8

I have my business email on GMail. I use 2-factor authentication for access to said business email. I access my business email from 2 computers and 1 mobile Android device. I do not use Outlook or any email client I access it solely through the web browser. I run Webroot AV on both computers and have run MalwareBytes, Hitman Pro and Sophos Virus Removal tool with 0 hits on all.

Yesterday, spoofed emails of my business email account originating from all over the world were sent out to my customers with an attached, password protected file that was a virus. In itself this is not unusual, however, each of the emails was a actual reply from a valid email I had received previously. I immediately looked at my google account settings and verified 2-factor auth, I looked at the devices that were using my email and could verify each one. I could find no proof that someone had gained access to my email other than myself.

Does anyone have any suggestions on where I should look for this breach? I am at a loss and dreading a second round of emails going out.

Improve this question
17
  • 4
    It's possible that the spoofer simply spoofed your name and email address as the sender, and sent the messages through some SMTP server other than GMail's. You may want to look at the headers of one of the spoofed messages, and see if it was sent through GMail's servers or not.
    – mti2935
    Oct 26, 2019 at 18:04
  • 6
    "each of the emails was a actual reply from a valid email I had received previously." - This does not mean that you are the only one who knew this mail. At least the sender of the original mail knew it. And maybe there were more recipients (maybe invisible to you, i.e. Bcc).
    – Steffen Ullrich
    Oct 26, 2019 at 18:34
  • 3
    I considered that, but this went out to many people and they had no connection to one another except for me.
    – PLBarton
    Oct 26, 2019 at 18:36
  • 6
    @PLBarton: in this case maybe one of the computers you use to access the mail got hacked. For example the attacker might have achieved remote access to your desktop and could thus misuse an existing authenticated session to access your mail. Have you also checked from where the last logins where done and made sure that this was all you?
    – Steffen Ullrich
    Oct 26, 2019 at 18:39
  • 4
    @PLBarton I think the missing details are important. You say that they are "spoofed" but then say that they are a reply. I think you need to edit your question with the actual email flow from the headers. If there is no strange account access and you use 2FA, then this might simply be a misinterpretation of the headers and no one accessed your account.
    – schroeder ♦
    Oct 28, 2019 at 10:47

2 Answers 2

Reset to default
1

It seems that someone remotely logged into one of your 2FA-authenticated devices and accessed your received email while your token was still valid.

Either way, it's unfortunate you have to deal with it.

Maybe implement a protocol of always logging out of the browser at least on the PC's and use a password generator to copy/paste your new password just in case there is a keylogger.

Improve this answer
2
  • 1
    Without knowing for the source of the problem, this sounds like a security step that has a high cost with dubious benefit. Logging out when not using the browser is only a mild pain, but may be completely pointless if an attacker can just wait until they are logged in (which they probably are plenty of the time anyway). Likewise, copy and past may help against a hardware keylogger but depending on how the system is compromised, a software keylogger may be equally as capable of stealing clipboard contents (and most probably do anyway).
    – Conor Mancone
    Oct 28, 2019 at 14:10
  • @ConorMancone Thanks for the further insight into how deep the intrusion goes. Maybe utilize a third-party clipboard utility after disabling the OS clipboard service. More than likely a "clean" install is in order after vetting your files. Be sure to implement a kill-switched VPN such as PIA at all times to further reduce your chance of intrusion exponentially.
    – Preston Bennett
    Aug 18, 2020 at 23:37
0

Yes if a malware implements MITB which is pretty common U2F and 2FA aren't even factors to the attacker.. You can even do this in modern browser sandboxes

Improve this answer
2
  • As I understand it, MITB is not a new thing and from what I read primarily affects IE and Firefox while I am exclusively using Chrome. The one variant of MITB I find that affects Chrome was relevant in 2012 and has been protected against for awhile now. The information I have is just from google searches and not personal experience.
    – PLBarton
    Oct 27, 2019 at 15:58
  • chrome.exe isn't hardened against DLL injection or static lib hooking.. TLS and HTTP buffer inline hooking is publicly documented for Chrome
    – user1276423
    Oct 28, 2019 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .