Yikes…. ain’t that a scary thought?

My sister called me around 10ish on friday morning. She was nervous because gmail.com was allegedly “hacked”. She was in some comp. lab @ CSUEB

She told me that it says gmail.com is up for sale (like one of those parked domains etc.) I thought I knew what exactly was wrong and I told her the most obvious thing… check the address bar you might have a typo in the url. She re-checked it and confirmed it. I was bit surprised and refreshed my gmail window (CTRL+R and not the inbuilt refresh) and gmail wasn’t hacked for me…

I thought it might be some kind of mental block where she can’t spot the wrong spelling etc (happens to me sometimes.) To prove my theory, I asked her to goto google.com (which wasn’t hacked for her) and then type gmail and then click the link. This would make sure there is no typo. She did it and still landed on the same page. This shocked me, because my sister is not computer illiterate and what she is saying might be true. But I was still wondering how come gmail.com is “unhacked” for me? She tried to access gmail.com using the adjacent computer and had the same result.

She had to leave, so I asked her to take a screenshot of the so called “hacked” gmail and mail me using her Y! mail. I got the jpg screenshot in my gmail after a couple of minutes and was shocked to see she was right. Here is the screenshot

I still don’t know what happened, but I think I can make out what this is. I think it is some kind of Spyware which plays around the windows dns resolver and somehow hardcodes mapping b/w some ip address with the domain name gmail.com. I might be wrong, but that is the best I can think of.

I think this kind of spyware can be seriously dangerous, what if the “domain for sale” was replaced by a clone of gmail’s login page? Or even worse bankofamerica.com is infected by this and is forwarded to a clone of the original web site?

I’d love to know more about this so called spyware or is it something else. Did somebody else also noticed this kind of behavior somewhere else? I googled about it, but couldn’t find anything.

If you enjoyed this post, make sure you subscribe to my RSS feed!