Hacker has access to email despite password change - how?
Discussion
My builder has had his email (MS live.co.uk aka outlook.com) hacked via an email attachment he clicked on and the hacker is sending out false invoices with, surprise surprise, new bank account details. This has been detected and no money lost. Notified the destination bank (Cashplus) fraud department and reported to Action Fraud (no real expectaction of action from either).
The hacker created some rules so that emails from people who received fake invoices were sent to a very old subfolder and marked as read. They then sat and monitored this subfolder for replies to perpetuate the scam while the real owner carried on using the email account. They delete the emails from this subfolder as they go, thereby removing most of the traces of their activity.
I've helped him to identify the rules, notify recipients and we've used the admin features to disconnected all the devices that can access the account (looks like the hackers are using ActiveSync to access the folders). The password to the account has been changed (twice) on a device that wasn't originally compromised.
What I don't understand is how the hacker is STILL able to see and send out emails from this account. They are definitely real emails, not spoofed, as I've checked all the headers. Somehow, despite changing the password, they still have access. I can't see how they can know the new password, so how are they able to use the account remotely? The compromised machine is turned off so it can't be by some kind of remote control.
Any ideas anyone?
The hacker created some rules so that emails from people who received fake invoices were sent to a very old subfolder and marked as read. They then sat and monitored this subfolder for replies to perpetuate the scam while the real owner carried on using the email account. They delete the emails from this subfolder as they go, thereby removing most of the traces of their activity.
I've helped him to identify the rules, notify recipients and we've used the admin features to disconnected all the devices that can access the account (looks like the hackers are using ActiveSync to access the folders). The password to the account has been changed (twice) on a device that wasn't originally compromised.
What I don't understand is how the hacker is STILL able to see and send out emails from this account. They are definitely real emails, not spoofed, as I've checked all the headers. Somehow, despite changing the password, they still have access. I can't see how they can know the new password, so how are they able to use the account remotely? The compromised machine is turned off so it can't be by some kind of remote control.
Any ideas anyone?
PhilboSE said:
My builder has had his email (MS live.co.uk aka outlook.com) hacked via an email attachment he clicked on and the hacker is sending out false invoices with, surprise surprise, new bank account details. This has been detected and no money lost. Notified the destination bank (Cashplus) fraud department and reported to Action Fraud (no real expectaction of action from either).
The hacker created some rules so that emails from people who received fake invoices were sent to a very old subfolder and marked as read. They then sat and monitored this subfolder for replies to perpetuate the scam while the real owner carried on using the email account. They delete the emails from this subfolder as they go, thereby removing most of the traces of their activity.
I've helped him to identify the rules, notify recipients and we've used the admin features to disconnected all the devices that can access the account (looks like the hackers are using ActiveSync to access the folders). The password to the account has been changed (twice) on a device that wasn't originally compromised.
What I don't understand is how the hacker is STILL able to see and send out emails from this account. They are definitely real emails, not spoofed, as I've checked all the headers. Somehow, despite changing the password, they still have access. I can't see how they can know the new password, so how are they able to use the account remotely? The compromised machine is turned off so it can't be by some kind of remote control.
Any ideas anyone?
if he ran an attachment the machine is probably compromised. assume that if there are any other laptops or desktops on the same network, that they are also compromised. The hacker created some rules so that emails from people who received fake invoices were sent to a very old subfolder and marked as read. They then sat and monitored this subfolder for replies to perpetuate the scam while the real owner carried on using the email account. They delete the emails from this subfolder as they go, thereby removing most of the traces of their activity.
I've helped him to identify the rules, notify recipients and we've used the admin features to disconnected all the devices that can access the account (looks like the hackers are using ActiveSync to access the folders). The password to the account has been changed (twice) on a device that wasn't originally compromised.
What I don't understand is how the hacker is STILL able to see and send out emails from this account. They are definitely real emails, not spoofed, as I've checked all the headers. Somehow, despite changing the password, they still have access. I can't see how they can know the new password, so how are they able to use the account remotely? The compromised machine is turned off so it can't be by some kind of remote control.
Any ideas anyone?
unplug the pc and laptop from the network and switch it off.
download a root kit scanner and a full AV suite to a usb key from a known good source to a machine that has no previous connection to the network.
rootkit scan it first by booting onto the usb then one the scan has completed, boot into windows and install the AV scanner. Do a full scan and then rinse repeat for all the other PCs.
separately, from a known good device, enabled two factor authentication on the email account to a mobile phone, google for instructions.
https://support.microsoft.com/en-gb/help/12408/mic...
Always a good idea anyway. Might be worth having a look to see if they granted app permissions : https://www.google.com/amp/s/www.winhelponline.com...
Always a good idea anyway. Might be worth having a look to see if they granted app permissions : https://www.google.com/amp/s/www.winhelponline.com...
Carl_Manchester said:
if he ran an attachment the machine is probably compromised. assume that if there are any other laptops or desktops on the same network, that they are also compromised.
unplug the pc and laptop from the network and switch it off.
download a root kit scanner and a full AV suite to a usb key from a known good source to a machine that has no previous connection to the network.
rootkit scan it first by booting onto the usb then one the scan has completed, boot into windows and install the AV scanner. Do a full scan and then rinse repeat for all the other PCs.
separately, from a known good device, enabled two factor authentication on the email account to a mobile phone, google for instructions.
Agree with all that and already done apart from the rootkit scanning - told builder that the machine is toast until a complete reinstall of Windows is done. His Avast AV didn't detect anything but I told him to run a full scan using Windows Defender which found a bunch of nasties including bitcoin miners and potential ransomware. They also injected a whole bunch of browser extensions. Anyway that machine is not being turned on again. It was a standalone device so hopefully things like another laptop he had at home (compromised machine was at the office) are OK to use.unplug the pc and laptop from the network and switch it off.
download a root kit scanner and a full AV suite to a usb key from a known good source to a machine that has no previous connection to the network.
rootkit scan it first by booting onto the usb then one the scan has completed, boot into windows and install the AV scanner. Do a full scan and then rinse repeat for all the other PCs.
separately, from a known good device, enabled two factor authentication on the email account to a mobile phone, google for instructions.
I did tell him to enable 2FA on the account, will check tomorrow.
The_Jackal said:
I would consider setting up a fresh email and doing business from that.
That is a fairly enthusiastic hacker.
You may have to even consider it is a personal enemy or disgruntled employee or client.
He risks losing a lot of repeat business if he just abandons the address, but it is a possibility.That is a fairly enthusiastic hacker.
You may have to even consider it is a personal enemy or disgruntled employee or client.
Ethusiastic hacker - they are definitely motivated. The original phishing email carried a payload which installed a whole bunch of things - rather too many as it happens as the bitcoin miner impacted the machine performance in a fairly noticeable way. To a degree they would have been better off keeping it clean and operating under the radar a bit more.
But I would classify it as "industrial" hacking - definitely with an objective of fraud. They went though his email history to identify the 2 jobs he has on the go at the moment where customers might be expecting invoices. Not a scattergun approach at all. It shows a level of sophistication and targetting that means it's all about the money, not a vendetta.
randlemarcus said:
https://support.microsoft.com/en-gb/help/12408/mic...
Always a good idea anyway. Might be worth having a look to see if they granted app permissions : https://www.google.com/amp/s/www.winhelponline.com...
Thanks for the second link, will get him to check that tomorrow.Always a good idea anyway. Might be worth having a look to see if they granted app permissions : https://www.google.com/amp/s/www.winhelponline.com...
It's still a mystery to me how they can have access though even with the password being changed. I would have thought that even an app that has been granted access would still need the correct credentials.
Activesync always used to have a delay between password changes on MS platforms. Not sure if that's still the case but it sounds like it might be. Outlook.com does have a section in the webmail settings where you see mobile (activesync) devices. You would think a rogue device would be visible in that section.
The viruses and other nasties on the PC could be a red herring, it may just be a phishing email that caused it.
The viruses and other nasties on the PC could be a red herring, it may just be a phishing email that caused it.
Thanks - the suggestion that Activesync can maintain a connection for a period of time after a password change is exactly the sort of indication I was looking for to explain the evidence. Seems crazy in this day and age, but that is MS for you.
The hackers are definitely using Activesync to access the emails - I found the settings that showed where connections were and there were a bunch of ActiveSync attempts from a foreign IP. These connections were all revoked so hopefully when the Activesync session the hacker is using has expired then it will be secure again.
He was sent an email attachment for a "work package" which he opened and then it asked for his email password to "access the contents"...I've educated him to the wrongs of this. Although he knew in principle this was wrong it also happens to be very similar to a method people use to commission large joinery projects from him so he got suckered in.
I'm pretty sure the viruses, bitcoin miners and latent ransomware (probably waiting to be enabled once the scammers had defrauded any money first) got installed at the same time as he noticed a change in performance on the machine. His free Avast AV failed to pick any of them up, but to its credit Windows 10 Defender did a much better job. He still won't be using the machine again until it's had a fresh install.
Cheers all
The hackers are definitely using Activesync to access the emails - I found the settings that showed where connections were and there were a bunch of ActiveSync attempts from a foreign IP. These connections were all revoked so hopefully when the Activesync session the hacker is using has expired then it will be secure again.
He was sent an email attachment for a "work package" which he opened and then it asked for his email password to "access the contents"...I've educated him to the wrongs of this. Although he knew in principle this was wrong it also happens to be very similar to a method people use to commission large joinery projects from him so he got suckered in.
I'm pretty sure the viruses, bitcoin miners and latent ransomware (probably waiting to be enabled once the scammers had defrauded any money first) got installed at the same time as he noticed a change in performance on the machine. His free Avast AV failed to pick any of them up, but to its credit Windows 10 Defender did a much better job. He still won't be using the machine again until it's had a fresh install.
Cheers all
Edited by PhilboSE on Thursday 26th September 07:58
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff