What the hell is this? Gmail wants my cell phone number?

[Krynn72]

I click my gmail bookmark, and it asks me to log in. I know it logs you out every once in awhile for security purposes, so I go ahead log in, but then I see this:

So uh... what?

 

[Bad^Hat]

The address has https:// in front... does that mean anything? D:

Edit: Nevermind just checked my gmail, that has it too.

 

[Krynn72]

I'm pretty sure that just means its a "secure" website.

 

[Raziaar]

Yes, it just means it uses HTTP Secure protocol.

I logged into my gmail just fine. It would suck balls if I have to use a mobile number like that says... I don't have a mobile.

 

[Krynn72]

So I did it, since it actually does seem legit after looking through gmail's website for password recovery. It looks like they do it when your password is compromised. I'm at my inbox now and apparently someone must have gotten in because I have a ton of "failed to send" messages. Whoever got into my account sent a link out to my entire contact list. I'm not going to post the url, but its a russian domain. :|

So if anyone gets an email from me with a link in it, DON'T CLICK IT. I'll be sending out emails to everyone to make sure they don't, but theres several people on here it tried sending it to, including Acepilot, Cyberpitz, and Ennui.

 

[Raziaar]

So I did it, since it actually does seem legit after looking through gmail's website for password recovery. It looks like they do it when you password is compromised. I'm at my inbox now and apparently someone must have gotten in because I have a ton of "failed to send" messages. Whoever got into my account sent a link out to my entire contact list. I'm not going to post the url, but its a russian domain. :|

So if anyone gets an email from me with a link in it, DON'T CLICK IT. I'll be sending out emails to everyone to make sure they don't, but theres several people on here it tried sending it to, including Acepilot, Cyberpitz, and Ennui.

Not me. I hate you Krynn... I hate you! <sniff>

 

[Krynn72]

Could be you too, I don't recognize a lot of my email addresses. I just usually type names into the To: field and gmail enters their actual addresses.

 

[Raziaar]

I haven't had any e-mail that was anything other than raziaar@ in like 12-13 years.

But, I'm just giving you a hard time.

 

[Krynn72]

Well I just searched my contact list, and you're not on it. Who feels bad now?!

 

[Raziaar]

Anyway, I hope your account is all back to order. Damn hijackers.

 

[Druckles]

You could have followed support if you really didn't want to enter your mobile number.

I'm curious as to how that works, though. I assume it only displays that screen if you type in your original password, otherwise anyone could type their mobile number in.

Now I want to go work in Google's security department just to find out how it works. That and the bean bags.

 

[BabyHeadCrab]

Better than a bunch of retarded impossible to read text, imo

GUESS THESE LETTERS TO PROVE YOU'RE NOT A SPAM BOT, ASSUMING YOU KNOW LATIN

Here are just a few problems to aspie over:

holy balls I lol'ed

 

[Krynn72]

You could have followed support if you really didn't want to enter your mobile number.

I'm curious as to how that works, though. I assume it only displays that screen if you type in your original password, otherwise anyone could type their mobile number in.

Now I want to go work in Google's security department just to find out how it works. That and the bean bags.

Yep, after you try to log in, using your old password, it prompts you. Which is stupid, because then whoever got into your account can do it (if they actually figured out the password, and it wasn't just entering random shit until it worked) and use their own phone to reactivate it.

 

[No Limit]

So I did it, since it actually does seem legit after looking through gmail's website for password recovery. It looks like they do it when your password is compromised. I'm at my inbox now and apparently someone must have gotten in because I have a ton of "failed to send" messages. Whoever got into my account sent a link out to my entire contact list. I'm not going to post the url, but its a russian domain. :|

So if anyone gets an email from me with a link in it, DON'T CLICK IT. I'll be sending out emails to everyone to make sure they don't, but theres several people on here it tried sending it to, including Acepilot, Cyberpitz, and Ennui.

You have an android phone by any chance? Today I found out my boss had a virus on his moto droid that was sending out emails to everyone in his contacts list. If you don't have an android phone one of the computers you worked on has to have had a virus. Get that checked.

 

[Krynn72]

I don't think I've checked my email on anyone's computer but my own, and I don't have an android phone. Would be odd if my computer had a virus, because I haven't downloaded anything suspect in a long while, plus I always use my computer under a regular account type, rather than admin (as per your recommendation in a thread a while ago).

 

[No Limit]

You have to becareful, running as a regular user is a huge security improvement but it doesn't make you immune to viruses; but it does make removing them totally painless.

A virus can still install itself through your local profile. It is then limited to that profile so it won't infect any other parts of your system. And you don't need to download anything to get infected, if you have adobe reader or adobe flash there are countless exploits out there for those. Install malwarebytes under the administrator account and update it. Then log back in to the restricted user and do a full system scan. Hopefully it won't find anything, if it does just have it remove everything.

If there is no virus on there there is also the possibility that someone on your network is infected. A virus can easily set up a man in the middle attack on your network using ARP cache poisoning (arp spoofing). It would make all the internet packets from your computer be redirected to the infected computer which would then steal all your passwords and other sensative information. The problem there is you should see a certificate error when going to secure websites such as gmail.

 

[Druckles]

Yep, after you try to log in, using your old password, it prompts you. Which is stupid, because then whoever got into your account can do it (if they actually figured out the password, and it wasn't just entering random shit until it worked) and use their own phone to reactivate it.

Yeah, that was what I was wondering about. It could be that it blocks the IP address, too, so they wouldn't be able to log back in. If it's a virus, this should solve the problem. I'm guessing it wouldn't be smart enough to try a proxy.

 

[Krynn72]

If there is no virus on there there is also the possibility that someone on your network is infected. A virus can easily set up a man in the middle attack on your network using ARP cache poisoning (arp spoofing). It would make all the internet packets from your computer be redirected to the infected computer which would then steal all your passwords and other sensative information. The problem there is you should see a certificate error when going to secure websites such as gmail.

Hmm. This seems the more likely of the two possible scenarios. My house has 3 desktops and two laptops (and one ipad) on the network sometimes. I guess I'll just have to get everyone to run scanners.

 

[No Limit]

You can type arp -a in the command prompt and this will give you all your cache'd arp entries. The IP address of your router and or modem should have a mac address that matches the one on the back of your router/modem, if it doesn't then someone is spoofing the arp entries on your network.

The only thing that doesn't make sense to me here is if this type of attack happened you would have gotten certificate errors when trying to log in to gmail. You can download cain and able to see how this type of attack works.

Don't discount doing a scan on your system. Malware bytes is a great program that doesn't take up any resources when you aren't using it, so no hurt in having that installed and running it once in a while since having flash and adobe reader on your system opens you up to all kinds of exploits that can in some cases infect your local limited user profile without any kind of prompt.

There doesn't seem to be any question about your google account being compromised so clearly something got you.

 

[morgs]

Did anyone else read this as Gman wants my cel number?