Hacker News new | past | comments | ask | show | jobs | submit login

Here's my guess. Google initially detected an attack coming from Chinese IP ranges and subsequently checked what other requests the IPs had made.

This is what led to the accounts that were accessed not "through any security breach at Google, but most likely via phishing scams or malware placed on the users' computers".

Although they mention gmail in the statement, the expansion to other industries is made on the Google Enterprise blog (mainly aimed at promoting Google Apps to large companies), so it seems likely the same Chinese IPs accessed users of Google Apps.

So this isn't the Chinese government targeting other industries so much as dissidents that might work there. Google's statement still seems consistent to me, although they have shied away from mentioning Google Apps.




> and subsequently checked what other requests the IPs had made.

By how?


Gmail stores the last IP that accessed your account - it's shown at the bottom of your inbox:

Last account activity: 14 minutes ago at X.X.X.X

My guess is they used that.


Yes but how do they get the other IP addresses that had been accessed without having that traffic go through Google?


That's the six hundred million dollar question in my mind.

How exactly did Google know that those other institutions were under attack?

Unless the attack resulted in rooted Google machines that then attacked outward, or all those institutions were running on Google Apps.

Major institutions running on Google Apps seems unlikely (Are any major institutions outside of academia running Google Apps hosted by Google?). And attacking outward from a rooted box inside Google's network seems careless, unless the attackers were leveraging some dedicated pathways that made their job easier. Which suggests the breach was far more serious than indicated.


Google's security team eventually managed to gain access to a server that was used to control the hacked systems, and discovered that it was not the only company to be hit.

http://news.ycombinator.com/item?id=1050300


Sorry, I could have made my original comment clearer. I don't think there were any other IP addresses accessed.

The "other industries" that were involved were using Google Apps, so Google has access to those records. That's why they have to inform the other companies their security was breached: the traffic did go through Google so they're the only ones who know about it.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: