Question Is my email compromised?

[Sahir Dizdarevic]

Hi everyone.

Recently I've got warning someone tried to log in to my email acc from unknown location and google prevented him, so after that I changed my pw (2FA is already on). Later on I've received an email claiming I created snapchat account (which I didn't, I don't even use it). I ignored that as I thought maybe someone accidently entered my email and created acc with it, and it also needs to be verified which shouldn't be possible If I don't click it, I thought. But the day after I received an email that I successfully verified that account. Right after that I downloaded manually snapchat app on my phone and tried to log in with my email, I successfully reset pw and entered account.
I saw he sent some spam virus messages to random ppl. Also I noticed some weird blackmails in my junk folder where he claims he got my data I have to pay some money to him in bitcoin or he will publish it etc etc, which I've just ignored. He gave me around 48hrs and that happened almost month ago at this moment.

I did clean install of my system and changed pw of every single acc I know I had.

But I wonder how's this possible? How did he verify newly created account if he didn't enter my email and why would he even do that? I checked login activity, it's only me, and that hacker who entered but google kicked him out instantly. I also wonder how did he pass my 2FA, which I use on every single account I have.

 

[jeremyj_83]

Hi everyone.

Recently I've got warning someone tried to log in to my email acc from unknown location and google prevented him, so after that I changed my pw (2FA is already on). Later on I've received an email claiming I created snapchat account (which I didn't, I don't even use it). I ignored that as I thought maybe someone accidently entered my email and created acc with it, and it also needs to be verified which shouldn't be possible If I don't click it, I thought. But the day after I received an email that I successfully verified that account. Right after that I downloaded manually snapchat app on my phone and tried to log in with my email, I successfully reset pw and entered account.
I saw he sent some spam virus messages to random ppl. Also I noticed some weird blackmails in my junk folder where he claims he got my data I have to pay some money to him in bitcoin or he will publish it etc etc, which I've just ignored. He gave me around 48hrs and that happened almost month ago at this moment.

I did clean install of my system and changed pw of every single acc I know I had.

But I wonder how's this possible? How did he verify newly created account if he didn't enter my email and why would he even do that? I checked login activity, it's only me, and that hacker who entered but google kicked him out instantly. I also wonder how did he pass my 2FA, which I use on every single account I have.

What type of 2FA do you use?

 

[Sahir Dizdarevic]

What type of 2FA do you use?

I use Google Auth and Microsoft Auth, but mostly Google's.

 

[jeremyj_83]

I use Google Auth and Microsoft Auth, but mostly Google's.

Double check and make sure that SMS based 2FA isn't allowed. If it is allowed then my guess is the hacker was able to have the 2FA sent that way. SMS based 2FA is very weak.

 

[Sahir Dizdarevic]

Double check and make sure that SMS based 2FA isn't allowed. If it is allowed then my guess is the hacker was able to have the 2FA sent that way. SMS based 2FA is very weak.

So you are telling me I should always disable SMS based 2FA and have only the one through google's app? 'cuz atm I have both.

 

[randyh121]

Check your forwarding settings. What is probably happening is they set up a rule in your email to forward all messages you get to his email.

 

[jeremyj_83]

So you are telling me I should always disable SMS based 2FA and have only the one through google's app? 'cuz atm I have both.

Whenever possible you should disable SMS based 2FA. https://securityboulevard.com/2021/12/why-using-sms-authentication-for-2fa-is-not-secure/

 

[Sahir Dizdarevic]

Check your forwarding settings. What is probably happening is they set up a rule in your email to forward all messages you get to his email.

I checked this, there weren't any mail forwardings, but there was POP and IMAP enabled, I disabled both.

 

[Sahir Dizdarevic]

Whenever possible you should disable SMS based 2FA. https://securityboulevard.com/2021/12/why-using-sms-authentication-for-2fa-is-not-secure/

Thank you for this. I used to set both since I was always afraid what if my phone just stops working or I lose it, I would lock myself out.

 

[jeremyj_83]

Thank you for this. I used to set both since I was always afraid what if my phone just stops working or I lose it, I would lock myself out.

Yeah that is always the fun part with 2FA. Usually there is a backup key that you can download to your computer in case of a lockout.

 

[Sahir Dizdarevic]

Yeah that is always the fun part with 2FA. Usually there is a backup key that you can download to your computer in case of a lockout.

But isn't backup code just an extra weakness?

 

[jeremyj_83]

But isn't backup code just an extra weakness?

That is something that you store either on your computer or could print out and have a physical copy. If you store it on your computer you can encrypt is using Windows so even if someone were to steal the file they would get garbage by opening it.