Trojan steals Gmail passwords – and charges for it

David M Williams
Wednesday, 12 March 2008 17:19

Opinion and Analysis

The Gmail inbox held no less than 1,777 G-Archiver generated e-mails all containing the username and password for many unsuspecting victims: the username and password which totally breaks open a user's personal mailbox. The very same username and password that gives access to a plethora of Gmail domain hosting or Ad-Sense accounts, or webmaster tools or more. Ever the crusader and whether rightly or wrongly, Brooks deleted all these messages.

There are enormous ramifications and concerns and lessons to be had coming out of this story. The immediate reaction you might expect is pure horror that this could happen. These days, no matter how many anti-spam or anti-virus or anti-spyware tools we use, no matter how many times Windows User Account Control asks "Are you sure?", no matter how tech-savvy we are, it seems that anyone can still be unwary when running a seemingly legitimate and useful app.

Once you've got over the horror that this happened, the next thought is how often does this occur? Indeed, the very producer of G-Archiver – MateMediaSoft – have several other items in their portfolio. From their web site FriendTools purports to be a great MySpace bot which will add friends, make mailouts and comments and perform other tasks to build up your network. Similarly, TubeAdder will automate the process of adding comments and making friends on YouTube.

Both MySpace and YouTube are immensely popular. Perhaps there is a niche market out there for people who want some automated program to bulk-add so-called friends into your own personal Web 2.0 networks. However, can you trust these programs? Undoubtedly they will require your MySpace and YouTube login credentials to perform their tasks. Do they similarly send your details off to an unknown third party without your knowledge?

To add insult to injury these two apps cost $US 29.95 just like G-Archiver. Imagine paying to have someone potentially steal your online identity? Of course, I don't mean to imply these programs do indeed do such a thing – but the point is how can you be confident they do not?
Similarly, this incident has surely soured the public perception of such well-known tools as Plaxo or Trillian, or sites like Bebo – all of which request your logins for Hotmail, Yahoo, Gmail, AIM and others.

I recall myself blindly trusting online tools that claimed to check which of my MSN Messenger contacts had blocked me or added me. This used web services and logged into MSN with my identity. Happily, nothing untoward happened, and I am sure the service was genuine – but it illustrates just how blasé we may be becoming to protecting our online identity when presented with tools that state they perform a useful and desirable function, no matter our level of experience.

Let's actually think about the utility anyhow. G-Archiver wax lyrical as to why you should backup your data. "What if the servers at Google are down and you can not access your Gmail account temporarily due to technical problems?" they say. Alternatively, maybe you wish to just keep only the absolutely important e-mails in your Gmail account – in this case, G-Archiver claim, it makes sense to backup your e-mail, delete everything you don't think is important, but have the peace of mind that you can refer to your backup anytime you want. Or again, perhaps Gmail will lose your data due to server fault. Using G-Archiver, they claim, you can rest assured you won't lose anything.

Please read on.

CONTINUED