2

It seems like Gmail isn't logging full account activity. Recently I had my online account to Paxful hacked.

Today, 11/27 at 5:07, I received an email from Paxful saying that someone requested a password reset link, and at 5:08, another saying that my password had been reset from an IP address registered to a company in Amsterdam, but showing a geolocation in Chicago (149.255.33.155), implying they had clicked on the email link.

I then accessed my detailed Gmail recent account activity, and there were no logs of logins to my Gmail account during that time, 100% positive.

How is this possible? There's no way to reset the password outside of accessing the email. Doesn't Gmail log activity?

Paxful email header:

Message ID <[email protected]> 
Created at: Mon, Nov 27, 2017 at 5:07 PM (Delivered after 28 seconds) 
From: Paxful <[email protected]> 
To: (hidden)@gmail.com 
Subject: Password reset at Paxful 
SPF: TEMPERROR with IP 184.173.153.56 Learn more 
DKIM: 'PASS' with domain paxful.com Learn more 
DMARC: 'PASS' Learn more
Improve this question
7
  • Does Paxful still have your proper email on file? Did you see a recovery email in your Gmail account?
    – Conor Mancone
    Commented Nov 28, 2017 at 0:20
  • Yes it does. I got both the password recovery email from paxful in the Gmail account and the paxful email saying confirmation of new login from the chicago/amsterdam ip address that was used. but gmail doesnt show any new ips, or activity at all showing account was accessed. i'm thinking it was the Notifier for gmail extension that was on my chrome browser, but dont undrstand why gmail wouldnt log access with that
    – bob
    Commented Nov 28, 2017 at 0:25
  • dkim passed and dmarc passed, so yes
    – bob
    Commented Nov 28, 2017 at 1:00
  • 1
    @bob you are assuming that someone gained access to your Gmail account in order to click the link, but there are many other ways to get that link. Anyone in the stream from Paxful to Gmail could get it, anyone at Paxful, and anyone with access to your emails (without logging into Gmail, like forwarding) can get it.
    – schroeder ♦
    Commented Nov 28, 2017 at 9:35
  • 1
    contact Paxful support and report an incident - get them to perform an investigation as to who, when, where, and how this was done
    – schroeder ♦
    Commented Nov 28, 2017 at 9:36

3 Answers 3

Reset to default
2

Was there a log of you accessing your gmail account at that time? If so, were you actually on then? It is possible that if your computer was hacked, they may have been able to check your email automatically using your session, which would not look unusual in the logs. As a for instance, a malicious browser extension would likely be capable of such a thing. This could also be how they found out about your Paxful account: by accessing your email directly.

Any chance your computer is the source of the compromise? I consider that much more likely than the possibility that someone accessed google without google logging it. Then again, it is hard to determine what exactly might to have happened on the basis of this very little amount of information. There are likely a number of ways this may have happened, up to and including a vulnerability in the password recovery for Paxful.

Improve this answer
7
  • no, thats exactly what i'm saying. the logs , detailed access logs all show my ip address, and no log in between nov. 25 , and nov. 27(today) at 5:17 which is the time i found out. even if computer were compromised then gmail would still log activity from opening the email at 5:07 that was used to reset pasword. i had an extension on my chrome web browser, "notifier for gmail", i think thats wat did it. Does gmail not log activity for extensions? I was logged in at the time
    – bob
    Commented Nov 28, 2017 at 0:18
  • Okay, I thought you meant you didn't see any access out-of-the-norm. I would fully expect gmail to log all access, including from extensions, third-party apps, or yourself. Moreover, I don't expect there is anyway to clear the access logs. However, those are my suspicons: not hard facts. Do you have your gmail forwarded anywhere? Again, it could be just about anything.
    – Conor Mancone
    Commented Nov 28, 2017 at 0:28
  • i didnt have it geting forwarded anywhere. i would expect gmail to log all access also. But even if my computer were compromised, theres still no way to reset the paxful pasword withtout geting the password reset link from gmail, which means some1 had to open that email at 5:07/5:08pm. i checked acess logs, and nothing between nov. 25 and nov.27 5:17pm, which was me reading my own email. i have strong suspiciouns gmail didnt log something from the notifier for gmail chrome extesnion
    – bob
    Commented Nov 28, 2017 at 0:30
  • Regarding this part: "theres still now way to reset the paxful password without getting the password reset link from gmail". This isn't true. Again, especially if someone found a weakness in the password reset feature of paxful. In that case you weren't the only one who was hacked, and your gmail was never accessed. Without more data though, this is all entirely speculative. Maybe someone else will come around with some more concrete suggestions.
    – Conor Mancone
    Commented Nov 28, 2017 at 0:45
  • interesting. thanks. i wonder if theres a vulnerability in Notifier for Gmail , by add0n.com . but if paxful were the problem i would be furious
    – bob
    Commented Nov 28, 2017 at 1:01
0

Bob, try this link:

https://myaccount.google.com/device-activity

It should give all devices's activity on Google. For instance if you access gmail through Google's Inbox, it won't show up in Gmail's activity.

Also, double check all of the apps and their permissions, here: https://myaccount.google.com/permissions Check if they have permission to access your email, and if so, ask yourself if it could be that such app followed the reset link in a legitimate way.

If you find nothing, follow the instructions on I think someone else has access to my account on https://support.google.com/mail/answer/45938?hl=en

I won't post the detailed steps as those might change with the service, but hopefully the link to that answer and page will be updated by Google

(but as they said, if they used your computer, then that's not good, or if Paxful got compromised)

Also, check if the Paxful email is a phishing one. It could be that the links sent you to a similar webpage / or one on Paxful that got HTML injected to it, to steal your Paxful credentials.

As you said on the comments, 2FA (/MFA), for the win. But make sure you have those 2FA keys on more than one physically secure site, something like your wallet and your place at home to keep stuff safe should suffice.

Improve this answer
5
  • Posting just a link to Google's page is not very helpful. Include the relevant parts in your answer. Plus, I don't see anything on that link that is helpful. The comments address your phishing question (I edited the question to include them), and please do not post questions in your answers. Use the comment fields for that. The 2FA paragraph appears not to add anything to answering the question asked.
    – schroeder ♦
    Commented Nov 28, 2017 at 9:30
  • @schroeder: showed another link that might be helpful, instead of the Gmail activity. If not, added a link to what should be his next steps, which also include answers if it is malware or something similar changed the questions of phishing to statements
    – João Antunes
    Commented Nov 28, 2017 at 10:33
  • This link still does not apply: the OP knows how to check for activity (he checked): the problem is that there is no activity. The question now includes evidence that it was not phishing. This (and the others answers above) is simply not a useful nor an applicable answer.
    – schroeder ♦
    Commented Nov 28, 2017 at 10:42
  • @schroeder: This link still does not apply: the OP knows how to check for activity (he checked): the problem is that there is no activity. Gmail's activity is different from the link that I provided, the link that I provided shows all of the devices logged in into the google account while the Gmail one shows Recent activity: That's why I provided it
    – João Antunes
    Commented Nov 28, 2017 at 12:38
  • @schroeder: I just checked that accessing in inbox.google.com doesn't show in Gmail's activity, and edited my answer to clearly make explicit that one is not like the other, yet Inbox also gives you access to your emails.
    – João Antunes
    Commented Nov 28, 2017 at 12:58
-2

the source of your compromise and the reason it is not showing a login from that IP is becaues they are using a VPN or proxy to make it look like they are at your exact location, there are two blackhat programs to do that. very easily. they accessed your gmail (to not cause issues with different country log) through your infected PC (trojan most likely where they have full control over your computer or a botnet that found some intereresting info.

For further OPSEC, they probably are probably accessing your PC through a VPS using a VPN or more likely if they are more sophisticated, a proxy with your city and state and one of the two programs I mentioned above that mimics your OS/PC Specs/Browser/etc so people can steal from you without the company you are using ever knowing.

Improve this answer
2
  • 1
    i dont think this is wat did it. there are no gmail activity logs watsoever from the time period the hack happened ( 5:07pm today). and from my testing, gmail does log account activity wen you open an email to read it.
    – bob
    Commented Nov 28, 2017 at 3:46
  • my email was open in chrome, but i hadnt clicked anything in it for 2 days. and the logs accordingly showed a gap in activity between november 25th and november 27th at 5:17pm(the time i noticed the hack)
    – bob
    Commented Nov 28, 2017 at 3:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .