1

I just got a message today that someone changed my password on my Google account.

The email seems legit, and Google confirmed there was a login from Ukraine two weeks ago in recent activity.

The password change that happened today occurred in a city in the country I live (Netherlands).

I have two factor authentication turned on - how is this even possible?

This is the view in Google "Your Devices" of the device that changed my password:

enter image description here

Improve this question
9
  • 2
    What type of two factor authentication do you have turned on? There are multiple types. Does the recent activity show any clues what type of 2FA the attacker used? SMS, Google Authenticator, backup code? My first thought was a compromised phone (malicious app installed, rooted phone, etc.) but it depends on which method you used.
    – Martin Fürholz
    Jan 21, 2020 at 12:49
  • 1
    Are you a person of interest for foreign nations? (For example a NATO subcontractor)
    – A. Hersean
    Jan 21, 2020 at 12:54
  • Hi @MartinFürholz, thanks for your msg. I have enabled SMS. Within Google "your devices" I don't see any info about which 2FA they would have used - I've attached a screenshot.
    – Dirk Boer
    Jan 21, 2020 at 13:50
  • Hi @A.Hersean, thanks for your message. No, I'm not :)
    – Dirk Boer
    Jan 21, 2020 at 13:51
  • Is it possible that you have granted access to a new app, web, add-on, or other soft that requested Google access?
    – jDSL
    Jan 21, 2020 at 13:54

2 Answers 2

Reset to default
2

There is a malware which is spreading nowadays that clone the ID of chrome, so an attacker can access any site/s thanks to cookie sessions saved on that chrome. The technique is very sophisticated and 2FA it's useless here because they're already logged in with your cloned browser id and nothing require to be checked. So most probably, if you're a google chrome user, you could have been affected by this kind of attack. If this is your case, the solution will be as follow:

·LogOut your google account from the infected machine (of course, run Malwarebytes or any other kink of anti-malware to delete the virus)

·Uninstall google chrome and/or any kind of chromium-based browser(and all of its related data)

·Now you need to change the name of your computer (so the new session will have a different name avoiding name hijacking https://kb.iu.edu/d/ajnx)

·From a different device change the password of your google account

·In 2FA google settings revoke all authorized devices

·Reboot your pc and reinstall chrome.

You should be done.

Improve this answer
10
  • 3
    any references to this malware? I can find nothing online that does what you have outlined
    – schroeder ♦
    Jan 21, 2020 at 20:22
  • AZORult and its related children
    – Virgula
    Jan 21, 2020 at 20:30
  • 2
    I'm still not seeing any reference to this 2FA-defeating behavior from AZORult
    – schroeder ♦
    Jan 21, 2020 at 20:40
  • In fact, there isn't. Many users have been affected by this malware (or similar ones) and they're are reporting they're experiences. It seems very strange that it is able to bypass 2FA and it is still not clear to me how it exactly works. It just copy the chrome ID so the attacker seems an authorized victim and does not require 2FA (in fact, on trusted devices 2FA it's not required, or at least it is not required on google). Anyway this virustotal scan is one of the most recent of the virus: shorturl.at/shortener.php
    – Virgula
    Jan 21, 2020 at 20:44
  • Thanks for your answer! Would it have been possible to simply steal the Google auth cookie? I.e. through a Chrome plugin?
    – Dirk Boer
    Jan 22, 2020 at 0:00
1

Run forensics on the phone:

  • Check the latest app permissions (timeframe of hack happened)

  • Get a list of the SMS from OTP provider (from carrier company) (timeframe of hack) compare it to to SMS that you have on the phone (malware could have deleted that)

  • Capture packets sent from phone through the wi-fi (deploy a VM, deploy a gateway on it, deploy a wireshark or burpsuite), analyze data, lookup for the connections to WAN IPs it's trying to do.

  • Try to get info on that IPs and then think what to do with all that info.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .