I upgraded to iOS 4.2 last night and this evening I got a system popup that my gmail contacts password was incorrect. Well, okay, maybe something got mixed up in the upgrade. I remember Photoshop's license key was so sensitive, that if I moved my disk image to a new disk, it would protest. So, okay. I re-entered my password.
And then I checked my email. To my horror, I had a huge number of out-of-office replies from people on my contacts list. They had been spammed by me.
That password was obviously dead to me, but it's not clear that it was compromised. I went to my laptop to see what else might be going on. Well, I have to log in somewhere if I'm going to change my password, so I logged in. And got a lovely notice from google:
Warning: We believe your account was recently accessed from: China (ny.adsl:115.49.32.130) Show details and preferences | ignore.
Interestingly, the flavor of the spam was similar to something I got from my father-in-law a few weeks ago from his yahoo account. I wonder if Yahoo and others are simply less forthcoming?
One other observation: none of the sent spam is in my sent items, but Google has temporarily suspended my account from sending. Could someone be spoofing Google and the Gmail team can only identify accounts by the out-of-office and bounce replies they get back?
----
Update: a friend was able to send me the original spam. Here's an anonymized pastebin: http://pastebin.com/L92pY631
And then I checked my email. To my horror, I had a huge number of out-of-office replies from people on my contacts list. They had been spammed by me.
That password was obviously dead to me, but it's not clear that it was compromised. I went to my laptop to see what else might be going on. Well, I have to log in somewhere if I'm going to change my password, so I logged in. And got a lovely notice from google:
Warning: We believe your account was recently accessed from: China (ny.adsl:115.49.32.130) Show details and preferences | ignore.
Interestingly, the flavor of the spam was similar to something I got from my father-in-law a few weeks ago from his yahoo account. I wonder if Yahoo and others are simply less forthcoming?
One other observation: none of the sent spam is in my sent items, but Google has temporarily suspended my account from sending. Could someone be spoofing Google and the Gmail team can only identify accounts by the out-of-office and bounce replies they get back?
----
Update: a friend was able to send me the original spam. Here's an anonymized pastebin: http://pastebin.com/L92pY631