Gmail hacked - Evo is number one suspect

[htcevolee]

Dont download the apps with the chinese writing on them. =P Also try using APpBrain as they "seem" to put more quality controls on which apps are good. Make sure to read what the APP has access to when installing. Anything that sends your password via clear text I would avoid.

 

[dfn]

I too believe that the Evo is a culprit.

I have hotmail but i do not register it against any computer in an email program. Never had a problem till i synced my hotmail with the EVO.

i had also synced my gmail to my evo at the same time as hotmail and now that address is compromised. My other email accounts (yahoo and one provided by my ISP) were not having problems.

 

[BeerPimp]

Could also be Coincidence. Also could be you have an app that did it. When you download apps if it says it needs to access your contact info and that has nothing to do with what the app does do not download it. Always be suspicious.

 

[Wadester]

has this happened to anybody else?

My Facebook account was hacked about a month after I got my EVO. I, too, am an IT geek and have a strong password. Someone got in and started spamming my friends with those stupid "one day free <item>" offers. I changed my password and it stopped. It does not seem coincidental to me.

 

[81_]

Yes...let's take a look at the Apple site shall we...and what do we find?

The reason Apple sells Norton is to quiet all the windows switchers that ask for an Anti-virus program when they are buying the computer. Not some real threat. And hey..they make some money on it too. But clearly it is not needed. If it were, millions of Macs would be infected since most do not have Norton (or similar) installed. If there were real threats, not only would Macs be infected all over the place, but Apple would be pre-installing an Anti-virus program with every Mac sold. Since they don't, and since they even crow about the lack of virus susceptibility right on their website, what you are saying just isn't the case.

If you (mistakenly) think that the you can't get a virus on a mac" adage died years ago, then you need to go visit Apple's site:

Apple - Why You?ll Love a Mac - It has a better operating system.

it may not get a "PC" virus, but it can get a "MAC" virus.

there is also an issue with the Iphones floating around. something about remote jailbreaking.

http://www.eweek.com/c/a/Security/iPhone-Jailbreak-Exploits-Remote-Security-Hole-115942/

 

[ragnarokx]

it may not get a "PC" virus, but it can get a "MAC" virus.

there is also an issue with the Iphones floating around. something about remote jailbreaking.

iPhone Jailbreak Exploits Remote Security Hole - Security from eWeek

You're right, it can get a "MAC" virus. Luckily there are none in the wild, so it's a moot point.

The iDevice exploit has to do with a vulnerability with the font being read in PDF files - that's how jailbreakme.com let's you jailbreak by simply visiting a website.

 

[septro]

The EarlyMon dude cracks me up..

Charlie Miller has been making mince-meat out of MacOs for the past few years and claims that it is much easier to hack than Windows 7. This from the guy that took 2min and then 7seconds respectively the past 2 years to hack Apple Macs during the Pwn2Own contests. He's also the first guy to hack the iPhone back in the day.

Questions for Pwn2Own hacker Charlie Miller | ZDNet

Charlie Miller (security researcher) - Wikipedia, the free encyclopedia

 

[EarlyMon]

The EarlyMon dude cracks me up..

Hey, thanks!

I crack me up, too.

Especially when I decide to not explain the differences between exploits and viruses and to not re-hash what I actually said as opposed to what you decided I said.

 

[IOWA]

The EarlyMon dude cracks me up..

Charlie Miller has been making mince-meat out of MacOs for the past few years and claims that it is much easier to hack than Windows 7. This from the guy that took 2min and then 7seconds respectively the past 2 years to hack Apple Macs during the Pwn2Own contests. He's also the first guy to hack the iPhone back in the day.

Questions for Pwn2Own hacker Charlie Miller | ZDNet

Charlie Miller (security researcher) - Wikipedia, the free encyclopedia

Id love to have that guys skill set. Better hit the books then...

 

[EarlyMon]

Yeap, I can see where that can come in handy.

Where you been keeping yourself?

 

[IOWA]

Yeap, I can see where that can come in handy.

Where you been keeping yourself?

I'm all over the place, where have YOU been xD

 

[Bobeo]

This is the most interesting discussion have read in a while. I wish I had the knowledge in this thread.

 

[ekz13]

I dont' think it's the EVO, but I do think it has something to do with android (in some form or fashion) I switched out of my current phone to try a hero and a day later, BAM, viagra spam to everyone on my gmail list. funny thing is I have two gmails (1 work, 1 personal) it came from the one that was tied to the phone. Happened to a friend of mine with the hero as well. Within hours I switched out to my old device. I'm not sure how or why, but it seems that a majority of android users were hit.

I didn't have any issue just having the gmail account, or using chrome. Could've been a fluke or not, I don't know. I do know that of mine and my friends:

I was rooted, he wasn't
I don't do facebook, he does
I had the unknown checked, he doesn't

basically his was all stock and normal, mine wasn't

 

[RestivoBC]

Just happened to me... sent emails to 9 people (that i know of so far) about me "coming out last night" and how i "hooked up with another man"... f**king great! I wish I got the viagra one.

This really sucks, 2 of those people were police sergeants! Don't know how I'm gonna explain that.

So ... I changed my password, is there something else I should/can do? Please help!

 

[IOWA]

Just happened to me... sent emails to 9 people (that i know of so far) about me "coming out last night" and how i "hooked up with another man"... f**king great! I wish I got the viagra one.

This really sucks, 2 of those people were police sergeants! Don't know how I'm gonna explain that.

So ... I changed my password, is there something else I should/can do? Please help!

Quit visiting shady porn sites.

Don't download free icons.

Don' download fonts.

Don't download e-mail attachments that end with .exe, or .bat

Don't... ah **** it. Just disable admin access on your PC.

 

[htcevolee]

Just happened to me... sent emails to 9 people (that i know of so far) about me "coming out last night" and how i "hooked up with another man"... f**king great! I wish I got the viagra one.

This really sucks, 2 of those people were police sergeants! Don't know how I'm gonna explain that.

So ... I changed my password, is there something else I should/can do? Please help!

Ahhhhhhhhhh that sucks, sorry had to laugh slightly at that one. BUT...dont download apps that are not well reviewed or look fishy or have access to your phone info and such. The program will tell you what it has access to when you install it. I usually only install well known apps that are widely used and well reviewed like Pandora. Dont install non-approved apps by unchecking the box that allows it. Try using AppBrain market as they review alot of the apps closely. Big one is dont download the apps that give you 1000000 backgrounds to choose from.

 

[RestivoBC]

Ahhhhhhhhhh that sucks, sorry had to laugh slightly at that one. BUT...dont download apps that are not well reviewed or look fishy or have access to your phone info and such. The program will tell you what it has access to when you install it. I usually only install well known apps that are widely used and well reviewed like Pandora. Dont install non-approved apps by unchecking the box that allows it. Try using AppBrain market as they review alot of the apps closely. Big one is dont download the apps that give you 1000000 backgrounds to choose from.

Yeah that sucked, haven't downloaded anything shady to my phone or computer. I'm pretty careful about that. Don't know what could've done it.

 

[htcevolee]

Yeah that sucked, haven't downloaded anything shady to my phone or computer. I'm pretty careful about that. Don't know what could've done it.

Could you possibly remember what apps you did install? Maybe we can see if there is one you downloaded maybe others who got compromised downloaded also.

 

[coffeepower]

Im not sure which is more scary: the FACT that android has an email exploit or that the fanboys on this site attack those that report it.

I had the exact same problem with my phone. One day spam came out of the account I had sync'ed with my Aria. Next thing I knew my account password had been changed. After getting everything recovered I decided to do an experiment. I hard reset my phone and created a new gmail account using my phone. I setup bogus contacts and I NEVER USED THE EMAIL ADDRESS ANYWHERE BUT ON THE PHONE. Nothing happened for days. I browsed the web as I normally do, searching craigslist, taking surveys from receipts for coupons, getting directions, googling topics of interest such as how to remove paint from jeans, etc, etc... Within two weeks spam leaked out of the email and I again lost control of it. Please note that I did not browse porn.

I have to now assume that there is an exploit involving Androids sync'ing connection with gmail and possibly the built-in browser. I dont trust Android any more and I plan to get my money back from AT&T if possible. DO NOT SYNC YOUR PHONE WITH GOOGLE UNTIL THE RELEASE AN OS PATCH...

 

[IOWA]

Im not sure which is more scary: the FACT that android has an email exploit or that the fanboys on this site attack those that report it.

I had the exact same problem with my phone. One day spam came out of the account I had sync'ed with my Aria. Next thing I knew my account password had been changed. After getting everything recovered I decided to do an experiment. I hard reset my phone and created a new gmail account using my phone. I setup bogus contacts and I NEVER USED THE EMAIL ADDRESS ANYWHERE BUT ON THE PHONE. Nothing happened for days. I browsed the web as I normally do, searching craigslist, taking surveys from receipts for coupons, getting directions, googling topics of interest such as how to remove paint from jeans, etc, etc... Within two weeks spam leaked out of the email and I again lost control of it. Please note that I did not browse porn.

I have to now assume that there is an exploit involving Androids sync'ing connection with gmail and possibly the built-in browser. I dont trust Android any more and I plan to get my money back from AT&T if possible. DO NOT SYNC YOUR PHONE WITH GOOGLE UNTIL THE RELEASE AN OS PATCH...

Wow, you must be MR. Credibility, you know, with all 1 post and all that.

 

[coffeepower]

Wow, you must be MR. Credibility, you know, with all 1 post and all that.

And my last post after that comment.. I deal with enough jackasses. I'm in the process of returning my Android. This was not the droid I was looking for...

 

[uniquenameEVO]

Im not sure which is more scary: the FACT that android has an email exploit or that the fanboys on this site attack those that report it.

I had the exact same problem with my phone. One day spam came out of the account I had sync'ed with my Aria. Next thing I knew my account password had been changed. After getting everything recovered I decided to do an experiment. I hard reset my phone and created a new gmail account using my phone. I setup bogus contacts and I NEVER USED THE EMAIL ADDRESS ANYWHERE BUT ON THE PHONE. Nothing happened for days. I browsed the web as I normally do, searching craigslist, taking surveys from receipts for coupons, getting directions, googling topics of interest such as how to remove paint from jeans, etc, etc... Within two weeks spam leaked out of the email and I again lost control of it. Please note that I did not browse porn.

I have to now assume that there is an exploit involving Androids sync'ing connection with gmail and possibly the built-in browser. I dont trust Android any more and I plan to get my money back from AT&T if possible. DO NOT SYNC YOUR PHONE WITH GOOGLE UNTIL THE RELEASE AN OS PATCH...

Do that with no apps loaded and I might see a correlation. Other than that, I can only assume something you had on there did it.

 

[coffeepower]

Do that with no apps loaded and I might see a correlation. Other than that, I can only assume something you had on there did it.

Zero apps installed... Like I said, I hard reset the phone. Plus the Aria only lets you install apps from the AT&T website (not that I had any installed). A virus from the Foxconn factory (built into the ROM) is another possibility but probably not as likely as an exploit.

Haven't heard of this exploit on 2.2 yet.. My guess is that Google knows about it and has quietly fixed it. Just a guess.

 

[the mayor]

Just got a HTC EVO.( first off....great forum here....I have learned alot about the phone)
I set up my Yahoo mail using the Yahoo ap.
Within seconds...my account was accessed from Indonesia and spam was sent to my contact list. I have since changed the password...we'll see what happens.
Is there anything that I should look for on the phone ( malware,etc)?
Could the ap be suspect?
Thanks in advance....

 

[IAmSixNine]

Interesting. Were you on an open wifi hotspot?