How do online accounts get hacked?

Question

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social engineering attacks? Is malware typically involved? Is it the result of compromising the systems holding account credentials? All of the above? What methods do the bad guys employ? What are the prevalent trends in methods used to gain access to these accounts?

I see friends get their Facebook or AIM accounts hacked, and without knowing how they were likely hacked, I have no idea how to advise them and can't really explain the nature of the problem to them.

Answer 1

@p____h already answered pretty well most of what occurs when an account is hacked, but I wanted to add my salt regarding a recently hack of a Gmail account that is very interesting to read!

It's the recent Cloudflare attack.

This is just AMAZING, the attacker used 4 flaw in various services, not only Cloudflare's :

1. AT&T was tricked into redirecting my voicemail to a fraudulent voicemail box
2. Google's account recovery process was tricked by the fraudulent voicemail box and left an account recovery PIN code that allowed my personal Gmail account to be reset
3. A flaw in Google's Enterprise Apps account recovery process allowed the hacker to bypass two-factor authentication on my CloudFlare.com address; and
4. CloudFlare BCCing transactional emails to some administrative accounts allowed the hacker to reset the password of a customer once the hacker had gained access to the administrative email account.

I highly recommend you to look at the blog post, and if you are hurry, just read the infographic that shows the sequence of events. This attack would be worth a short movie!

Answer 2

There are a lot of ways which could be used to hack into your account.

Firstly, a lot of people use the same password to register everywhere. If you create account on the vulnerable website, then someone could hack into that website and get your credentials (stored at database). Then attacker has your e-mail, your password and if that password is the same as the password to your email-box, then he has an access to your e-mails.

Secondly, the next thing could be a very common password. If you use password like 123456 or qwerty then it's very huge probability that your account will be hacked. There are a lot of bots/crawlers in the Internet which collect e-mails and try to log into grabbed account by using common passwords. Of course they just use a few tries (preparing brute-force attack will be blocked e.g. by CAPTCHA).

Moreover, phishing is a nice trick to extort your e-mail and password. There are a lot of ways to trick users to type their credentials on the fake website. Some of them use social engineering, rest of them: more technical tricks, like tabnapping.

We shoudn't forget about malware. Keyloggers (or even mouseloggers for virtual keyborads) intercept typed passwords and send them to the attacker.

Creating a secret question (to help us in e-mail recovery) could be a problem too. It's not a method used for mass-email-stealing, but it's pretty effective for specific people. Obvious secret question like (what's my name or my favourite color) could be easily guessed or extorted by social engineering methods.

Answer 3

It is all of those. I work for a major company in the line you mentioned. I get a good inside out view, everyday there user accounts compromised.

Combination of phishing and social engineering is a major reason behind, there are ton of phishing sites out there and users get sent soliciting fake emails to them.

Secondly malwares and weak passwords. Malwares work best on site like facebook since their architecture's nature of open platform to integrate other sites and applications. I have seen huge dictionary attacks that went on for months and years to gain access to accounts with weak passwords. Compromising the system it self is less frequent.

Some attacks are combination of two or more, it is a chain of attacks that output of one attack is used in next attack. These attacks target not only usernames and passwords but gaining extended info and Personally Identifiable Information (PII) information too.

Answer 4

Just to expand on what p____h mentions - malware requires a delivery mechanism. Most users are now smart enough not to run .exe's spontaeneously downloaded from the internet, and most Microsoft OS users will be running some sort of anti-virus, however javascript provides a fantastic range of facilities for accessing the internet and leveraging authentication mechanisms built into browsers. It might run inside a sandbox that prevents local file access - but what use is that when your data assets are stored on the internet and not on your filesystem? There are still limits on what can be done with just javascript - but it's probably a lot more than you think.

There have been a series of issues in Adobe Acrobat and Flash and MANY activeX objects which have allowed javascript to inject binary malaware into the system outside the sandbox.

I still see a surprising amount of traffic from browsers which users have 'enhanced' with dodgy search toolbars - once someone's code is in your browser chrome, then they have complete control over your browser.

Answer 5

All of the above you mentioned, plus at least two more:

1. For a user who re-uses passwords across different accounts (ie. a great, great, great many users), a password-database theft from one service allows a malicious actor to just retry those credentials at a wide array of other sites. Often successfully.

This tactic has proven successful in password breach after password breach, and is probably the most efficient way that a bad actor can quickly get into many valuable accounts. Concrete example: if a given user's email address and password are stolen from, say, LinkedIn, a malicious actor then just goes and tries those same credentials at Bank of America, Citi, JP Morgan Chase, Paypal, and other financial (and other sites of interest) with very large customer bases. The attacker plays the odds: try stolen credentials of a person who re-uses passwords on enough very-popular services and you'll often hit an account where those re-used credentials work. Even if this try-as-many tactic works for a very, very small percentage of user credentials in a given stolen database, if the database we're talking about contains millions of records that's an incredible feast for any malicious actor who gets access to them.

(For purposes of keeping things simple here, let's assume that whatever compromised password database I talked about above was not protected by very robust password hashing, resulting in malicious actors successfully cracking a large proportion of password hashes stolen so they could recover the original, plaintext passwords and try to reuse them. Like, well, what happened with the hack at LinkedIn.)

2. The often-overlooked but devastating tactic of password reset abuse.

As a user you can do absolutely everything right when setting a password for a service--don't reuse a password from anywhere else, use a lengthy & randomly-generated string with lowercase letters, uppercase letters, digits, and special characters--but still have your account hijacked. If, that is, bad actor can simply reset that password. How does that happen? Well, most frequently it happens because some very prominent services still use the god-awful practice of guarding password reset with quite-guessable security questions. (Some of them have even allowed attackers to make unlimited attempts to guess the answers to these questions correctly.) But sometimes an attacker doesn't even need to accomplish that; customer service reps for services will sometimes be lax about proper procedure and reset a password even when an attacker can't answer the questions properly. Most famously/infamously, this is what happened to journalist Mat Honan when a hacker breached his Apple account and deleted the contents of all his Apple devices.

Setting up two-factor authentication with a service (if the service offers it) to authorize password reset can reduce your risk, as can trying to avoid using services that rely on weak authentication mechanisms like security questions. But that still leaves the possibility open that a poorly-trained, poorly-monitored customer service rep will get tricked into resetting your password for an attacker. And about that threat a user can do very little.