Alleged leak of more than 5M Gmail accounts

by pmalynin • 12 years ago

158 127 12 years ago

bagels• 12 years ago

Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it.

I generally don't bother, because it's just more security risks.

crummy• 12 years ago

"If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac*nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy."

the_af3• 12 years ago

Only up to 3 characters? Why 3? Especially since it's an email address and not a random string, which limits the possibilities for the 3 missing characters. This looks like it's giving more info than you'd think to a dodgy website...

joeblau• 12 years ago

Exactly. just show me the list and let me do a command+f. I'm not trying to enter my email into their system.

durrrrrrr• 12 years ago

Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?

FatalLogic2• 12 years ago

It could be even more dangerous than you are imagining.

If you check a username, then you would probably also be revealing the IP address range and browser referrer that is normally used to access your account.

Google uses IP address and location to help detect illegal access. So giving away this information could make it easier for your account to be stolen.

emeidi• 12 years ago

How? Is the hacker going to buy a plane ticket, fly to my home and plug his laptop into my network?

kostko• 12 years ago

Give me your email, and I'll check for you. I won't do anything, I promise. Joking aside, I downloaded the list and my email is not listed. Phew...

dredmorbius2• 12 years ago

I also checked a few of those near and dear to me. Should probably try my full address list...

VikingCoder• 12 years ago

...or that when you log on to the site, the site would tell you that your account was in the list.

rodrigorega• 12 years ago

To avoid this, I made this script to check if my email addresses are in a leak list: https://github.com/rodrigorega/wordlist_compare

mlatu4• 12 years ago

nice.. i'll use grep instead, thanks for the effort though

rdjik• 12 years ago

It's nowhere near advisable for anyone to submit their address to that box.

Notwithstanding the questionable reliability of this what is meant by "leaked"? a trove of phished credentials does not really qualify as a "leak".

lucaspiller• 12 years ago

I just tried it with my old Gmail account that I no longer use, and it displayed the first two letters of my password. The password was random letters and numbers, 16 characters, so not easily guessable. Seems legit to me :-)

nness• 12 years ago

ecma• 12 years ago

On August 20 an address of mine was entered and my Origin account was subsequently compromised. Looks like this leak matches the creds that account had before I reacted. Happily enough it was a low equity account, I had 2FA and nothing else seems to have been grabbed.

Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.

ars• 12 years ago

I used the wildcard and mine is not in it.

So I don't think this is a hack of google itself, but rather just collecting addresses from elsewhere and collecting the gmail ones.

vocket• 12 years ago

I tried it and it gave me a year old password. I am guessing they only got a hold of old passwords.

tonymon• 12 years ago

Links to zip archive with plain email list (without passwords):

https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4...

Alternative: http://rghost.net/57937836

The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails

thaumaturgy• 12 years ago

I bet there are some people who have other leaked account & password lists, and since the isleaked.com site is kind enough to give the first two characters of the password for any given email account, it'd probably be possible to guess the passwords for some of those accounts.

psykovsky• 12 years ago

Am I blind? I only see if there is a match, no password initial letters at all ???

EDIT: Not blind, it just doesn't show the initial letters if you search using a wildcard even if there is only 1 match.

mct• 12 years ago

Interestingly, there are a large number of non-gmail.com addresses in there, including 123k yandex.ru addresses, plus a (very) small number of yahoo.com and hotmail.com addresses. Here's the output of "cut -d@ -f2 | sort | uniq -c | sort -nr":

https://gist.github.com/anonymous/255959493c0a26cce856

The data hasn't been very well edited from whatever dump it came from. For example, there are lines that end in "gmail.com_xtube", "gmail.com7777", "gmail.com|login", etc, which are curious.

unicornporn2• 12 years ago

OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...

hmottestad2• 12 years ago

The webpage will give you the first two letters of your password.

important• 12 years ago

Assuming hacker did sign in into your Gmail , you might be able to get that information from the list of last logins in your Gmail account. Any IP that's out of your normal location would reveal that. More in this link https://support.google.com/mail/answer/45938?hl=en

corysama• 12 years ago

Thanks! Checking that list against my gmail contacts, I found six of my friends in there!

reirob• 12 years ago

Did the same, found one.

curiousDog• 12 years ago

It says mine is in it but suggests the wrong password. I don't think I even had a password with those letters plus I've had 2FA for a while now. Wonder how legit this is.

fnayr• 12 years ago

My older account (8+ years) was leaked but my more recent one (4+ years) was not.

EDIT: This was good to find out because I did not have 2 factor auth on my older account as I hardly use it anymore.

Sommer717• 12 years ago

Weird, it gives me a very old password.

Though back when I had that password my account was hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.

caractacus• 12 years ago

Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions...

Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.

INTPenis• 12 years ago

I can also verify this. One of my gmail accounts was in there, incidentally the "trash account" I use when I sign up for various services online.

And the password was one of my lowest security "trash passwords" I use with this e-mail as login sometimes if it's a service I wouldn't trust or don't care if it's compromised.

So I wouldn't worry about this. Someone had their site hacked most likely and these are logins to the site, not from Google.

minusSeven• 12 years ago

can anyone talk about how this site works and where they get the list of leaked email address from ?

hotmilo23• 12 years ago

Tried it with mine and it said yes but had the password wrong. It didn't match a password I've ever used...

tectonic• 12 years ago

It's suggesting a password that I do use on some sites, but never have on Gmail. I think this is a scraped database from somewhere else...

zwischenzug• 12 years ago

Same for me.

hmottestad2• 12 years ago

My Gmail was hacked a few years ago. This database showed the first two letters of the password I had at the time.

I had (stupidly) been using the same password on other sites, so after I was hacked i made a new password just for gmail.

Now I also have two factor authentication :)

hayksaakian• 12 years ago

checked the plain text list against against 20 of my contacts, and nothing matched

gotothrowaway• 12 years ago

For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years.

That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.

chippy• 12 years ago

but matched up with your email... and many people don't have throwaways

mcoliver• 12 years ago

Interestingly enough fuck@gmail.com is an email address.....grepping the email list txt file is ahhhmazing

Fede_V• 12 years ago

I just checked using a bunch of throwaway email accounts I had to sign up for various promotions. One of them was leaked - and one of them had a very old password associated with it.

I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.

cornewut2• 12 years ago

I don't think this is leaked from Google. Probably people just were using the same password for some other service...

sinak• 12 years ago

Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services:

- Google: https://www.google.com/landing/2step/

- Github: https://github.com/settings/security

- AWS: http://aws.amazon.com/mfa/virtual_mfa_applications

- Facebook: https://www.facebook.com/settings?tab=security

- Twitter: https://twitter.com/settings/security

- Dropbox: https://www.dropbox.com/account/security

- Lastpass: http://helpdesk.lastpass.com/security-options/google-authent...

- More: https://twofactorauth.org/

unknownBits2• 12 years ago

With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say:

"During sign-in, you can tell us not to ask for a code again on that particular computer."

Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

doubt_me• 12 years ago

https://play.google.com/store/apps/details?id=com.google.and...

ak217• 12 years ago

I'm not sure exactly what point you're trying to make, but you seem confused about how 2FA works.

The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP-based). Typically the cookie only lasts for 30 or 60 days.

If what you're concerned about is the idea that Google knows your phone number, you can use Google Authenticator or another TOTP app instead.

JosephRedfern• 12 years ago

If you're worried about giving Google your phone number, you should perhaps also be worried about them having access to all of your email messages.

bigiain• 12 years ago

My gmail(and aws and dropbox and digital ocean and github and zoho and ...) TFA uses a TOTP app, not my phone number. (and works just fine on my iPad - which doesn't really have a phone number - at least not one I know or worry about...)

Also, according to the three biggest telcos where I live:

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication," ( http://www.itnews.com.au/News/322194,telcos-declare-sms-unsa... )

probably_wrong3• 12 years ago

Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways.

Although that wouldn't be 2FA, it's worth noting that Facebook, Hotmail and Flickr will ask for some extra verification if you connect from a different country that usual. So that's probably not a bad idea.

dragonwriter• 12 years ago

With two-factor authentication you are happily providing gmail with your phone number.

Which I also provide to Google because all of my phone numbers are forwarding numbers for my GVoice account, so that's not a big deal.

They say they need this to send you a verification code when you log into your gmail account.

Sure.

Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

How can they determine its valid without the second factor the first time you log on from a particular device? That's a key feature of 2FA (plus, if you ever use a shared computer, you don't want to choose the option to never ask for a code again on that computer!)

nodata2• 12 years ago

I don't want 2FA for absolutely everything. I want to authenticate once.

valarauca1• 12 years ago

Then your laziness is important to you then your security.

marcodena• 12 years ago

I would add Mitro.co, which is Open Source (http://www.marcodena.it/blog/stop-remembering-passwords/)

x3sphere• 12 years ago

The passwords seem to have come from somewhere else. My email is on the list, but the password is wrong and actually matches the one I use for throwaway accounts.

maxerickson• 12 years ago

There seem to be enough people reporting this to do some correlation and figure out what was really compromised.

myrandomcomment• 12 years ago

So my wife's is in there but the password it gives is from over a year ago.

cornewut2• 12 years ago

Quite a few of the leaked accounts also appear to be using SoundCloud. Could this be related?

j0hnskot• 12 years ago

It says mine is leaked too. But the two first digits of my password it gives me are not relevant with my password. What does this mean?

turtles• 12 years ago

Where the passwords at? Would make a good common passwords list for security testing.

EDIT: Not seeing the password list online, and below someone mentioned it showed an old password for them, so thinking someone is making this up.

tapsboy• 12 years ago

I just tried it with an old account. It correctly gave out the first two letters of existing password

Luckily, 2FA was already enabled.

aquadrop• 12 years ago

It has passwords collected from other sites, at least from heroesofnewerth.com

That's one more example against password reusing.

Vincez• 12 years ago

Sites should stop storing plain text password

Intermernet2• 12 years ago

I can tell from the first 2 characters that the leaked password associated with my email address was scraped from Pizza Hut Australia's online ordering system (they only recently implemented SSL on the login page).

It's interesting that I setup a particular password for that service when I noticed it didn't use SSL. Make's me wonder how many databases this comes from. It certainly isn't Google's.

junto• 12 years ago

Out of interest, do you know from your data as to when your Pizza Hut Australia account could have been compromised? Was it a plus addressing yourname+pizzhut@yourdomain.com type email address?

Would be interested to know more about this. I'm @junto on Twitter if you don't mind contacting me. It would be appreciated.

Intermernet2• 12 years ago

Hi, No I assume that the breach happened in the last 3 years, and before they implemented SSL. I have noticed that http://www.pizzahut.com.au/members/login is still a valid page, inaccessible via SSL, but haven't checked if logging in on that page actually works.

I noticed that they've also implemented a password reset email, instead of their previous practice of just emailing you the password. Hopefully this means that they are no longer keeping unhashed passwords on the system.

It seems that they realised they weren't doing things correctly in the last 6 months (maybe a bit longer, not 100% sure) and have taken steps to rectify this. This may be due to a discovered security breach, but may just be a change in their internal IT policy. Hopefully they're now following best practices!

joshka• 12 years ago

grep admin google_5000000.txt -c 1019

sigh

NaNaN• 12 years ago

A summary about phishing:

    1. Found you password with the same email address somewhere
     and ask if you still use that email address on another site.
    2. And get your IP, then login through proxy to bypass the security checking.
    3. Still, to know which email address is in use.

If you just worry, change you password right now without using their service. :P It may be good that every a few months some guys remind you to change passwords.

broolstoryco2• 12 years ago

Exactly what proxy would allow to appear to be using my IP address?

netrus2• 12 years ago

For many security checks, a proxy in the same country would be sufficient. They might only check if you log in from Asia and America at the same time.

laacz• 12 years ago

This leak is more likely a result of phishing attacks. So, if you have been (and still are) careful enough, your email should not be on that list.

noyesno• 12 years ago

Interesting, the password associated to a secondary Gmail account of mine turned out to be not for Gmail login but for a Friendster.com account from years back that used it as user ID.

broolstoryco2• 12 years ago

I found my email there, but the first two letters are of a password that I have never used with gmail (it is a disposable password i use for uniportant sites)

nmjohn• 12 years ago

The full list was leaked, my email was on it but I've never used that password for an email account in my life. It's my throwaway "I don't trust this website" password. I use it for a reason!

kaoD• 12 years ago

My account was compromised a couple months ago. Google detected a series of logins from Poland, Lithuania and Oregon (probably botnets, which I think it rejected) and sent me a warning.

I expected my address to be there but it wasn't. Makes me wonder.

onestone2• 12 years ago

It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.

ndr• 12 years ago

Can you disclose which site?

onestone2• 12 years ago

Can't be sure, it's a "garbage sites" password which I've used too many times on untrusted sites. Any one of those sites could have been hacked, or had been a phishing gateway itself.

Of course what I did was bad practice. One should store passwords in a secure password manager, and use a different (preferably 30+ chars) password on each site.

rasz_pl• 12 years ago

it has my ancient password from ~2008 for

http://login.aeriagames.com/user

That company went under 4-5 years ago, and I seem to remember few forum (phpbb afaik) software/database breaches at the time.

ganessh• 12 years ago

My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?

kibibu• 12 years ago

Based on the two letters of mine, I have a feeling that it's from a BB forum crawl or similar.

Sarkie• 12 years ago

It has a password for another site but not gmail.

Not sure which, but it isn't gmail.

marksamman• 12 years ago

If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested.

For Gmail users, it's a good practice to register to websites using username+websitename@gmail.com (e.g. mark.samman+hackernews@gmail.com), that way you'll know who leaked your data when it appears in lists like this or when you get spam. Gmail ignores the plus character and anything that follows the plus. You can also add dots at arbitrary positions in the username part.

unbelievr• 12 years ago

Going with your suggestion, the amount of DBs must be huge. The most prominent additions after the + sign (ignoring just single numbers) are:

- Bioware (54)

- Bravenet (19)

- Bryce/daz3d/daz (244)

- Eharmony (64)

- Filedropper/fd/etc. (113)

- Freebie/Freebiejeebies (64)

- Friendster (65)

- Hon (42)

- Policeauctions (28)

- Savage/Savage2 (116)

- Xtube/porn (200ish)

netrus2• 12 years ago

On the other hand, this will reveal to anyone you have a HN/NRA/porn account in case of a leak ;)

archenemy• 12 years ago

I have always wondered what use is this with regards to spam and sneaky address lists. What exactly prevents someone from cleaning up the addresses before letting them out?

If I were a bad behaved site and sell (sold? sorry, tired and non native speaker) my userlist, i'd probably remove all plus-suffixes from the addresses. Same as if I were a blackhat stealing them to be sold.

Honest question, no snark.

JasuM• 12 years ago

I was on the list and now I got a Facebook password reset code to my phone, without asking for one. Someone already seems to be trying to use the passwords.

Grue3• 12 years ago

My email is on there, but the password is not the one I'm currently using. Though I wonder which site or sites I've been using this password on. Has anyone figured it out? I'm going to crosscheck with my saved passwords list in Firefox when I get home.

cordite3• 12 years ago

The problem with 2FA for me is that I am underground for a good part of my day, without reception.

I use google voice to get notified of calls and voicemails so I can be fairly responsive, but obviously using another service that can be accessed in multiple places defeats the point, especially when owned by the same people.

palebluedot2• 12 years ago

You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.

cordite3• 12 years ago

Yeah, good luck on a windows phone.

priteshjain• 12 years ago

Site is down right now :(

LilyOfTheValley• 12 years ago

Two-factor authentication looks more appealing then ever. But first go to www.gmailleak.com make sure your account was not compromised.

Alleged leak of more than 5M Gmail accounts

Related Stories