keylogger in media file?
 

my friend seems to have had his gmail account hacked. he couldn't log in (until he got help from a friend at google to reset). he's positive he hasn't changed his password or told any person ever.

I'm slightly tech savvy. I told him that as I see it either he was key-logged, or he got hacked. his password was pretty weak but not quite trivial: the name of a country plus two digits on the end. being hacked seems unlikely because I assume that google would protect against thousands of log in attempts, and why would someone bother hacking a gmail account?

so I figure he must have gotten key logged. but he (being very tech shy) says the only things he has downloaded since he got his new computer are itunes, firefox (and extensions on the site), and a few media files (music and image and video, some of it undoubtedly porn).

my question is if he only downloaded (suspect) media, could a key logger be in there?

Re: keylogger in media file?
 

No. But he could have had a keylogger installed on any number of sites, or thru a backdoor trojan he got on one of those adult sites.

If he's as tech shy as you say, he very well could have been phished. Why someone would want his gmail account is beyond me.

Also, though I'm sure bringing it up wouldn't necessarily get a truthful or dishonest answer, it's possible he could have had his password written down somewhere near his pc at work or home. People who choose weak passwords also tend to not take the greatest care of keeping them private. I would certainly but the name of a country plus two digits (while probably long when added up) in the list of weak passwords.

Doesn't seem like much, but Brazil26 is insanely weak compared to BraZ#2 6iL.

Re: keylogger in media file?
 

All it takes is clicking on the wrong link with vulnerable software...

Re: keylogger in media file?
 

If anyone feels they may not be as paranoid as they should be or need reminders on just how dangerous the internet is, here is a small collection of security-related lists/feeds to check out:

https://lists.grok.org.uk/mailman/li...ull-disclosure
http://sunbeltblog.blogspot.com/
http://www.schneier.com/blog/
http://blogs.technet.com/antimalware/default.aspx
http://www.f-secure.com/weblog/
http://taosecurity.blogspot.com/
http://www.avertlabs.com/research/blog
http://blogs.technet.com/markrussinovich/default.aspx
http://blogs.technet.com/msrc/default.aspx
http://technobabylon.typepad.com/tb/
http://isc.sans.org/
http://www.securityfocus.com/
http://www.computerdefense.org/?feed=rss2
http://portal.spidynamics.com/blogs/msutton/rss.aspx
http://ha.ckers.org/blog/feed/
http://blogs.securiteam.com/index.php/feed/
http://www.milw0rm.com/rss.php
http://www.infosecnews.org/
http://www.cgisecurity.com/index.rss
http://www.secgeeks.infys.net/security_rss_feeds
http://www.bloglines.com/public/TaoSecurity
http://www.computerdefense.org/?feed=rss2

Re: keylogger in media file?
 

Either way, it seems like it'd still be important for him to make sure his computer is clean. Has he run a spyware/adware program as well as a virus scanner to check for problems? Also, if he used the same password for other things, he should really consider changing those passwords, too. (The battle might not be over yet.)

Re: keylogger in media file?
 

thanks for the input. I forgot about the whole scripts thing (again, I'm minimally tech competent, so I don't much know how it works but I do remember just going to hacker site and having that set off my anti-virus like crazy). also, he may have logged in from another computer that had a key logger. and as has been said, there are lots of ways he could have compromised his password.

I'm not someone who has much chance of figuring out what happened to him, but I hope he finds someone who does so I can learn from it. So far his gmail password got changed. He got in through a google person and his inbox was deleted but not sent messages and no new sent messages. I told him to email everyone to ask if they got messages. then he found that he was locked out of ebay. but he's not locked out of paypal or wellsfargo or schwab. he had the same (weak) password for most if not all of them. so I'm surprised they only got such low value stuff--no cash.

I told him to change all passwords and if he can't figure out a pwd generator, to type randomly on a page for a dozen or two lines and copy and paste 8 characters as his pwd without typing that. curious to see if anything else develops.