How to Recover a Hacked Gmail Account

Recently a client called and left a pan­icked voice­mail telling me some­one in South Africa was send­ing email from their Gmail account and ask­ing for $2000 cash from all their friends. I told them it sounded like their Gmail account was cracked and we needed to move quickly. It was and we did.

Here’s what we did:

1. Imme­di­ately went to every other online account they had (includ­ing bank, Face­book, Twit­ter, Com­cast, etc.), logged in and changed the email address on the account to some­thing other than the Gmail one and updated the weak pass­word to a stun­ningly secure one. (Impor­tant: If you don’t change the email address, they will just keep reset­ting the password.)
2. Reviewed the his­tory of the gmail account on the local com­puter (searched archived email) and (luck­ily) found the orig­i­nal wel­come mes­sage from the Gmail team. (This is one email you will want to hang onto for­ever! I’ll tell you why in a sec.)
3. Filled out the form accessed from the main Gmail page by click­ing the “Can’t access your account” link. (Image 1)
4. Entered the Gmail Ver­i­fi­ca­tion Code (Image 4) that was orig­i­nally sent in the wel­come mes­sage when the account was cre­ated. (If you have this, you are pretty likely to get your account back fairly easily. Unfortunately, most of us (me!) prob­a­bly deleted that since we already knew how to use Gmail and didn’t need some silly wel­come mes­sage. Doh!)
5. Entered the 5 peo­ple they emailed frequently
6. Entered the date that they first con­nected their Droid cell phone account to the Gmail account.
7. In about 24 hours we received notice that the account was back under our control.
8. Once account access was recov­ered, we enabled account recov­ery via SMS on the Google account. This last step is crit­i­cal (espe­cially if you no longer have your wel­come mes­sage) and will ensure that, should your account ever be com­pro­mised again, it will be far eas­ier to recover it.
9. Also checked to see if any for­warders had been set up to for­ward a copy of incom­ing email back to the attacker.

Below are the screen­shots indi­cat­ing the sequence required to get to the account recov­ery form:

Image 1?

Image 2

Image 3

Image 4

How did it happen?

The thief got in because my client did what 9 out of 10 of us are guilty of doing— they cre­ated a weak pass­word. It was a 7-character dic­tio­nary word and all lower case. Not good!

But here’s the scarier impli­ca­tion of this story. (Luck­ily the fol­low­ing did NOT hap­pen, but it could have had we not moved as quickly as we did to secure things.)

You think it’s just a dan­ger that one of your friends might fall for the plea to send money to some­one in South Africa, but it’s far worse than that. In this case, the Gmail account was the email address used for all busi­ness accounts includ­ing bank­ing and Face­book among many others.

So, in the­ory, once the attacker got in, it would be a sim­ple mat­ter to go to each of the sites man­aged with the hijacked Gmail account (review­ing the received email would clue them in to what’s avail­able), click the “for­got pass­word” but­ton and reset all your logins for all your accounts, thus lock­ing you out and effec­tively tak­ing con­trol of your busi­ness. Ouch!

Think about this for a sec­ond. Imag­ine, in a worst-case sce­nario, they got into your bank account and decided to make a pay­ment with online bill pay­ments with them­selves as the recipient.

You think your pass­word is good, but it isn’t

So here’s the deal. If you think using pass­words like, “password1”, or “abc123”, are OK, then you will likely be hacked very shortly if you haven’t been already. And the length of your pass­word does NOT guar­an­tee its effec­tive­ness if you repeat characters!

For instance, in a recent data breach study where mil­lions of pass­words were inad­ver­tently revealed, research firm Imperva dis­cov­ered that nearly 300,000 cracked pass­words were sim­ply ‘123456’.

A sep­a­rate weak pass­word breach study revealed that someone’s account pro­tected by the 30-character pass­word, ‘lafarol­er­a­t­rope­zoooooooooooooo’ was also eas­ily cracked. The repeated ‘o’ was basi­cally a point­less exer­cise in cre­at­ing a false sense of security.

Steps you MUST take to pro­tect your Gmail account

1. Add a sec­ondary non-Gmail address to your cur­rent Gmail account (if you haven’t already).
2. Keep your Gmail wel­come mes­sage! (But don’t worry if you already deleted it like I did. Just make sure and do step 4!)
3. Cre­ate a very secure pass­word for your gmail account, prefer­ably at least 14 char­ac­ters long, with upper and lower case let­ters, sym­bols and no repeated characters.
4. Enable account recov­ery via SMS so you can ensure an eas­ier time of recov­er­ing your account via a text to your cell phone.
5. Review your Gmail account and note all your cat­e­gories, the 5 peo­ple you email most often and make a list of all the Google prod­ucts you use and the date you started using them (month, day, year). All this will be extremely use­ful if you need to recover your account. It will be even more crit­i­cal if you deleted your wel­come mes­sage and no longer have your ver­i­fi­ca­tion code.

So that’s it. Let me know if I missed any­thing, or if you have ques­tions, and be safe!

SMS2E8MGNBPD