Stealing Gmail

Peter Snyder and Chris Kanich at the University of Illinois at Chicago recently unveiled a tool that reveals risks users face through their Gmail account. Cloudsweeper audits a user’s Gmail account to determine the risk of exposure and the financial value of a stolen Gmail account. If someone hacks your Gmail account, accesses your phone and computer and invades your computer, they may be able to access a range of other data via your Gmail or other email accounts.

There are a range of risks that may be lurking in your email account. The two primary risks include access to online accounts and capturing plaintext password information. Cloudsweeper searches for exposure in both of these areas.

When you set up an online account such as Amazon or iTunes, you must give an email account. With the convenience of Gmail, many people have gotten in the habit of archiving emails instead of deleting emails. When a hacker invades your email, one thing they search for is archived emails containing account credentials. Recently, Krebs on Security reposted a graphic he created last year, showing the value of a hacked email account.

As Krebs demonstrates, a hacked email gives thieves access to your information and a variety of your accounts. They may be able to access your account credentials for companies like iTunes, Fedex, Amazon, and more. They may access your bank account, your stock information, or other financial information. If you utilize online backup/file sharing like dropbox or box, all your data may be exposed. Attackers can steal your software license keys, valuable work information, or passwords that have been sent via plaintext.

Last year, I posted an article on “Staying Safe in an Age of Hacking.” I’ve copied the highlights. In light of Cloudsweeper, I would add keeping your email cleaned out and deleting old emails that content account information or other secure data. Here is a quick overview of the highlights I listed previously.

Stay Up to Date – When applications such as browsers, operating systems, PDF readers and more release security patch updates, be sure to stay-up-to-date. This should be a given, but many businesses fail to stay keep up to date, leaving glaring security holes.

Multiple Passwords/Two Factor Authentication – Last year, Matt Honan ran a series of pieces on his online meltdown. In the end, his key security takeaway was use different passwords on each account and use two-factor authentication when available.

Training Staff – Keep your team regularly refreshed on guarding against attacks like phishing and spam; train staff to practice clean desk practices (see The Challenge of Guarding Ideas); and make sure everyone follows mobile device best practice security habits.

Layered Defense – You need a multi-layered defense plan that include firewalls, email security, anti-virus software and a range of security technologies.

Security Assessment – You need to conduct ongoing security assessments. It is helpful to utilize an outside service to assess your security policies, procedures, tools and so on.

The post Stealing Gmail appeared first on Integracon Technologies Blog – Computer Support in Knoxville, TN.