3

I just had a weird experience that I am trying to figure out. I received a suspicious sign-in notification from google on my gmail account. They had my correct password. This isn't that surprising, the password was old and probably breached and needed to be changed anyway.

The weird part is that the attempt came from my town, on a device listed as Windows NT. I don't own any Windows devices. And this isn't NYC or somewhere that could be a coincidence, this is a small city of about 100k people.

Unfortunately I didn't think to save the IP or other information that came with the notification and now it is gone, and the "last 10 sign-ins" page is overwritten with new activity.

This seems to imply that somebody in my town has my email/password and tried to log in with it. But I just moved to this town and I don't know anybody here! I don't know how anybody could have that information.

Does anybody have any insight here? This is creeping me out.

4
  • wild guess here... but it's possible that you accessed a wifi network that stole your session or login. (OR, more likely that YOU logged in from a wifi network and there was no breach at all) It's really difficult to say with any certainty. – pcalkins Dec 30 '20 at 21:20
  • I suppose it's possible that I logged in on a wifi network somewhere that hijacked my credentials, but this seems unlikely to me because I use LTE for all my portable devices. And they are all iOS/iPadOS devices with Safari only, so even if I logged in from one of them it would not show up as a Windows device using Chrome. – Janet McElroy Dec 30 '20 at 21:27
  • it is unlikely, yes. I think it's really just a matter of you being in a new town that flagged it. Not sure why NT/Chrome came up. It's also possible that the e-mail itself was a phishing attempt. Did you verify the e-mail headers? – pcalkins Dec 30 '20 at 22:12
  • It wasn't an email, it was one of the in-app notifications from gmail. And the attempt shows up in google's security events panel, so it was definitely legit. I had all devices that could have made a login attempt with me, and I wasn't logging into any google services at the time, so I'm almost certain it wasn't coming from them. Besides, as mentioned in an update comment to the answer below, I managed to track down the IP this was coming from and it wasn't my house. I'm stumped! – Janet McElroy Dec 31 '20 at 4:10
5

The most likely possibility is that your browser was mis-identifid as Windows NT for some reason. Google treats logins from the same device but a different browser as a new login, for security purposes, and alerts you. It's quite likely that this login was legitimate but just improperly identified.

Another potential is that some malicious app stole your Gmail login credentials, and used it to sign in with a spoofed user agent string.

Either way, I strongly suggest taking the following precautions:

  • Go to Device Activity and check what devices are logged in. Log out any that you aren't using any more, or don't recognise.
  • Go to Security Checkup and perform all the steps there. Particularly pay attention to third-party access, as many malicious apps will gain access to your gmail, add themselves as a third-party app with full access to your account, then delete the alert emails from your inbox. This gives them persistent access even if you change your password.
  • Start using a password manager. I recommend KeePass, but there are lots of options.
  • Perform similar checkups on any of your other accounts. A compromised email account means that an attacker can reset passwords on other stuff. If you've used this password elsewhere, make sure to change it on those services. Most social media sites have their own security checkup pages.
  • It's technically covered by a previous step, but I want to emphasise that you should enable 2FA. It's really important, particularly on things like Google accounts, Microsoft accounts, Apple accounts, anything with monetary value (banking, Steam, Amazon, etc.), and any social accounts (Facebook, Twitter, Reddit, Slack, Discord, etc.) that might be used by an attacker for spam. If you run any web hosting or domains, check over those accounts too and enable 2FA where supported.
  • Check HaveIBeenPwned to see if your email address appears in any password leaks. Chances are the answer is yes. Use this to think about where you might have reused passwords that were used in any of the compromised services.
  • Check your outbox and deleted emails on gmail. If your account was compromised it may have been used to phish people in your address list, or to send malware to people. Ask your friends to keep an eye out for anything strange coming from you online.
5
  • good advice... but my buddy once was a victim of a sim-swap and said that using 2FA made things worse and advised against it. What's your opinion on that? Maybe use a phone# that's not your cell? (google voice or ???) – pcalkins Dec 30 '20 at 22:15
  • 1
    SMS 2FA is pretty bad because of that issue, but no 2FA is still worse than SMS 2FA in my opinion. Ideally, though, use Google Authenticator or a similar app wherever possible. – Polynomial Dec 30 '20 at 22:18
  • I managed to track down the IP, it was embedded in the page source of the google security event page (seems like the page requests this stuff but doesn't render it). The IP doesn't match the IP of another listed event just a few hours later, when I changed my password. So I don't think it came from my house. IP lookups say it is a comcast connection in a nearby part of town, so I don't think it's a mobile connection of any kind. I've changed my password and done the all the usual things to secure the account. But I am still mystified as to how this could happen and it freaks me out! – Janet McElroy Dec 31 '20 at 0:22
  • I know this is getting to a serious tinfoil hat level, but could it be a local LEO? I don't know why they would be interested in me, but that's the only group I can think of that could plausibly obtain a password (perhaps from a cloud password keychain, I did have this password stored with google). But then again, would they ever even log in directly like that? I would have guessed they'd just subpoena or get a warrant for emails and bypass any login systems. Still scratching my head here… – Janet McElroy Dec 31 '20 at 0:31
  • @JanetMcElroy I highly doubt it. Given that info, my guess would be that either someone in your town is messing with your account - maybe some local kid fancies themselves as a hacker and is just looking up local folks' email addresses in a password dump - or your device briefly accidentally connected to an open WiFi access point while you were out (or something like that) and the Windows NT part is a misidentification. – Polynomial Dec 31 '20 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.