WARNING about Account Hijacking - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: May 01, 2024, 12:06:39 am
content: WARNING: We have had a huge uptick in the number of hijacked accounts on the forum.Security on the forum has NOT been compromised, it's because spammers have gotten a stolen credentials list, and people reuse passwords.Please DON'T REUSE PASSWORDS, and change your pasword if you think you have been compromised.And if you get an email that someone has tried to log into your forum account, if means your details have been compromised elsewhere and other accounts you have on other sites are at risk.This has been mostly happenign to older accounts that don't often get used, but and automated script we now have in place to detect this is showing up to 4 accounts per day being compromised, hence the recent uptick in spam necroposting from established accounts.

author: strawberry
author_rank: Super Contributor
timestamp: May 01, 2024, 09:17:16 pm
content: ahoyI am here, shall me show who are made of wood or steelI am here, if they have got guts even to try

author: Kean
author_rank: Unknown
timestamp: May 04, 2024, 12:55:09 pm
content: Probably made easier due to the publicly available member list which they can try cross-referencing against user names or partial email addresses with leaked credentials from other sites.A pain in the rear, but it is what is is and part of the process these days of putting almost anything on the Internet.

author: schwaggins
author_rank: Contributor
timestamp: August 22, 2024, 11:00:27 pm
content: Thanks for unfreezing my account, my all Chrome data got stolen then reposted on some dark web forum. 541 compromised passwords is not fun to deal with

author: radiolistener
author_rank: Super Contributor
timestamp: August 28, 2024, 03:08:18 pm
content: Quote from: schwaggins on August 22, 2024, 11:00:27 pmHow it happens?

author: Kean
author_rank: Unknown
timestamp: August 28, 2024, 03:14:23 pm
content: Quote from: radiolistener on August 28, 2024, 03:08:18 pmUsually via malware

author: madires
author_rank: Super Contributor
timestamp: August 28, 2024, 03:41:51 pm
content: For example: Qilin ransomware caught stealing credentials stored in Google Chrome (https://news.sophos.com/en-us/2024/08/22/qilin-ransomware-caught-stealing-credentials-stored-in-google-chrome/)

author: Halcyon
author_rank: Unknown
timestamp: January 10, 2025, 12:56:19 am
content: Quote from: schwaggins on August 22, 2024, 11:00:27 pmIn my profession, over the past 6 months or so, we've seen a significant up-tick of credential stealers or threat actors getting access to saved passwords in browsers or Google Password Manager. Usually as a result of malware (not always detected by antivirus/EDR tools) and via phishing emails/fake login websites.Do yourself a favour and use a dedicated password manager, such as Bitwarden (my preferred option), LastPass, or 1Password. There are many others out there. Use phishing resistant MFA methods (like Yubikeys) where possible, and never recycle passwords or base your passwords of a common pattern (e.g.: Bob123!, Bob234# etc...)

author: johnh
author_rank: Regular Contributor
timestamp: January 10, 2025, 06:26:07 am
content: I use Password Safe. They have Windows/Linux version. Someone has ported it to AndroidThe reason I like it you can copy the password, without displaying the password on the screenIt support yubikey as wellhttps://pwsafe.org/

author: EEVblog
author_rank: Unknown
timestamp: January 10, 2025, 10:23:32 am
content: Quote from: Kean on May 04, 2024, 12:55:09 pmI assume that when they steal your email and passwords from your computer they also steal your history of site logins?That seems the obvious way so many spammers with stolen databases can find and access this otherwise obscure forum.

author: Kean
author_rank: Unknown
timestamp: January 11, 2025, 04:40:29 am
content: Quote from: EEVblog on January 10, 2025, 10:23:32 amDepends on whether the password is stolen from your PC via malware in which case grabbing that extra info is certainly possible, or it leaked from a website breach using poor encryption (where they wouldn't have access to any of your other browser history).

author: coromonadalix
author_rank: Super Contributor
timestamp: January 11, 2025, 05:12:59 am
content: yeah happened to me, malware payload grabbed every password stored in the web browsers, man i had to rush changing all precious ones, bank and install microsoft authenticatorwhen i saw computer going strange, killed it, and used an plan B computer all my pw where stored on excel file in an usb key next to the B computer just in caseand once in a while it pop many requests around the world

author: Karel
author_rank: Super Contributor
timestamp: January 11, 2025, 08:35:33 am
content: Let me guess, you used a windows pc to access the internet and/or you installed software from an unreliable source...edit:If you insist on using the most used desktop-os and using the most used internet browser, don't get surprised that you are in the crosshairs of malware writers.

author: madires
author_rank: Super Contributor
timestamp: January 11, 2025, 11:20:58 am
content: Quote from: EEVblog on January 10, 2025, 10:23:32 amA common practice of cyber criminals is to copy browser cookies which are often used as keys by websites. The convenience of a cookie based authentication instead of the normal login procedure with credentials makes that kind of attack simple. It's even done for session cookies with a short lifespan.