Remote hack of my computer via Chrome using Google account

Question

I posted this on Google yesterday but I think it deserves more visibility. If what I think might have happened, actually happened, then Chrome may not be secure:

Something weird happened yesterday morning and I am trying to get my head around it.

I have a Windows 2012 Server hosting virtual machines, but yesterday I just wanted to do a quick search on mortar types and didn't log into a VM. Symantec is installed (12.1.5 - yes I know it is old) and only visit green WOT sites. I opened a few of the search results in tabs and starting going through them. Then, all of a sudden, Chrome starting flipping pages and I had a message that Chrome was downloading and installing something. Then I noticed that it was logged into a Google account. it was the account for my property manager's assistant (I live in a condo). I used task manager to kill chrome immediately and it all stopped. I have Chrome 59.0.3071.115 on my server, but it looks like it just downloaded an update.

I could not figure out how the heck the property manager's assistant could have logged onto my server and then why he would log into chrome. I checked and Symantec was running. I checked my firewall router and RDP was still disabled to the server, plus this was the admin console and why would a hacker do something so obvious? I always lock my screen (old habit) when i leave my desk, even though only my wife and I live here - and one of us is almost always home. [Plus the session locks after a 15 minute timeout.] There is no way anyone had physical access unless they took the master key and came in while we were asleep, but that would have been really dumb. [And it would be next to impossible for anyone else to know my password.] Even so, why log into Google?

I downloaded MalwareBytes and ran a scan on my C drive with it and with Symantec. Both only found a few tracking cookies.

I also checked my main service ports using grc.com and everything is in stealth mode. I confirmed with Event Viewer that no RDP sessions were running (last one was months ago).

The only thing I can think of is that one of the sites I clicked on ran code that automatically logged into Chrome using the property manager's assistant account. Why? Since we are both in the same building, both our IPs would be in a similar IP range. Perhaps the assistant's computer is being hacked regularly and they were trying to get back in. Before killing chrome, I peaked at the user account settings, and the assistant's password had not been changed since January this year.

I do not think the assistant is computer savvy enough to be behind any of this. Most likely is that he has a simple password and it was simply hacked. I don't know what having access to his account would provide, but I imagine a remote program could instruct it to upload files. If so, they could have the passwords for all the security panels in the building.

I have not used my Google account for years, and don't think I ever used it on my server.

Can someone please confirm if this is a possible scenario? If it is not, then it looks like we had an invader in here, and I will call the police. I will notify the manager's office on Monday.

No, I do not have access to the account. However, if I click "Sign In", the account comes up as the default, but I do not know the password. Also, I am assuming it is the property manager's account. I have not talked to them yet, but plan to this afternoon once I get a reply back for a meeting. I should be able to confirm if it is their account. Once they have changed the password, I will post more info.

The only extensions I have are:

• Adobe Acrobat
• Google Docs
• Google Docs Offline
• Google Sheets
• WOT: Web of Trust, Website Reputation Ratings.

There is a chance that someone got the key and entered the unit. It seems really unlikely, but is not impossible. I'm on the board here and there has been a lot of conflict. Four board members have resigned as a result of conflict with the President over the past year or two. I have not as I was urged by others in the building to remain. The Property Manager was just let go. I had full faith and trust in her. A new property manager is starting as of this morning, and we just hired a new assistant superintendent. My first thought was they tried to get evidence or delete evidence - one of the board members is suing another. But I just do not know.

If it is possible Chrome is "hackable" as described, then it seems the most likely scenario to me. Its one or the other.

Answer 1

I'm fairly certain that the flipping pages, downloads, and installing that you saw was the result of the Chrome profile being that of a user who had authenticated to Google and has selected to synchronize everything or at the very least their extensions. http://prntscr.com/maqyg0

Why? probably because they wanted access to their Google Drive to be able to store any files they were attempting to retrieve from your server. Seems fairly ignorant to not sign out, but who knows.

Those "flipping pages", were they not a bunch of tabs opening? Many extensions, upon installation, open a new tab with information about the extension.

I'd be very interested in your after action review on this if it was anything other than a case of an inept data thief who had physical access to your server while it was unlocked.

Answer 2

It could be somebody using the Chrome Remote Desktop app to bridge across from his/her computer to yours. This Chrome app has been designed to be easy to use, even by non-technical people.

You can check whether it's been installed by going to chrome://extensions/ and looking at the Chrome Apps section. If it has been installed, you can either remove it or run it and disable remote access.

All it needs to operate is the firewall open for:

• Outbound UDP traffic
• Inbound UDP responses
• Traffic on TCP ports 443 (HTTPS) and 5222 (XMPP)