Google now uses over 120 signals to thwart account hacks, says it’s cut hijacks by 99.7% since 2011 peak

Google on Tuesday announced it has been developing new techniques to help keep its accounts secure. The company now uses more than 120 signals to try and detect whether a log-in is legitimate, and has thus reduced the number of compromised accounts by 99.7 percent since the peak in 2011.

Hijacked accounts are nothing new, especially when it comes to popular services run by a firm the size of Google. The company’s security team said it saw an increasing of this trend in 2010, largely by spammers tired of dealing with spam filters and eager to make a quick buck with their own messages.

Google threw out two related statistics today: more scams (illegal, fraudulent, or spammy content) come from someone you know today than compared to five years ago. In Gmail, less than 1 percent of spam emails make it into an inbox, and so unwanted messages are more likely to make it through if they come from someone you’ve been in contact with before.

The company also put attacks on its infrastructure into perspective:

Every day, cyber criminals break into websites to steal databases of usernames and passwords—the online “keys” to accounts. They put the databases up for sale on the black market, or use them for their own nefarious purposes. Because many people re-use the same password across different accounts, stolen passwords from one site are often valid on others.

With stolen passwords in hand, attackers attempt to break into accounts across the web and across many different services. We’ve seen a single attacker using stolen passwords to attempt to break into a million different Google accounts every single day, for weeks at a time. A different gang attempted sign-ins at a rate of more than 100 accounts per second.

Google was also targeted by a huge slew of attacks originating from China in January 2010. The Chinese government naturally denied the allegations multiple times, but the hijacking attempts haven’t stopped.

In June 2011, the company revealed that Gmail accounts were being targeted by a series of spear-phishing attacks to hackers from Jinan, China. The Asian country was not pleased with Google’s accusations.

In fact, some Gmail users are still getting prompts from users to this day regarding attempts to hijack their accounts. Last week, The New York Times reported several journalists who cover Myanmar said they had received warnings from Google that their e-mail accounts might have been hacked by “state-sponsored attackers.” Just last night, a Reuters journalist in China tweeted the same:

Here we go again. On my Gmail: “Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer.”

— Sui-Lee Wee 黄瑞黎 (@suilee) February 19, 2013

The timing of Google’s announcement today is thus not surprising. The company has reminded users they can help protect their accounts by using a strong, unique password, 2-step verification, and updating the recovery options with a secondary email address and phone number. “Following these three steps can help prevent your account from being hijacked—this means less spam for your friends and contacts, and improved security and privacy for you,” Google said.

Image credit: Robert Linder