In addition, suspicious charges showed up on one her of credit cards, and additional password change requests were coming in. The first malicious requests started coming in at 5:30 and her e-mails stopped coming in shortly thereafter. The bad actor had a 4-hour head start.<\/p>\n
I started by talking through what happened – what she’d been doing on the computer and other details. We reviewed the sequence of messages closely. It quickly became clear that my client hadn’t done anything to start the hack. In fact, she was doing almost everything right!<\/p>\n
My suspicion was a data breach contained one of her passwords. One account was breached, followed by lateral movement across her accounts. Although my client was using multiple passwords on accounts, there was some password re-use and two-factor authentication wasn’t active in some places.<\/p>\n
<\/p>\n
The first thing to get control of was the local machine. I checked over the machine to find out that the client’s Microsoft account now had an email address from a Russian e-mail server. That meant a Microsoft breach. The next step was to check the client’s primary e-mail (Cox\/ISP), and we found we were locked out of that as well.<\/p>\n I created a local account with Administrator rights on the machine and switched into that in order to ensure control over the computer. After a cursory malware check using 2 different scanners, the machine appeared to be clean from most low-level malware.<\/p>\n We moved on to e-mail. Restoring our access required calling the ISP and verifying our identity with our landline. Getting control of the primary e-mail was our first win (or so we thought – read on). We immediately changed passwords and set up two-factor authentication with her ISP. We were able to change passwords and secure her Walmart account in short order.<\/p>\n After quick wins from Cox and Walmart, we started running into snags…<\/p>\n The malicious actor had changed all the personal information at Microsoft. We were able to change the recovery phone number, but due to Microsoft rules, personal information can only be changed every 30 days.<\/p>\n We had three options. We could wait out the 30 days and try to change the e-mail on the account back to our e-mail address. Or, we could try to prove the hack through Microsoft customer support. Finally, we could cut our losses and consider the account hacked. Although we had the password under control, nothing was preventing the bad actor from changing it back.<\/p>\n We decided to create a brand-new Microsoft account as the quickest way to fully gain control of her machine. I created a new Microsoft account for her. Unfortunately, she had to purchase her Microsoft Office 365 subscription again.<\/p>\n Before logging out of the compromised account, I made sure all of her One Drive files were available locally. We then disconnected the One Drive and deleted the One Drive files from the hacked account via the web.<\/p>\n I disconnected the hacked Microsoft account. Then I connected her clean, new Microsoft account as an Administrator.<\/p>\n After another malware and virus scan, it appeared we had control of the PC.<\/p>\n Note that if we wanted to be more cautious, we could have wiped the entire computer and started again at this point. I decided this was likely overkill based on the factors of the case.<\/em><\/p>\n We called Amazon login support, verified ourselves, and were told to expect an e-mail…none came.<\/p>\n Two days later, and with no Amazon e-mail, we called again. We were informed that Amazon had removed the extra authentication, e-mailed us to tell us that. They could see that we’d changed the password and re-enabled two-factor authentication…<\/p>\n What?!!! Sorry, it wasn’t us…<\/strong><\/p>\n Incidentally, in the meantime, the hacker in the Amazon account had been busy. They’d ordered a few items off the “recently purchased” list, promptly returned them, and converted the returns into gift cards. My client received an ottoman she already had two of. By now, she sure needed to put her feet up!<\/p>\n (When debugging issues like this, always go straight to the server via the webpage. This takes settings in your e-mail client program out of the equation.)<\/em><\/p>\n I remembered the customer service representative telling me to check forwarding settings on the account when we regained control over it. Sometimes, a bad actor will hack an account and forward copies of e-mails to other accounts. However, this setting was cleaned.<\/p>\n Then I remembered the filter rules. <\/strong><\/em>Rules, sometimes called filters, sometimes filter rules, are used to help sort and file your e-mails. Here’s an example: I can set up a rule to file everything from my electric company into the “utilities” folder.<\/p>\n I checked the rules, and there it was – one rule, ironically named “$”. This rule took every e-mail containing “amazon” in the “from” field and sent it off to another e-mail address without it hitting the inbox. Clever.<\/p>\n DELETE!<\/strong><\/p>\n Problem solved, or so we thought.<\/p>\n After 2 days, we called Amazon again and were told to repeat the same process. By now, we’d provided documentation (redacted IDs) to Amazon and verified our ID by phone several times. We were still receiving e-mails regarding the hacked account.<\/p>\n We repeated the process 5 times. We never could get Amazon to remove the two-factor authentication from the hacked account. Or, if they were, a bad actor was verifying against us.<\/p>\n As the client had already shut down any payment forms associated with the account, we decided to cut our losses. This meant re-subscribing to Amazon Prime and Amazon Music. The alternative? Not having control of her Amazon account, Echo devices, Blink security cameras, and Ring doorbells!<\/p>\n This had been going on for nearly two weeks. We cut our losses. I created a new Amazon account for her. I then re-subscribed to Prime and Amazon Music. We re-connected her apps and accounts, and re-setup two-factor authentication. Now, it was time to take control of the smart home.<\/p>\n Note – we may have pursued the Amazon account recovery further if my client had a large digital library (eBooks, Audible, movies). She was happy to pay for Prime and Amazon Music again to resolve the problem.<\/em><\/p>\n Starting with Blink, I put the Sync module into setup mode. We still had access to the Blink app on the phone and were able to re-add the sync module. We then re-associated Blink with the new Amazon account and had the cameras back.<\/p>\n The Ring was a similar process. We opened up the Ring app and re-associated it with the proper Amazon account.<\/p>\n We got lucky and saved some work. The hacker hadn’t compromised the client’s Ring and Blink password. That would have required a factory reset on the Ring cameras and Blink sync module.<\/p>\n Next came Alexa. I set up the Alexa app on the client’s phone with the new Amazon information. I reset all the Echo devices to factory default and re-added them into the Alexa app.<\/p>\n Last was to re-enable all the smart home Alexa skills to control Kasa smart plugs and her Nest Thermostat.<\/p>\n <\/p>\n The ecosystem was under control and the compromised accounts had been secured or abandoned.<\/p>\n Once we had control of the e-mail and compromised accounts, it was time to change passwords that were similar to the compromised ones. I was quite certain the e-mail account was breached first, but it’s better to be safe than sorry.<\/p>\n We decided to generate complex, unique passwords<\/em> for every place the client logs on. Luckily, the client already had an active subscription to the password manager LastPass and was familiar with using it.<\/p>\n LastPass and other password managers can generate complex passwords and save them, so you never have to remember the password.<\/p>\n We started by printing out a list of all accounts and passwords in her password database. Then, we moved one-by-one down the list of sites.<\/p>\n On each site, we:<\/p>\n We enabled two-factor authentication wherever possible. For security, we used an authenticator app when we could. If that option wasn’t available, we used a text message. We only used an e-mail backup as a last resort.<\/p>\n At the end of the process, we generated and printed a new password list from LastPass as a hard copy backup.<\/p>\n For e-commerce sites, we took an additional security step. We leveraged Privacy.com to generate unique credit cards for each site. Privacy.com, and services like this, protect real credit card numbers from data theft. “Fake” credit cards can be generated for each website, and limits can be set. One-time, disposable cards can even be created.<\/p>\n I hooked up privacy.com to her checking account. We set up the default payment methods for Microsoft, Amazon, and a few other sites to use Privacy.com cards.<\/p>\n <\/p>\n The first thing to do when analyzing any security incident is to look at the “TTP’s”, or tactics, techniques, and procedures. On a broad basis, most hacks occur due to a data breach, a hardware\/software bug, or a target hack.<\/p>\n My client was brutally honest with what she’d been doing on the computer and what went wrong. She was also quick to call for assistance, which is vitally important even if you only need a “second set of eyes” on something.<\/p>\n We checked hacking lists such as haveibeenpwnd.com to see if her e-mail address had been sold. Indeed, it had. My client had a unique e-mail password, but hadn’t changed it recently and didn’t have two-factor authentication enabled on her e-mail.<\/p>\n The computer appeared to be clean from high-level malware, so this was the likely culprit.<\/p>\n Two things would have prevented the hack – changing the password to the e-mail account after the data breach and having two-factor authentication enabled.<\/p>\n My best bet is my client wasn’t individually targeted. This was a lateral account movement style attack, starting with her primary e-mail address. Once the malicious actor gained access to the e-mail, they moved to reset passwords on high-value e-commerce accounts. Once they gained access to Amazon, they focused on that – locking up the two-factor authentication. They also set up the mail rule in Cox to attempt to gain persistent access to Amazon after the e-mail account was recovered. The Amazon gift card game could begin.<\/p>\n Did they win?<\/strong> Yes and no. It could have been worse. My client was forced to create new Amazon and Microsoft accounts, re-subscribe to services, and pay me to help secure her systems. She also was under a great deal of stress for several weeks and must learn new procedures for accessing her accounts.<\/p>\n In a sense, my client got off easy. The TTP’s pointed to a scripted Amazon\/e-commerce scam originating out of the east. If this had been a targeted attack, the damage could have been worse even with quick intervention.<\/p>\n There are automated tools available on the dark web that make “credential stuffing” and password changes a one-click operation. It probably took the bad actor a few clicks to cause days of headache.<\/p>\n If the bad actor had specifically targeted my client, they could have:<\/p>\n <\/p>\n As I say in all my security talks – “Everyone and everything is hackable, with enough time and effort.” Even the most seasoned security professionals and hardened systems can fall prey to a determined enough adversary. Don’t be embarrassed if a security breach happens to you!<\/strong><\/p>\n If you react quickly and rationally, you can prevent breaches from getting worse. Set down your device and stop clicking! Seek help from someone you trust (NOT the 800 number blinking “computer help” on the screen).<\/p>\n While it’s hard to cover all security issues with one tip list, here are a few lessons learned from this incident:<\/p>\n <\/p>\n![\"security](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_16187173-800w.webp)
<\/picture><\/p>\nHow did we secure it?<\/h2>\n
The Microsoft Account Problem<\/h3>\n
![\"Microsoft](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_46310975-800w-300x200.webp)
<\/picture>I moved on to the Microsoft account. We were able to log in to the Microsoft account on the web and see the user information. We were able to change the password but ran into a problem taking full control over the account.<\/p>\nWhat the hackers did at Amazon<\/h3>\n
![\"Amazon](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_40325209-800w-300x200.webp)
<\/picture>Amazon proved to be a trickier situation. The malicious party had taken control of the account, changed the password, and activated their own <\/em>two-factor authentication. This time, the two-factor authentication proved to work against us. Even though we had control of the e-mail to change the password, we didn’t have the secondary code.<\/p>\nThe big miss<\/h4>\n
![\"model](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_12287898-800w-300x236.webp)
<\/picture>The hacker had been clever. Something was preventing us from getting Amazon e-mails, but what? Time to check the e-mail settings directly from the ISP (Cox’s) website.<\/p>\nWe give up<\/h4>\n
![\"Overworked](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_12003464-800w-300x200.webp)
<\/picture>The e-mail was under control. We were now getting notifications from Amazon. We called login support again and were told to wait another 2 days. In the meantime, we were able to change the Amazon password to something complex, but we still couldn’t log in.<\/p>\nGetting the smart home back<\/h3>\n
![\"Smart](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_42162953-800w-300x222.webp)
<\/picture>Since Amazon owns the Echo, Blink, and Ring ecosystems, you need an Amazon account for all of their features to work. Obviously, we don’t want to run those devices on a hacked account.<\/p>\n![\"security](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_16359399-800w.webp)
<\/picture><\/p>\nTaking it further<\/h2>\n
Complex unique passwords for all<\/h3>\n
Changing the passwords<\/h3>\n
\n
Fake credit cards? Yes, in this case…<\/h3>\n
![\"hacker](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_342534150-800w.webp)
<\/picture><\/p>\nHow did the hacking start?<\/h2>\n
How could it have been worse<\/h2>\n
\n
![\"lessons](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_82388204-800w.webp)
<\/picture><\/h2>\nLessons in defending against hacking<\/h2>\n
\n
![\"Do](\"https:\/\/lokwest.com\/wp-content\/uploads\/2021\/08\/Depositphotos_28239855-800w.webp)
<\/picture><\/p>\n