1

I have had my Microsoft account ever since Hotmail boomed, and I've had the same super weak six character password up until this year, but it was when one of my google accounts got compromised a few months ago that I decided to check my Microsoft account activity. I was surprised to see that it had registered activity that preceded from 2015 from countries I've never been in, so it was that moment when I made some changes.

I changed the password of every single account on every platform that I used to super lengthy ones with different kinds of character, and after reading on strong passwords, all of them focused on being especially lengthy. I also upped every security measure, adding recovery emails for my most important accounts and phone notifications to nearly all of them.

Then this morning happened. This morning I got a text and an email from Microsoft saying that someone else MAY be using my account and a link to review my activity. I was at work so I left the notification there to check it out later, but about half an hour later I got another text and email saying that my password has been compromised and a link to change my password. I didn't click it right away, I instead tried logging in to check my activity and it made me change my password and offered me to update my security info, which I did, and then I was prompted to log in again, and when I did it asked me to choose between sending a code to my recovery email or sending it through a text (like always after I upped my security).

After I logged in successfully I confirmed that there was unusual activity, as apparently an automatic sync (I don't ever use Microsoft apps, or any app for that matter, only web, even on my phone) from Russia. I refreshed the page because this activity was showing above my last activity (even though it's supposed to show chronologically) and after it was shown correctly I clicked on the arrow beside the activity to see the details again and was I again for a surprise.

The details showed activity from different dates from a small array of different countries none of which are where I live and all of them were automatic syncs. I double checked the rest of the activity and all of them were successful logins all made by me. All of these syncs were successful according to the details and the first one was from late July (last month).

Here's the data, skip if you want:

Protocol: POP3
IP: 185.31.162.106
Account alias: 
Time: 3 hours ago
Approximate location: Russia
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 84.238.84.12
Account alias: 
---@hotmail.com
Time: 8/13/2017 2:22 AM
Approximate location: Denmark
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: POP3
IP: 39.54.232.237
Account alias: 
---@hotmail.com
Time: 8/12/2017 11:00 AM
Approximate location: Pakistan
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.
Protocol: IMAP
IP: 177.142.187.49
Account alias: 
---@hotmail.com
Time: 7/27/2017 12:12 AM
Approximate location: Brazil
Type: Successful sync
You've secured your account since this activity occurred.
Learn about more ways you can protect your account.

How was my account compromised? Who was at fault for this breach? Me or Microsoft? I have my phone on 24/7 and email notifications at all times, how could this happen without my notice? Am I missing something or is this a vulnerability on Microsoft's system? How can I prevent this from happening again?

3

Changing a password does not typically revoke existing access. I'm not familiar enough with a Microsoft account, so I'll provide a general suggestion that many modern websites use.

Twitter has a section in your profile settings that list all connected applications to your account. This can be other twitter clients, or other services that use your twitter data some way. Once connected, this access usually persists through password changes. See if MS has a similar settings page and if so, revoke every application you see and then if something breaks on your end, add that access back.

So how was your account compromised after the password change? It likely wasn't. The user has an authorization token that hasn't been revoked yet. That would be my guess.

  • Just finished triple checking and microsoft doesn't have the menu, panel or option to visualize or revoke other active sessions (I assume this remains this way for user friendliness sake or something among those lines) Also how can they have an unrevoed token if my password change was months ago? My guess is that my password got bruteforced or there is some kind of security fault with these kind of tokens. – Bruno Coloma Aug 20 '17 at 0:17
0

I suspect the email from Microsoft isn't really from them, but is a clever forgery. When doing a quick nslookup of the IPs you listed, they all seem to be tied to junk domains. One of the IPs isn't currently in use. Please check if the email ASKED for any information, as there is a possibility of phishing for passwords or the like here.

  • The email I got in backup account was sent by "account-security-noreply@accountprotection.microsoft.com" and it showed a censored version of mi microsoft account and it said "We detected something unusual about a recent sign-in for the Microsoft account [..] To help keep you safe, we've blocked access to your inbox[etc] for that sign-in. Please review your recent activity and we'll help you take corrective action. To regain access, you'll need to confirm that the recent activity was yours." followed by a safe link to the official site and then "Thanks, The Microsoft account team" – Bruno Coloma Aug 19 '17 at 23:30
  • Although what worries me most is that even though it says this the activity log says it was a succesful sync, which seems to me that they've already downloaded my emails and stuff. – Bruno Coloma Aug 19 '17 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.