China rejects Gmail spying claims

Google's logo Google said the cyber-spying campaign targeted Gmail accounts of US officials and journalists

Related Stories

China has rejected allegations of involvement in a cyber-spying campaign targeting the Google e-mail accounts of top US officials, military personnel and journalists.

A foreign ministry spokesman said it was "unacceptable" to blame China.

Google has not blamed the Chinese government directly, but says the hacking campaign originated in Jinan.

The US company said its security was not breached but indicated individuals' passwords were obtained through fraud.

Google said Chinese political activists and officials in other Asian countries were also targeted from the Shandong city, which is 400 km (250 miles) south of Beijing.

The White House said it was investigating the reports but did not believe official US government e-mail accounts had been breached.

Safety tips

It is extremely difficult for analysts to determine whether governments or individuals are responsible for such attacks, says the BBC's Adam Brookes in Washington.

But the fact that the victims were people with access to sensitive - even secret - information raises the possibility that this was cyber-espionage rather than cyber-crime, adds our correspondent.

Analysis

Security experts say they are seeing an increase in these so-called spear phishing incidents in which attackers go after specific information or assets and aim at "high value individuals".

One consultant described it as an "epidemic", while another said such attacks are all too easy to perpetrate given the amount of information that lives on the internet about people - from their Twitter stream to their Facebook pages to sites that trace your family tree.

A smart attacker can assemble enough information to "influence and convince" a target that they are receiving a genuine email from someone they know.

However, Chinese foreign ministry spokesman Hong Lei told a news briefing: "Blaming these misdeeds on China is unacceptable.

"Hacking is an international problem and China is also a victim. The claims of so-called support for hacking are completely unfounded and have ulterior motives."

On Wednesday, Google said it had "detected and has disrupted" a campaign to take users' passwords and monitor their emails.

"We have notified victims and secured their accounts," said the company. "In addition, we have notified relevant government authorities."

The e-mail scam uses a practice known as "spear phishing" in which specific e-mail users are tricked into divulging their login credentials to a web page that resembles Google's Gmail web service (or which appears related to the target's work) but is in fact run by hackers.

Having obtained the user's e-mail login and password, the hackers then tell Gmail's service to forward incoming e-mail to another account set up by the hacker.

In an advisory message released on Wednesday, Google recommends several steps for users to take to improve the security of Google products:

  1. Enable two-step verification, such as using a mobile phone to which Google sends a second password to enter on sign-in
  2. Use a strong password (mix of letters and numbers, avoiding family names, birth dates etc) for Google that you do not use elsewhere. Here's a video to help.
  3. Enter your password only into a proper sign-in prompt on a https://www.google.com domain.
  4. Check your Gmail settings for suspicious forwarding addresses or delegated accounts

More on This Story

Related Stories

The BBC is not responsible for the content of external Internet sites

More Asia-Pacific stories

RSS

Features & Analysis

Elsewhere on the BBC

  • UnderwaterHidden depths

    How do you explore the bottom of the ocean? BBC Future finds out

Programmes

  • The challenge is to drop a bottle of water within 100 metres of this dummyClick Watch

    The race to get water – transported by drone – to a man stuck in remote Australia

BBC © 2014 The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.