Is there a way to know if my email is on list of breached?
Right in the article: https://gooligan.checkpoint.com.
More Than 1M Google Accounts Breached by Gooligan
61–70 of 183 posts
Re: More Than 1M Google Accounts Breached by Gooligan
#62Is there a way to know if my email is on list of breached?
Have you installed any of the apps listed in the "Appendix A"?
Re: More Than 1M Google Accounts Breached by Gooligan
#63Earlier quoted context omitted.
Yes. It never occurred to me to connect my portable devices to any accounts that mattered. Who does that?
It never occured to me that anything sent or received from a gmail account was private.
It's not. In fact, Google has the right to publish your private emails if it's for promotional purposes. The worldwide unrevokable license they grant themselves to everything you store on their service has no requirement that they don't publicize private information. Check their Terms of Service.
Re: More Than 1M Google Accounts Breached by Gooligan
#64Earlier quoted context omitted.
I don't use a Google account on my android phone. Cyanogenmod sans google anything.
No gmail, gmaps, gphotos ? do you have replacements ? pse: thanks all AP a lot for suggestions :)
K9Mail with Fastmail, AddressToGPS + OSMAnd, I back up my own photos with a home server and some rsync (Syncopoli). There is PhotoBackup which is kind of neat though.
We use Google Calendar for stuff at work, Google still has an old psuedo-deprecated-not-talked-about CalDav endpoint I hit with DavDroid that gives me all of that. These problems were solved with protocols long before gardens. I use offlineCalendar(Yes you need an app for that in Android) to create a calendar for myself locally, though I have a radiCAL server for things I need sync'd. Could have used Fastmail I guess.
Re: More Than 1M Google Accounts Breached by Gooligan
#65[deleted]
Re: More Than 1M Google Accounts Breached by Gooligan
#66> While Google implemented multiple mechanisms, like two-factor-authentication, to prevent hackers from compromising Google accounts, a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in. What's the right fix here? Should auth tokens be ip-address-tied? How much will that break? Or would that not even fix it?
Token binding would solve this by binding OAuth tokens to TLS connections, so they can't be used even if stolen: https://tools.ietf.org/html/draft-jones-oauth-token-binding-...
Would this mean that the token is only good for the duration of the connection though? Most apps on mobile hold tokens that ~never expire (iirc I've never had to re-auth the Gmail app.)
Re: More Than 1M Google Accounts Breached by Gooligan
#67Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/
>Malware on your Android device picked up from third party app stores They say that, but then Google's G+ post[1] says "These apps are most often downloaded outside of Google Play" You could read "most often" as "some of these were downloaded from Google Play". Either way, they are exploiting known vulnerabilities. The big issue to me is that phone manufacturers / carriers, by choice, stop patching phones whenever th…
If you read further down in the G+ post it says:
- Removing apps from Play: We’ve removed apps associated with the Ghost Push family from Google Play. We also removed apps that benefited from installs delivered by Ghost Push to reduce the incentive for this type of abuse in the future. Downloading apps from Google Play, rather than from unknown sources [https://goo.gl/9rqdiH], is a good practice and will help reduce the threat of installing one of these malicious apps in the future.
Re: More Than 1M Google Accounts Breached by Gooligan
#68Earlier quoted context omitted.
I don't use a Google account on my android phone. Cyanogenmod sans google anything.
No gmail, gmaps, gphotos ? do you have replacements ? pse: thanks all AP a lot for suggestions :)
BlueMail is fine for mail, Scout is good for driving directions (and uses OSM data).
I don't know gphotos and I don't really watch or show my photos on my phone.
Re: More Than 1M Google Accounts Breached by Gooligan
#69Malware on your Android device picked up from third party app stores (FDroid? Amazon?) that steals email accounts and auth tokens. Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. You can see if your account has been affected here: https://gooligan.checkpoint.com/
Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1…
In a similar vain a Google employee has a very obvious incentive to downplay this campaign.
Re: More Than 1M Google Accounts Breached by Gooligan
#70Earlier quoted context omitted.
I am using "Here WeGo" https://here.com/ (originally developed by Nokia), quite a good alternative to Google Maps. It does not need any Google services installed. Downloaded it directly from the Google Play store with Raccoon.
Hmm, that Raccoon thing seems ok but using something like that would be a bit of a sideways move for me. I'd rather move toward 100% libre software and not rely on proprietary software I'll need to hack around to maintain privacy.
Then I would suggest Neo900 https://neo900.org/ . Good presentation about the concept: https://neo900.org/stuff/cccamp15/ccc2015talk/talk.pdf