Important Google Warning

[Lewis]

Google Issues New Warning for State-Sponsored Attacks

Starting Tuesday, look out for an unusual warning atop your Gmail inbox, Google home page or Chrome browser. It will not mince words: “Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer.â€
Google said it planned to issue the warning anytime it picks up malicious–possibly state-sponsored–activity on a user’s account or computer. How does Google know whether an attack is state-sponsored? It won’t say.
“We can’t go into the details without giving away information that would be helpful to these bad actors, but our detailed analysis—as well as victim reports—strongly suggest the involvement of states or groups that are state-sponsored,†Eric Grosse, Google’s vice president of security engineering, wrote in a blog post.
The announcement is timed just one week after security researchers discovered Flame, a massive, data-mining virus, had been spying on computers in the Middle East– predominantly in Iran– for at least the last four years.
Researchers say they believe the Flame virus is sponsored by the same entity that commissioned Stuxnet, a virus co-sponsored by the United States and Israel, that destroyed thousands of Iranian centrifuges in 2010.

 

[DarkHorseRising]

It's times like this I love the fact that I have a Mac running Linux.

 

[tim-from-pa]

Ubuntu 12.04LTS user here, too. I don't worry about Flame with Linux.

But I'm confused about the OP. Is Google putting the warning notice there when they believe the government is spying or are the "state sponsored attacks" from other-government hackers? (I think they mean the latter)

 

[felix]

It is easy to identify from where the attacks came from esp using the IP used to attack. A govt will not and cannot use home computers to initiate an attack. They do it from their computer system or using special non isp provider which are easy to identify. This is because, if govt does such attacks using normal home computers or standard ISPs, they are easy to identify by ISP and will come in headlines and police will be investigating those govt officials and it is hard to cover up the mess which will be created by media.

The ISP usually gives you a hostname (a name for the IP) which is suffixed. The IP also helps to identify the location of the system. The ISP will also know to which account and at what time the IP is issued. Google knows the IP range for different service providers and the location based ip addresses (this is not a rocket science as geo-ip services are already available and can be used by anyone). Assume, when an attack happens using a particular IP e.g, 10.0.0.67 and Google already has logs of IP and one IP say, 10.0.0.39 is used to browse Google servers and it resolves back to something like xyz.defence.gov, then, the attack is obviously from the same computer network. There are also other techniques having it's vast knowledge of IP addresses used to Google search - because, being any reputable govt organization, it cannot hide itself to attack and do dirty tricks esp, on internet without leaving a trace esp, from Google's glasses.