Brazen hackers assault Gmail, Yahoo and Hotmail

Still unidentified individuals or groups have been perpetrating scams to gain access to e-mail accounts held by government officials on the three major U.S.-based e-mail platforms.

In a report on the official Google blog on Wednesday, Eric Grosse, the engineering director of Google's security team said the campaign ... affected what seem to be the personal Gmail accounts of hundreds of users with the goal being to monitor the contents of these users' emails.

Google said the perpetrators appeared to originate from Jinan, China.

The users affected were described as seemingly senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists.

The campaign to steal passwords and monitor users' emails was disrupted accounts were fortified and authorities alerted, Google said.

Attempts to compromise other services have also taken place, according to reports.

Hotmail and Yahoo! Mail have been targeted in separate attacks displaying significant similarities, according to Nart Villeneuve, a senior threat researcher at computer network security company TrendMicro.

The campaign uncovered by Google involved yet unidentified individuals attempting to collect user passwords by using so-called phishing scams which are characterized by sending e-mails - which appear to be from trusted sources - to trick people into sharing their passwords, or by using passwords obtained by hacking other websites.

Villeneuve said TrendMicro had recently alerted Yahoo! of an attempt to exploit Yahoo! Mail by stealing users' cookies to get access to their e-mail accounts.

While this attempt appeared to fail, it does signify that attackers are attempting to attack Yahoo! Mail users as well, he said.

TrendMicro's Taiwan Threat Solution Team also revealed this week that in one scam for Hotmail users an e-mail message is specifically crafted for a recipient using each user's Hotmail ID in a malicious line of computer code embedded in the e-mail.

Unlike other email-based attacks that require users to open the message and to click an embedded link or to download and execute an attachment, this attack's execution merely requires users to preview the message in their browsers, the Threat solution team reported.

Employees who check their personal email accounts at work who are victimized gives the attacker access to sensitive information that may be related to their company, including contacts and confidential messages, the team said.

Villeneuve points outs some things users can do to prevent being a victim of an attack.

These include checking for spelling and grammatical errors that help indicate the e-mail did not originate from the expected source.

Another tip urges users to take a look at what the links are. While the malicious links may include the words google, yahoo, and Hotmail, a closer look may indicate that the links are not from the website from which they purport to be.