I just got a message today that someone changed my password on my Google account.

The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity.

The password change that happened today occurred in a city in the country I live (Netherlands).

I have two factor authentication turned on - how is this even possible?

This is the view in Google "Your Devices" of the device that changed my password:

enter image description here

  • 2
    What type of two factor authentication do you have turned on? There are multiple types. Does the recent activity show any clues what type of 2FA the attacker used? SMS, Google Authenticator, backup code? My first thought was a compromised phone (malicious app installed, rooted phone, etc.) but it depends on which method you used. – Martin Fürholz Jan 21 '20 at 12:49
  • 1
    Are you a person of interest for foreign nations? (For example a NATO subcontractor) – A. Hersean Jan 21 '20 at 12:54
  • Hi @MartinFürholz, thanks for your msg. I have enabled SMS. Within Google "your devices" I don't see any info about which 2FA they would have used - I've attached a screenshot. – Dirk Boer Jan 21 '20 at 13:50
  • Hi @A.Hersean, thanks for your message. No, I'm not :) – Dirk Boer Jan 21 '20 at 13:51
  • Is it possible that you have granted access to a new app, web, add-on, or other soft that requested Google access? – jDSL Jan 21 '20 at 13:54

There is a malware which is spreading nowadays that clone the ID of chrome, so an attacker can access any site/s thanks to cookie sessions saved on that chrome. The technique is very sophisticated and 2FA it's useless here because they're already logged in with your cloned browser id and nothing require to be checked. So most probably, if you're a google chrome user, you could have been affected by this kind of attack. If this is your case, the solution will be as follow:

·LogOut your google account from the infected machine (of course, run Malwarebytes or any other kink of anti-malware to delete the virus)

·Uninstall google chrome and/or any kind of chromium-based browser(and all of its related data)

·Now you need to change the name of your computer (so the new session will have a different name avoiding name hijacking https://kb.iu.edu/d/ajnx)

·From a different device change the password of your google account

·In 2FA google settings revoke all authorized devices

·Reboot your pc and reinstall chrome.

You should be done.

  • 3
    any references to this malware? I can find nothing online that does what you have outlined – schroeder Jan 21 '20 at 20:22
  • AZORult and its related children – Virgula Jan 21 '20 at 20:30
  • 2
    I'm still not seeing any reference to this 2FA-defeating behavior from AZORult – schroeder Jan 21 '20 at 20:40
  • In fact, there isn't. Many users have been affected by this malware (or similar ones) and they're are reporting they're experiences. It seems very strange that it is able to bypass 2FA and it is still not clear to me how it exactly works. It just copy the chrome ID so the attacker seems an authorized victim and does not require 2FA (in fact, on trusted devices 2FA it's not required, or at least it is not required on google). Anyway this virustotal scan is one of the most recent of the virus: shorturl.at/shortener.php – Virgula Jan 21 '20 at 20:44
  • Thanks for your answer! Would it have been possible to simply steal the Google auth cookie? I.e. through a Chrome plugin? – Dirk Boer Jan 22 '20 at 0:00

Run forensics on the phone:

  • Check the latest app permissions (timeframe of hack happened)

  • Get a list of the SMS from OTP provider (from carrier company) (timeframe of hack) compare it to to SMS that you have on the phone (malware could have deleted that)

  • Capture packets sent from phone through the wi-fi (deploy a VM, deploy a gateway on it, deploy a wireshark or burpsuite), analyze data, lookup for the connections to WAN IPs it's trying to do.

  • Try to get info on that IPs and then think what to do with all that info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.