I posted this on Google yesterday but I think it deserves more visibility. If what I think might have happened, actually happened, then Chrome may not be secure:
Something weird happened yesterday morning and I am trying to get my head around it.
I have a Windows 2012 Server hosting virtual machines, but yesterday I just wanted to do a quick search on mortar types and didn't log into a VM. Symantec is installed (12.1.5 - yes I know it is old) and only visit green WOT sites. I opened a few of the search results in tabs and starting going through them. Then, all of a sudden, Chrome starting flipping pages and I had a message that Chrome was downloading and installing something. Then I noticed that it was logged into a Google account. it was the account for my property manager's assistant (I live in a condo). I used task manager to kill chrome immediately and it all stopped. I have Chrome 59.0.3071.115 on my server, but it looks like it just downloaded an update.
I could not figure out how the heck the property manager's assistant could have logged onto my server and then why he would log into chrome. I checked and Symantec was running. I checked my firewall router and RDP was still disabled to the server, plus this was the admin console and why would a hacker do something so obvious? I always lock my screen (old habit) when i leave my desk, even though only my wife and I live here - and one of us is almost always home. [Plus the session locks after a 15 minute timeout.] There is no way anyone had physical access unless they took the master key and came in while we were asleep, but that would have been really dumb. [And it would be next to impossible for anyone else to know my password.] Even so, why log into Google?
I downloaded MalwareBytes and ran a scan on my C drive with it and with Symantec. Both only found a few tracking cookies.
I also checked my main service ports using grc.com and everything is in stealth mode. I confirmed with Event Viewer that no RDP sessions were running (last one was months ago).
The only thing I can think of is that one of the sites I clicked on ran code that automatically logged into Chrome using the property manager's assistant account. Why? Since we are both in the same building, both our IPs would be in a similar IP range. Perhaps the assistant's computer is being hacked regularly and they were trying to get back in. Before killing chrome, I peaked at the user account settings, and the assistant's password had not been changed since January this year.
I do not think the assistant is computer savvy enough to be behind any of this. Most likely is that he has a simple password and it was simply hacked. I don't know what having access to his account would provide, but I imagine a remote program could instruct it to upload files. If so, they could have the passwords for all the security panels in the building.
I have not used my Google account for years, and don't think I ever used it on my server.
Can someone please confirm if this is a possible scenario? If it is not, then it looks like we had an invader in here, and I will call the police. I will notify the manager's office on Monday.
No, I do not have access to the account. However, if I click "Sign In", the account comes up as the default, but I do not know the password. Also, I am assuming it is the property manager's account. I have not talked to them yet, but plan to this afternoon once I get a reply back for a meeting. I should be able to confirm if it is their account. Once they have changed the password, I will post more info.
The only extensions I have are:
- Adobe Acrobat
- Google Docs
- Google Docs Offline
- Google Sheets
- WOT: Web of Trust, Website Reputation Ratings.
There is a chance that someone got the key and entered the unit. It seems really unlikely, but is not impossible. I'm on the board here and there has been a lot of conflict. Four board members have resigned as a result of conflict with the President over the past year or two. I have not as I was urged by others in the building to remain. The Property Manager was just let go. I had full faith and trust in her. A new property manager is starting as of this morning, and we just hired a new assistant superintendent. My first thought was they tried to get evidence or delete evidence - one of the board members is suing another. But I just do not know.
If it is possible Chrome is "hackable" as described, then it seems the most likely scenario to me. Its one or the other.