My account is being hacked? - Page 1
Forum section: electronics / general

author: DDT
author_rank: Contributor
timestamp: June 23, 2020, 03:37:35 pm
content: I have received this email 4 times today. It seems the hacker is a forum member, HPIB.

author: tooki
author_rank: Super Contributor
timestamp: June 23, 2020, 03:53:50 pm
content: ...or someone on the same ISP, since many ISPs recycle IP addresses among customers.

author: ebastler
author_rank: Super Contributor
timestamp: June 23, 2020, 05:08:08 pm
content: ... or someone who has already hacked into HPIB's account successfully, causing their IP address to be associated with the HPIB account.HPIB has only posted here three times, in quick succession, in late August/early September of 2019. Now the forum stats show him as recently active. Of course that may be real; he might have switched to reading only a long time ago, or may be back after a long break. But taken together with your warning messages, a hacked account seems somewhat likely.I'll report my own post (if I can do that?), so the mods can look into it.

author: EEVblog
author_rank: Unknown
timestamp: June 23, 2020, 11:51:15 pm
content: I can't see anything wrong with HPIB's account or associated IP tracking, and both of you use different ISP's in different countries. So

author: golden_labels
author_rank: Super Contributor
timestamp: June 24, 2020, 03:07:26 pm
content: EEVblog:Failed login attempts aside, Dave: privacy! That email leaks IP addresses of other forum members. If this is configurable or some forum plugin, perhaps disabling it would be a good idea?DDT:👍 for reporting this and asking for advice on the forum. Just to make sure you will not make any mistakes: do not click any links in such emails. The emails themselves may be an attack attempt.As tooki has mentioned, this may be a recycled addres. Or, even more likely, a network that uses NAT. Note that it’s a network that has merely 8k addresses to distribute. It’s quite possible the tens of people may be sharing that one.

author: grumpydoc
author_rank: Super Contributor
timestamp: June 24, 2020, 03:28:01 pm
content: Quote from: golden_labels on June 24, 2020, 03:07:26 pmAgree - the first question is "does this email actually come from eevblog"Do you use an email client which allows you to view the headers?The last legit failed login message I had (in fact me, forgetting my password) originated from cpanel1.eevblog.com

author: Jeroen3
author_rank: Super Contributor
timestamp: June 24, 2020, 08:06:08 pm
content: Quote from: golden_labels on June 24, 2020, 03:07:26 pmI read about this thing on some other forum and the general story was that is wasn'tleakingthe IP since you could assume the IP address belonged to the addressed. The name of the forum member though, that is different.

author: magic
author_rank: Super Contributor
timestamp: June 24, 2020, 08:34:20 pm
content: Yes, it tells you about other users connecting from the same IP. Not sure over what timespanIt could possibly even be illegal in the EU, but... Australia

author: golden_labels
author_rank: Super Contributor
timestamp: June 25, 2020, 04:52:46 am
content: Quote from: Jeroen3 on June 24, 2020, 08:06:08 pmUnless DDT is HPIB and is trying to break into their own account, this is not what happens here. What has been leaked is an address-username pair of another user. In this case DDT learned what address HPIB is known to be using.But even if DDT would now be using that address, the reasoning on that other forum(1)is invalid. The most important part: there is no way software sending email would know what IP address the recipient is using at the moment, so it’s still a leaky solution even if in a particular case no data was leaked. And even if that would be somehow verified, the address is likely to be shared/reused — but the reasoning seems to assume that the mapping is unique at all times.____(1)As reported by you. I don’t know the source.

author: magic
author_rank: Super Contributor
timestamp: June 25, 2020, 06:03:01 am
content: Quote from: magic on June 24, 2020, 08:34:20 pmNo, hell no, it tells you what other users used the forum (over some unspecified timespan) from the same IP which attempted the failed login.If you didn't fail a login attempt, this is not your IP address and never was. The forum doesn't even try to send this email to the IP address displayed in the email. This is an "FYI" list of users who may be suspected of having attempted the failed login. Or it could have been someone else from the same ISP. Sorry for the misinformation yesterday.

author: Halcyon
author_rank: Unknown
timestamp: June 27, 2020, 12:18:18 am
content: Many internet providers and most cellular network providers these days use carrier grade NAT (CG-NAT) on their IPv4 address space. This means that you could be sharing an IP address between multiple users. There just isn't enough IPv4 addresses to go around so that everyone has their own unique address (even if it's dynamically assigned).

author: paul
author_rank: Contributor
timestamp: July 25, 2020, 04:48:06 pm
content: I had two of these failed login attempt emails yesterday, except I had a long list of over 90 names with the same ip address.Hello paul,We have detected a failed login attempt on your account.Matched forum members with same ip address:Snip, its a long listIP address of the failed login attempt: 178.159.37.139Anything to worry about ?

author: Ysjoelfir
author_rank: Frequent Contributor
timestamp: July 25, 2020, 05:38:44 pm
content: No, as Halcyon already explained, it is nothing to worry about.

author: gorge441
author_rank: Contributor
timestamp: July 28, 2020, 06:56:08 pm
content: I guess,1. It is happening for share IP i mean share bandwidth.2. Someone knows your password and i suggest you to change your password as soon as possible.Thanks- GG

author: ebastler
author_rank: Super Contributor
timestamp: July 28, 2020, 07:38:04 pm
content: Quote from: paul on July 25, 2020, 04:48:06 pmQuote from: Ysjoelfir on July 25, 2020, 05:38:44 pmBut then, that IP address is in the Ucraine and shows up on various spam and IP abuse blacklists, according to Google. Hmm...

author: tom66
author_rank: Super Contributor
timestamp: July 28, 2020, 07:41:11 pm
content: Surely to get a failed login attempt you need to enter someone's username and the wrong password. So it is something to worry about, someone is bruteforcing or trying common passwords?

author: Ysjoelfir
author_rank: Frequent Contributor
timestamp: July 28, 2020, 09:25:29 pm
content: Quote from: ebastler on July 28, 2020, 07:38:04 pmwhen you visit the AustNet IRC channel you have that happen very often to you - I don't want to count how often I got the message that my IP is on some ban list....I think it's pretty common nowadays to get find the IP you have today been used by someone malicious...

author: pidcon
author_rank: Contributor
timestamp: July 29, 2020, 05:21:46 am
content: Go to your email reader and use "View Source" or some similar option to see what really is in the email message. Perhaps, Dave could possibly send a test message from EEVBlog.com for you to compare.

author: ebastler
author_rank: Super Contributor
timestamp: July 29, 2020, 05:46:34 am
content: @pidcon: I don't think anybody is questioning the authenticity of theemail. The question is whether it suggests a serious attempt to hack into the account, and what it means that so many forum user accounts seem to be associated with the same IP address.The latter could either be due to the fact that many users have in fact connected to the forum via that IP address. (Since it is an address used by an internet provider, and assigned to varying users when they connect.) That would be the harmless scenario. But it could also mean that an attacker has already successfully hacked into those 90 other accounts, and that's why they are associated with this IP.@paul: I would suggest checking a few of the forum accounts which were mentioned in the email, to see whether they are actually based in the Ukraine (where the IP address is) or nearby. If they are in very different regions, so that it is implausible that all those users connected via an internet provider in the Ukraine at some point, then I would think there is reason for concern. (Mainly for all those other users, whose accounts may have been compromised.)

author: paul
author_rank: Contributor
timestamp: August 01, 2020, 05:10:04 pm
content: Just for a test I logged in with the wrong password, this resulted in two Failed Login Attempt emails. So this is how the system works and the emails are genuine. Interestingly though, although I am connected via my phone, no other users are listed with same ip address.I checked the accounts of some of the user names on the list and, no they are not from Ukraine or the same region, also all the users I checked have a Position of ZeroPoster with a post count of 0, surprisinglyand Date Registered of 2020-3-12. As most of the names look like keyboard mashing of random letters I am presuming these are fake accounts, there are some real names in the list but these are also ZeroPoster and a similar registration date.I dont think these are compromised accounts as they have never made any posts, this is all a bit odd.

author: paul
author_rank: Contributor
timestamp: August 02, 2020, 05:57:16 pm
content: I checked again the first few names on the list of “IP address of the failed login attempt: 178.159.37.139”There are over 90 users on this list but I think after checking the first 11 there is a pattern appearingPosition Date Registered PostsZeroPoster 2020-03-12 0 Redmond WA USA March 12, 2020, 02:25:51 pmZeroPoster 2020-03-12 0 Hollyoaks, england March 12, 2020, 02:25:56 pmZeroPoster 2020-03-12 0 La Spezia, SP March 12, 2020, 03:03:43 pmZeroPoster 2020-03-12 0 Worldwide March 12, 2020, 05:49:53 pmZeroPoster 2020-03-12 0 Chucktown IL March 12, 2020, 09:12:20 pmZeroPoster 2020-03-12 0 Dunkerton, Iowa March 12, 2020, 09:33:15 pmZeroPoster 2020-03-12 0 Hattiesburg, MS March 12, 2020, 10:27:18 pmZeroPoster 2020-03-12 0 Washington NC March 12, 2020, 10:53:17 pmZeroPoster 2020-03-12 0 Vienna,Austria March 12, 2020, 11:34:21 pmZeroPoster 2020-03-13 0 York UK March 13, 2020, 05:43:38 amZeroPoster 2020-03-13 0 Upper Montclair, NJ March 13, 2020, 07:24:49 amI have not included the names (not sure if there are rules about that) most are just random letters and a few are real names. All I can say is someone was busy on the 12th and 13th of March, but to what end ?Any ideas why so many accounts with random names would be setup and not used ?

author: ebastler
author_rank: Super Contributor
timestamp: August 02, 2020, 06:18:04 pm
content: Hmm, strange indeed. Creating so many accounts (and accounts with non-plausible usernames!) just in preparation for spamming the forum with advertising links does not seem like a realistic scenario.If someone had access to the encrypted password information on the forum server, creating many dummy accounts might be part of a "known plaintext attack", trying to figure out the encryption (or hashing) algorithm and key for the passwords?Anyway, it's probably a good idea for Dave & team to remove all the accounts registered from that IP address, and to block the IP address from future use. I'll report my own post here to make sure this gets spotted.

author: EEVblog
author_rank: Unknown
timestamp: August 03, 2020, 12:02:45 am
content: Quote from: paul on August 02, 2020, 05:57:16 pmYep, have banned that IP. No active users but a lot of spam accounts.Thanks.

author: Halcyon
author_rank: Unknown
timestamp: August 03, 2020, 09:13:34 am
content: Quote from: EEVblog on August 03, 2020, 12:02:45 amI don't know if the forum software has a capability, but can there be an automatic deletion on zero poster accounts that are overxweeks/months old?

author: EEVblog
author_rank: Unknown
timestamp: August 03, 2020, 11:15:11 am
content: Quote from: Halcyon on August 03, 2020, 09:13:34 amNot automatic, but I manually do this every couple of weeks. Just the other day there was 4000+ registrations waiting approval, all spam of course. I just bulk delete one older than say 3 days, giving new users caught in the spam trap time to email me.

author: paul
author_rank: Contributor
timestamp: October 09, 2021, 05:31:59 pm
content: Its happened again, four emails with “Failed Login Attempt”.Three users with the same ip address, followed by seven users the next day with a different ip address.However the user names are not found when I “search for members” so I guess the users accounts have already been blocked / deleted ?The user names were mostly random letters (again) and the ip addresses are 45.88.82.128 and 195.208.119.20

author: MrMobodies
author_rank: Super Contributor
timestamp: October 10, 2021, 02:29:00 am
content: Just noticed HPIB's country flag is showing Czech Republic and the IP address is assigned to Czech ISP MagnaLink and DDT has a British flag which is a long way away assuming they are in their respective countries according to flag they set.https://whois.domaintools.com/188.122.198.84Quote

author: bson
author_rank: Unknown
timestamp: October 10, 2021, 10:01:22 pm
content: Quote from: Halcyon on June 27, 2020, 12:18:18 amIt could also be a bug in the forum software. If I try to login in as you, will it associate my address with your account? It shouldn't, but if it does it would result in exactly these messages if someone is trying guess passwords for a large number of users.

author: EEVblog
author_rank: Unknown
timestamp: October 11, 2021, 01:46:35 am
content: Quote from: paul on October 09, 2021, 05:31:59 pmA couple of people have mentioned this recently.I presume it's just spam bots randomly attacking account.

author: timbob
author_rank: Contributor
timestamp: August 02, 2024, 12:28:21 am
content: Just got and email about failed login today while was at work

author: Andy Chee
author_rank: Super Contributor
timestamp: August 02, 2024, 06:23:05 am
content: I imagine it's a data scraper bot that is harvesting the thread subheader, for example:QuoteSo a single bot machine (which explains the common IP address) located in India, Russia, North Korea, could scrape this list of names, and tryout some obvious passwords.There's probably a bot just sitting on the Test Equipment forum (biggest forum) just scraping away.

author: EEVblog
author_rank: Unknown
timestamp: August 06, 2024, 02:24:16 am
content: Just had a forum user contect me that he got an email report that a dozen different new account were set up with part of his username used, sharing the same IP address.The only conclusion I can come to was that his machien was infected with some sort of malware that was creating accounts. As how else would they kno his udername and use the same IP?

author: Halcyon
author_rank: Unknown
timestamp: August 06, 2024, 03:15:21 am
content: Quote from: EEVblog on August 06, 2024, 02:24:16 amUsername, I can understand, but IP address nope.

author: ebastler
author_rank: Super Contributor
timestamp: August 06, 2024, 05:11:19 am
content: Quote from: EEVblog on August 06, 2024, 02:24:16 amWhere did that email come from? Does SMF send such emails when it detects fraud attempts? (But why would the creation of an account which uses "part of one's username" be considered fraud? There are plenty of usernames here which share parts of the name.)I am wondering whether the email itself was a scam attempt, trying to get the user's real credentials?

author: Halcyon
author_rank: Unknown
timestamp: August 06, 2024, 07:53:06 am
content: Dave, I know you set up DMARC a little while ago, but I'd recommend implementing a stronger policy. Currently the policy is p=none (which is useful for testing), but worth moving that over to p=reject at some stage.Also make sure any services sending emails on-behalf of eevblog.com are included in your SPF policy (if they don't login directly to your Google account).https://checkcybersecurity.service.ncsc.gov.uk/email-security-check/results?domain=eevblog.com

author: EEVblog
author_rank: Unknown
timestamp: August 07, 2024, 03:56:40 am
content: Quote from: Halcyon on August 06, 2024, 07:53:06 amDid that and it caused all my email to be rejected by recipiant (gmail especially)

author: EEVblog
author_rank: Unknown
timestamp: August 07, 2024, 03:57:32 am
content: Quote from: ebastler on August 06, 2024, 05:11:19 amYes, SMF detects failed login attempts and alerts the account holder via email.

author: ebastler
author_rank: Super Contributor
timestamp: August 07, 2024, 06:46:58 am
content: Quote from: EEVblog on August 07, 2024, 03:57:32 amSure, I know about these notification. But in your earlier post, you had mentioned "anemail report that a dozen different new account were set up with part of his username used, sharing the same IP address".What's the deal there? Would I receive an email if someone creates an account with a username which resembles mine? Or if someone creates a new account and comes from the same IP address which I have used at some point before -- i.e. someone just using the same internet provider as me?

author: Halcyon
author_rank: Unknown
timestamp: August 07, 2024, 07:50:07 am
content: Quote from: EEVblog on August 07, 2024, 03:56:40 amThat's working as intended. It also means something else is misconfigured (probably SPF). a policy of "none" is basically like having no DMARC at all.

author: golden_labels
author_rank: Super Contributor
timestamp: August 07, 2024, 06:32:49 pm
content: Untilebastler questionis answered, I can deliver one guess.Perhaps the user registered in another service using the same username and email address? If the service was run or compromised by the adversary, they would have their username, email address, and IP address. The first two is enough to send a scam email, pretending that it comes from some service (EEVblog forum in this case).(1)Having the IP address just makes it more believable.(1)The EEVblog forum itself wouldn’t be special in this case. It just happened that the usernames agree for this particular website.

author: madires
author_rank: Super Contributor
timestamp: August 07, 2024, 07:05:08 pm
content: Quote from: Halcyon on August 06, 2024, 07:53:06 amCode:host -t TXT _dmarc.eevblog.com_dmarc.eevblog.com descriptive text "v=DMARC1; p=none; sp=none; fo=1; aspf=r; adkim=r;"fo=1 (create forensic report for rejected emails) doesn't make much sense without also setting ruf=mailto:<some email address> to receive the reports.

author: golden_labels
author_rank: Super Contributor
timestamp: October 08, 2024, 04:28:04 am
content: Perhaps the failed attempts notification should be disabled altogether? I don’t see the purpose it serves in the modern attack scenarios, while it irritates and worries users. Worrying is good, if it drives action, but in this case users can do nothing. They can just sit and watch a red light blinking. If they come to the forum, the only help they may receive is a reminder about basic security hygiene. Which certainly should be observed, but which doesn’t prevent the emails from piling up in their mailbox.I believe the notifications should rather go to administration only, as nowadays they’re the only ones capable of using that information. And not even about single accounts,(1)but as cumulative, statistically meaningful data detecting deviation from measured normal.It seems only some users are affected.(2)Those attacks may be credential stuffing, so one could imagine an email notification acts as an early warning sign about a leak elsewhere. But that assumes the user can pinpoint the leak source and that it comes from their actual account. Assumptions that are hardly reasonable in 2024.(1)Mistyping may happen to anybody.(2)I’m not, for example.

author: MrAl
author_rank: Super Contributor
timestamp: October 08, 2024, 09:50:41 am
content: Hi,If it looks like a duck, quacks like a duck, waddles like a duck, then it's an attempt to use someone else account.I can't be sure, but that one reply indicates that it could be a coordinated attack with multiple hackers banded together. It would not matter much where they are located in the world today with communications being so fast with the internet.This is one reason why I always like to suggest a timer function that does not allow several failed login attempts to occur at 1 second intervals but rather at 30 seconds or something like that after three failed attempts (maybe even longer), and a backup email address so they could email the forum if needed to explain the login problem.