US secrets on the line! Chinese hackers target Gmail

In a phishing attack, hackers based in China broke into hundreds of Gmail accounts, including those belonging to senior US government officials and military personnel, Internet search giant Google has said.

"Through the strength of our cloud-based security and abuse detection systems, we recently uncovered a campaign to collect user passwords, likely through phishing," Google said in a posting on Wednesday.

The Internet giant said it has uncovered a "phishing campaign," which "appears to originate from Jinan, China" in which access was gained to Gmail user passwords and emails, Google security team's engineering director Eric Grosse said in a blog post.

The "bad actors" hacked into personal Gmail accounts of hundreds of users including, senior US government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists, Grosse added.

"The goal of this effort seems to have been to monitor the contents of these users' emails, with the perpetrators apparently using stolen passwords to change peoples' forwarding and delegation settings."

The Washington Post reported that the personal Gmail account of one Cabinet-level official was compromised.

However, Caitlin Hayden, spokeswoman for the National Security Council, said there is no reason to believe that any official US government email accounts were accessed.

Grosse said the goal of this effort seems to have been to monitor the contents of these users' emails, with the perpetrators apparently using stolen passwords to change peoples' forwarding and delegation settings.

Google detected and has disrupted this campaign to take users' passwords and monitor their emails.

"We have notified victims and secured their accounts. In addition, we have notified relevant government authorities," he wrote.

In Washington, officials of the Federal Bureau of Investigations and Department of Homeland Security were working with Google on this issue.

Pentagon spokesman, Col Dave Lapan said at this point he is not aware if the targeted individuals are employees of the Department of Defence.

Google said bad actors take advantage of the fact that most people are not tech savvy - hijacking accounts by using malware and phishing scams that trick users into sharing their passwords, or by using passwords obtained by hacking other websites.

Through its cloud-based security and abuse detection systems, Google detected and has disrupted the phishing attack, notifying victims and securing their accounts.

Google further added that these account hijackings were not the result of a security problem with Gmail itself.

It urged its users to enable a two-step verification, under which Gmail uses a phone and second password on sign-in.

Google also listed a slew of measures that users can take to secure their email accounts.

Google has more than 200 million users for its free, Web-based Gmail email service, Last year, Google had blamed China for cyber attacks on its computer systems that partly targetted Gmail user accounts of Chinese human rights activists and some Silicon Valley-based companies.