I guess I can disclose this now...
I got a Google warning of my gmail being access from the Jinan province back in January with also a break-in of twitter account. Since my security changes no break-ins.
Despite China's denials the threat is real.
I got a Google warning of my gmail being access from the Jinan province back in January with also a break-in of twitter account. Since my security changes no break-ins.
Despite China's denials the threat is real.
Why did google choose to publicise the event at all? surely that only tells the attackers to find a new attack vector (rather than thinking there existing vector is still okay).
The attacks relied on the victim's naivety and lack of knowledge. If you read the blog post [1], I think it's pretty clear that the purpose was to educate users on how to improve their security when using Google products.
[1] http://googleblog.blogspot.com/2011/06/ensuring-your-informa...
The usual practice is to warn of potential issues, not publicise a specific attack, and then say "beware!" -- In fact the article didn't even give the common advice of 'check url, https, etc' to avoid phishing.
More relevant, it's one of the three largest military centers in China, which I'm guessing is why the attacks stem from there. This does lend credence to the idea of a government sanctioned operation.
However, Jinan is also the home to one of the top computer science schools and software engineering colleges in China, so it could be just student hackers I guess (though I'm not convinced).