Ask HN: Google warned me that a state organized hacking group targeted me

https://news.ycombinator.com/item?id=16722124

by Bombthecat • 8 years ago

50 42 8 years ago

news.ycombinator.com

Has anyone of you guys gotten that message?

I'm still not sure why they targeted me nor how? I'm neither famous nor a journalist or blogger or scientist or something like that.

Nonetheless,what can I do to find out how they tried it? Or if they broke in or if my network is comprised?

And what can I do to prevent in future? Beside 2fa.

buschkowitz2• 8 years ago

This in itself sounds like a phishing attack. Is the mail authentic?

Bombthecat7• 8 years ago

Not a mail.you get that message when logging in to Google.

I first thought that too.and tried another browser ( got that message in Vivaldi first,than tried IE) Same result.

Here are some old articles about that:

https://www.recode.net/2017/3/24/15054954/google-reassures-u...

http://www.zdnet.com/article/google-heres-why-you-shouldnt-f...

buschkowitz2• 8 years ago

Yea, it does look legit after reading the articles you posted. I am not a hacker per se, but I guess uncovering what a gov hacker did in your account is highly difficult. In terms of safety, use a password manager that creates and stores hard-to-crack passwords for you. I am pretty happy with Dashlane, 1password has a good reputation, too.

DyslexicAtheist• 8 years ago

interesting. does anyone know how ProtonMail handles such situations and whether they alert their users?

fwdpropaganda• 8 years ago

This is when you know you've "made it", when state intel is trying to get to you :-)

Seriously now, even though you're not famous or a jounalist you might have some type of valuable access in your life? Or maybe it's just a false positive from google. Or maybe you weren't being especially targetted, and instead your e-mail ended up in some list of valuable e-mails (rightly or wrongly).

meganibla• 8 years ago

Yeah but they’re not going to let you know if the NSA or the CIA targets you.

So the message can be read more like: a non-allied state actor has targeted your email and we are notifying you to show how good we are. Please note we will not reveal when you are targeted by an allied state intelligence. Privacy is relative, mostly an illusion. Thank you for your cooperation.

Bombthecat7• 8 years ago

Jeah,my thought were along that line to.

It's not America. More likely is Russia,China,Japan, Germany or God knows...

Bombthecat7• 8 years ago

Another user here noted that Google also tells you if you were just in a circle.

But they didn't tell me...

anotheryou• 8 years ago

I got it too years ago. It said it might also be my circle of contacts being attacked. So it might not be you in specific.

Bombthecat7• 8 years ago

Mine didn't..

That's bad I guess.

supergirl3• 8 years ago

how do they know it’s a state organized group?

badrabbit2• 8 years ago

Advanced Persistent Threat (APT aka Nation state) actors are tracked using known indicators of compromise. These indicators can include infrastructure identifiers such as domain names and ip addresses that maybe used in a phishing url or post-compromise for command-and-control or to download other malware.

Other indicators can include malware sample hashes or actor-specific detection rules (Example: YARA,Snort or Netwitness rules).

These indicators are typically not public. Some can be accessed if you pay the right sum of money and undergo vetting,still,some are kept private within the relevat security firms or organizations.

As you can imagine,Google has their hands in many pies including security research and threat intelligence collection(Everyone loves their VirusTotal intelligence product). They can scan email metadata for any of these indicators as they see fit.

Generally speaking,some indicators are of such high quality, they can be used to detect well crafted spear phishing by a nation state actor. But most are good only to detect untargeted attacks or targeted attacks that include a large number of targets.

Hope that answered your question.

supergirl3• 8 years ago

it doesn’t. i was asking how do they know in this case

supergirl3• 8 years ago

also why do people like to use the term nation state when it involves hacking. just to sound fancier? according to wiki nation state has a precise meaning and it’s not equivalent to the term country

huntsman3• 8 years ago

My team at Google is responsible for identifying the users we give these warnings to. Here's what I wrote last year to provide a bit more context: https://security.googleblog.com/2017/03/reassuring-our-users...

The most important point is that this indicates signs of targeting not compromise. Also,like all systems there are false positives especially for security researchers and the similar types but we hope it is a useful indicator to reassess your security posture.

pimlottc• 8 years ago

Thanks for the extra context. One thing I didn’t see addressed that I’m curious about is how does Google distinguish a “government-backed” attack vs your normal everyday hackers? Is it a function of the specific methods used, the depth and breadth of resources deployed, source ip ranges, or what?

huntsman3• 8 years ago

It's a range of factors. Basically this warning means that what we detected ties in some way to wider activity that looks government backed. There's some border cases, but in practice the targeted campaigns of governments look very different in both technique, volume and targeting to say a widespread cybercrime phishing campaign. It's not a perfect science, but we believe its worth calling out separately the activity that does fall into this bucket.

rabboRubble• 8 years ago

Perhaps you aren't of interest, but you are in the address book of somebody of interest, or in the address book once/twice/thrice removed of somebody of interest.

jacksmith21006• 8 years ago

Ironic Google warns you of this while we have Apple moving their iCloud to GCBD in China where GCBD is managed by the China Gov.

Then they also moved the keys also to China. Then on top removed the VPN apps from the app store.

Google Gmail was getting hacked by China gov so they warned and ultimately left China.

Even Amnesty International has opened a campaign on Apple and their disregard for privacy.

https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... Campaign targets Apple over privacy betrayal for Chinese iCloud ...

Ask HN: Google warned me that a state organized hacking group targeted me

Related Stories