8

I don't know if they are related, or how they could be. But yesterday I received four upvotes at the same time on unrelated questions. Later, around 1 a.m. this morning, my Gmail account that is attached to Stack Exchange was hacked.

Now I've received five upvotes at the same time about two hours ago.

The upvotes in themselves are suspicious, but combined with the access to the Gmail account I wanted to bring it to everyone's attention. I don't know if there's a correlation but the timing seems too coincidental to ignore.

  • I've already changed passwords and enabled 2 part authentication. Should I revoke all the SE sites permissions as well? – Chris Jul 23 '13 at 16:08
  • doesn't seem coincidental to me – Sai Jul 23 '13 at 16:14
  • 3
    I'm not sure where the tie-in is between you getting upvotes and your Gmail account getting hacked? – Jay Riggs Jul 23 '13 at 16:30
  • 3
    2-part authentication is an excellent idea, by the way! – Andrew Barber Jul 23 '13 at 16:39
  • I suspect we have a case of secret admirer / crazy fan (5 upvotes in a matter of 1.5 minutes...) – Old Checkmark Jul 23 '13 at 17:03
  • @JayRiggs My SE account is handled through the Google SSO, same account as the Gmail account. – Chris Jul 23 '13 at 18:56
  • I've just got a bunch of upvotes too. What is going on here? – John Dvorak Jul 23 '13 at 21:30
  • 3
    DEfine "hacked". What did actually happen? – John Dvorak Jul 23 '13 at 21:31
  • @JanDvorak sorry. My gmail got hacked earlier... – Cole Johnson Jul 23 '13 at 23:39
  • @JanDvorak There was an email sent out to all and only the contacts I had in the gmail account. That happened early in the morning, by the time I woke up and saw the email, the account had already been disabled. The latest activity was from India, and Kazakhstan. Luckily I haven't seen any other effects. – Chris Jul 24 '13 at 3:21
9

I can't immediately picture how those events could be linked. I don't see any evidence in our tools that suggests there is any link; I think the person voting for you was perhaps just innocently trying to support you. Those votes will be invalidated, but I don't see any sign of vote fraud there, so it won't reflect badly on you at all.

I also don't see any recent logins, so I think you are OK there as far as anyone taking over your Stack Overflow account. If you have taken steps to protect your Google account, you should be good there.

That said; I'm only replying to help put you at ease real quick. A staff member might look into things and see something I can't, but I wouldn't have posted the above if I was not moderately sure.

As one last bit of possible help, I am going to invalidate your logins. This will force you to have to log in again - and would do the same for anyone who had logged in via your Google account, in case I'm wrong about the above.

| improve this answer | |
  • 5
    Also note that Stack Exchange does not know any Gmail passwords. Plus, how stupid would one be to hack a Gmail account, and leave a trail by using another SE account to upvote one's victim. – Arjan Jul 23 '13 at 16:44
  • Indeed @Arjan; they would more likely just wreak havoc via the 'hacked' account, and not do anything connected to their own. – Andrew Barber Jul 23 '13 at 16:53
  • I agree it doesn't make sense, but two established accounts (had both for years) that are tied to the same username and password, both having odd activity within less than a 24 hour period, with no previous history of any attack or intrusion on either. It'd be foolish to completely rule out a possible connection. – Chris Jul 23 '13 at 19:02
  • @AndrewBarber Thanks though, for the quick reply. – Chris Jul 23 '13 at 20:07
  • 3
    @Chris, "two established accounts [...] that are tied to the same username and password" -- just to be sure, Stack Exchange doesn't know your Gmail password. Stack Exchange only knows that you wanted to authenticate using Gmail, and after you authenticated with Gmail, finds the SE account that is related to that Gmail account. So yes, if your Gmail account is compromised, and people know you're using that for SE, then they can log in as you on SE. But after that they would abuse your account to vote on others; not some other account to vote on you. – Arjan Jul 23 '13 at 21:37
  • 1
    "Moderately sure"... clever ;) – Cole Johnson Jul 23 '13 at 23:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .