1

In the midst of using a popular online service the other day, I noticed some curious activity. My usage was diverted - while I was interacting with the service - into activities that were not (and would not have been) of my choosing. This access was registered as coming from an iPhone, and I don't own such a device. The activity made some (free) additions to my account.

At first I had no idea what was going on - I thought it might be a family member using an iPhone and "borrowing" my credentials. It took some hours to establish that it was not, by which time the suspicious activity had ceased, although the changes made remained. I accessed this service using my Facebook credentials. To be sure, I then logged out of both the service in question and Facebook and changed both passwords to strong, unique ones.

I have contacted the service provider, who has told me that "another user" gained access to my account and that I did the right thing to change my password. They refused to divulge any further details.

However, this breach seems unlikely to have been malicious due to the pattern of behaviour. Specifically:

  • There was no attempt to change the password or email associated with the account.
  • There was no attempt to use the payment access on the account to purchase anything.
  • Access to the account was via Facebook, and there was no attempt to change my email or password there either, nor was there any suspicious activity there at all.
  • A third service was linked to the suspicious one, which records my activity there. None of the suspicious activity was recorded, which is most peculiar.
  • The suspicious activity ceased of its own accord some hours before I changed the passwords.

So there are two possible options here. Either someone got my password for this account or this service has a security flaw that can lead to shared data and activity between accounts. Obviously, either is alarming and I'd like to know which one it is.

Can the lack of malicious actions taken during the breach be taken as any indication that it was not a deliberate hacking attempt? What other possible reason would there be to make non-malicious use of someone else's account in a non-social/public service?

1

Can the lack of malicious actions taken during the breach be taken as any indication that it was not a deliberate hacking attempt?

Someone was able to enter your account. Activities that followed don't matter. You never know what all changes were made to your account. Maybe, the free additions were made to mask the other evil intentions. Or, maybe, it was not a deliberate hacking attempt.

But the fact remains that someone else was able to enter your account, and that in itself is a reason enough to cause worries.

...and that I did the right thing to change my password.

Yes, and apart from this, you should contact the website's support to inform them of such activity. They should rectify it if the problem is on their end.

Also, you should change passwords on all other websites, which are still using the hacked password.

  • Thanks for contributing. I'm a little unwilling to name the service in question as I don't want to cast suspicion on them if this turns out to be my fault. However, given the nature of what it provides, there's no way the activity was somehow covering up for something else here. – Matt Thrower Jan 9 '18 at 13:12
  • @MattThrower What makes you think it could be your fault? – pri Jan 9 '18 at 13:14
  • I now use a password manager to store strong, unique password and have done for some time. On my older accounts, however, I used a recombinatory system to remember passwords which lead to me having a handful of different phases which I picked at random for new accounts. I cannot remember whether I changed this particular account to the password manager. So it's possible the password was re-used and someone managed to get the combination I'd used here in a hack and lucked out. – Matt Thrower Jan 9 '18 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.