5

Premise:

Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. The account was created and then left unused for a few days. Later, when accessing the account again about one week later, the system reported that the account was suspended because some suspicious activities were detected. The security page for the account reported an "successful login attempt" from an unrecognized IP about 10 minutes after the account was initially created. The account password was pretty strong and not shared with any other account, the account name was chosen at the time the account was created and couldn't be reasonably know to other people, so the only way some third party could get to know the account credentials in less than 10 minutes from the account creation I could think of was a keylogger or similar spy malware on the machine.

At this point my friend contacted me for help. I immediately searched for traces of an infection or other system-compromise but wasn't able to find any sign of infection on the machine - a IMac/Osx based computer. No visible rogue app, router config seems ok (I had also tried some online tools like F-Secure Router Checker to check if there was any trace of a router-lever dns hijack). I then noticed that the reported "unknown ip" that supposedly accessed the mail was 65.55.52.40 - an IP belonging to Microsoft. Contacting the service support yield no result (no wonder) : some of the employees seemed to hint that the system could indeed sometime cause false positives originating from internal maintenance scripts, but no official documentation was found about the issue.

So, long story short: Microsoft reports that someone used the correct credentials to access the account, the access is dated just <10minutes after the account creation so there is no time to bruteforce the account. Either I assume that there is some sort of spyware on my friend machine and suggest a full wipe OR I tell him that it probably was a false positive (the Microsoft owned ip seems to suggest so) and that he should probably ignore it.

I am now wondering on what the best actions would be in such case.


SIDE NOTE: Technically, an hacker accessing the account could very easily spoof its IP to appear as a Microsoft owned one in order to try to hide its activity. But I wonder if such technique could really work: imho such behavior would be the equivalent to trying to fool a bank into giving you access to someone else account while presenting them a fake ID card with the name of the employee in front of you printed on it.... I would hope that Microsoft would at least be a little suspicious when receiving a request over the internet from a remote PC claiming to be a machine in their own network...

1

As proof of a successful compromise has been cited, my suggestion would be to isolate the computer from the network and watch its behaviour (i.e. the network traffic). Information gleaned from this might shed some light upon how the compromise was performed, and thus how to avoid it in the future.

After this step, the computer should be erased, updates performed and all passwords and credentials for user accounts should be changed.

To emphasize on earlier postulations: Whether Microsoft is directly or indirectly involved in a compromise is irrelevant here; a Microsoft system could be hacked, and a proxy or VPN software installed upon it to cover tracks... After all, nobody in Microsoft would want to admit to such an embarrassing attack; they'd cover it up.

I am now wondering on what the best actions would be in such case

At the very least, to quote what I wrote earlier, "the computer should be erased, updates performed and all passwords and credentials for user accounts should be changed." This won't shed insight upon how the compromise was performed, but that insight might not be necessary. I tend to be curious about these kinds of things, so I'd be likely to perform some investigations prior to that system restoration phase, and from my experience there's usually a botnet to observe, and a leader repeating the same attack upon multiple people well into the future.


EDIT: The following was the result of misinterpretation of the question, and doesn't answer the question, but does present some good advice so I'll leave it, with invalid sections struck out like this.

It's a good practice to change the password every few months. The account was only freshly created, and there are no reasonable grounds to suspect the password is known.

Some time ago a friend of mine created a Microsoft based mail account (Live Id/Microsoft Account. He just needed the mail) to use for receiving some messages. ... All seems to point to a keylogger or similar infection on the client used to create the account.

It seems crazy to assume the only person who knew about the email address was the client, does it not? After all, the client was "receiving some messages".

Additionally, if the client is keylogged, it seems crazy to assume the hackers need to brute-force; if they have your keystrokes, they can... replay your password.

Perhaps the sender wanted to crack the account open but doesn't want there to be any evidence and so to cover tracks, used an irrelevant Microsoft system (the IP you mentioned).

There are also emotions to consider. Suppose sender thinks receiver will get paranoid, and to trigger the paranoia merely inserts the email to a phishing page with a fake password. Yes, people are often extremely vulnerable to emotional hacking.

Whether the sender/hacker/whatever is internal to Microsoft or not, this detail matters not to the question. Nonetheless, it's possible that Microsoft system was infiltrated by a Microsoft employee posing as a Russian hacker via Tor, which was then used to host a phishing site later used by sender to trigger anxiety meaning the blame is shared amongst two (edit: multiple) attackers, and the service staff you spoke to not wanting to get in trouble for such a stupid (edit: an embarrassing) attack implicitly being a third; how deep could the rabbit-hole go? It's not important.

No, the computer shouldn't be erased unless there's conclusive evidence that it was compromised. In this case, there seems to be no such conclusive evidence (or even mildly suggestive evidence), so even changing the password for the inbox seems unnecessary.

I am now wondering on what the best actions would be in such case

(edit: see suggestion at top of post)

Nonetheless, changing your password every few months is a good security practise. Perhaps making a memo to change the password in a few months is the most appropriate course of action here :)

  • Hi, sorry for the delayed reply but as you may imagine I had some problem merging the accounts. Anyway, I think you may have miss-interpreted some details in the question. The main point is that either the system was somehow compromised and the password was stolen that way or Microsoft is reporting a false positive and no one ever accessed the account in that time range (so, probably the reported access was due to some maintenance script on Microsoft side). Will try to edit the question to explain the situation better. In the meantime, thanks for the input. – user145772 Apr 21 '17 at 11:26
  • @user145772 Err, my bad! I misinterpreted "successful login attempt" as "unsuccessful login attempt". I'll update my answer, now. – autistic Apr 22 '17 at 3:06
  • Thanks. The point is that I don't really know how realistic is to think that someone using a keyloger managed to log the account credential and then log to the account before 5 minutes had passed from the original account creation. I strongly suspect that there was no hack, just Microsoft reporting a "fake" alert due to some maintenance script that was detected as a "successful login" to the account. That said, there is no way to be secure... but I don't have any way to be secure that the machine won't be infected again even after we perform the restore. – user145772 Apr 26 '17 at 7:45
  • @user145772 Indeed you don't; you have to trust that Apple hasn't installed some sort of factory-default backdoor for example. However, by studying the behaviour, network-wise, of such compromised machines I've found in the past that a binary can be found, and this can be submitted to antivirus organisations for analysis. This way you can be certain you won't be infected by the same sample, providing you keep your antivirus signatures up-to-date. Of course, that being said, some compromised systems show little or no obvious behaviours network-wise or otherwise, so one shouldn't rely upon this. – autistic Apr 28 '17 at 5:13
  • What I meant is that right now basically all the "proof" that the machine was compromised is Microsoft claiming that someone accessed the account. And the claim isn't very realistic - timing and IP addresses of the "hacker" seems to indicate a false positive. So, I can wipe the machine, but I don't know what the infection was or where it came from - I don't even know if there was an infection in the first place! – user145772 Apr 28 '17 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.