[SLL] Gmail Security Hole

[Jerry Horvath]

My Gmail has been compromised.  See the following link.

http://net.nana.co.il/Article/?ArticleID=155025&sid=127

 Any comments will be appreciated.  What follows is an E-Mail from my brother:

Jerry,

You won't believe this, but some how/some  way I accidentally
"cracked" your gmail account!!!!!   The evidence is attached (a
snapshot of your "sent" items).

Quite frankly, I am completely perplexed on how I accomplished this!
Let me explain.  This weekend I placed a small order online for some
plants for the home.  This facility uses "Google Checkout" to submit
payment.  I did not have a Google account so I had to sign up (this
weekend).

Utilized by me is "RoboForm" to maintain track of passwords.  You can
search for this to understand all its capabilities, but simply one
uses a main password to secure a database of passwords for various
sites.  It has the smarts to gather in User IDs & passwords when you
sign-up on appropriate web pages.  For my sign-up for Google Checkout,
I have the User ID/pw  combo for the account I signed up for with
"balsac at yahoo.com", but I also have your User ID/pw!!!!

Somehow during the automation, RoboForm captured your sign-in
creditials for User ID "jerroldhorvath", and tied it to the web page:
https://www.google.com/accounts/ServiceLoginAuth.

I don't have the slightest idea how this happened; it can probably be
used as a case-study for your computer forensics interests.  Obviously
a major security flaw.  From a personal standpoint, I will monitor
very closely if I was phish'd as I used & entered credit card info for
this transaction.  Most notably, perhaps it's a coincidence, perhaps
real.  This weekend, I am positive that I completed a transaction on
Eddie Bauer's web site too.  Now they have no record of this purchase
being completed.  Granted that I was, as usual, busy doing multiple
tasks, and I may have not fully completed the transaction, however in
my mind, I am positive I did, yet EB shows no record!  This may be a
Red Herring, or coincidence due to the breach with your account, I
don't know.


Mark



-- 
Jerry Horvath

aka -  jerrypenguin The Linux Longshoreman
mathematics/philosophy/computers/maritime

"It is cheering to see that the rats are still around - the ship is not sinking"
Eric Hoffer - Philosopher/Writer/Longshoreman