod Touch apps such as Facebook for seamless password management, but I guess this is impossible on these devices under strict Apple APIs. At present, the app launches the iPhone versions of Gmail and Facebook when you click on each secure account, which is not bad, but not ideal for those of us now used to accessing Gmail via the native applications.

Here’s the 1Password video (narrated by a bloke with a distinctly British accent) that’s a good intro to this programme. 

done

My Gmail is still frozen.

I’m still unsettled by this experience, but I’m reading up on this issue, I’ve installed 1Password and I’m now more diligent about logging off from website even when they are on my PC. In the interim, many many friends and colleagues have written in with stories of how their own email accounts and social networking site accounts were hacked. Some repeatedly.

It’s also been a wake up call as to just how much of data I already have “in the cloud” that could be inaccessible or worse, misused, if someone were to get access to the respective accounts. Perhaps all users who have had their privacy and online security compromised look at the web storage differently.

I know I do.

UPDATE – 20th September 2008

Lifehacker has an excellent round-up of password managers for Windows as well as OS X.