Sketchy activity detected last night

24  2016-12-01 by incognito_truth

Last night my Google account informed me that someone in the Washington, D.C area has my password and tried to log into my account. Should I be worried or is this a normal occurrence? Edit: I took a picture of this activity, but I don't know how to post as this is my first reddit post.

29 comments

My acct. was hacked shortly before r/Pizzagate was shut down; funny thing is my acct's are monitored BY an FBI security contractor (I have a gov't job so since all gov't employees details were hacked a year ago they now give out free cyber security), so basically I was informed by the FBI that the FBI had hacked into my personal acct. and that I should consider changing my password, haha

Best thing I ever read.

lol that's too funny, but your saying that if you work for the govt. your not safe so in terms no one is safe.

Yep, no one is safe. It's been suggested that TOR uses intelligence servers to bounce off of, and most encryption software is developed by the CIA and such. So really our only hope at the moment IMFO is to overload them with data.

Edit: For instance But basically the idea is to insert flagged language and searchable words in everyday language, perhaps even redefine their meanings via slang.

Don't forget who invented the internet! DARPA! I too have heard that a good 80%+ of Tor exit nodes are compromised.

How can other govt employees get this?

You would've gotten the option to sign up about a year ago from "myIDcare" if you held a position that was effected or could be effected by hacking.

Yesterday they publish about the hacking of more than a 1M accounts. For that reason is better to activate the two steps authentication process

http://imgur.com/a/KXefR

edit: This is the picture of the ip address.

Ip address showing as hotel in California from google search results

Ya I looked it up too, but why is it telling me from Washington, D.C?

VPN?

Fake email possibly?

This is a possible explanation, especially if the email has a "click here to reset your password" link... and if that link makes you type your current password (which it then steals).

Really popular phishing method, my company gets them all the time.

It wouldn't be a VPN, when you connect to a VPN, your entire public IP is different. If it were the same address, there would be no point in having a VPN.

Nothing from MXtools' reverse IP lookup.

Interesting that it's a hotel, wouldn't expect them to have compromised servers acting as VPNs/proxies. Unless someone was hacking from their room?

With a mac address spoofer that's pretty untraceable since the hotel can't be expected to respond to that activity within the timeframe of the stay, and they anyways they can't see specifically which room was using the WiFi, just which AP (corresponding to what area of the hotel they were in).

The IP block owned by Hilton Hotel Group is registered to their Operations HQ in Beverly Hills, CA:

ARIN Lookup Info

This is why a whois of the IP shows you the CA address. Image related:

HHOpsHQ

The IP addresses for each hotel location within the region are distributed by ARIN to Hilton Ops HQ in Beverly Hills, and from there HHOps distributes them to the various hotel locations internally. This is why relying strictly on geoip lookup tools also fails and shows only CA.

When Google does their calculation, they rely on additional data, including browser information, wifi and gps-based (if on a mobile device) location estimations that they calculate, and additional pieces of data which are almost guaranteed to be more accurate than the geoip results.

In this instance, it implies that the location of the login was a Hilton Hotel in Washington, DC or in close proximity to Washington, DC. Have you recently stayed in any in that area? Or did you stay near one, use one's wifi in passing, etc? If you stayed at one, did you use one of the business center shared computers and forget to logout?

If you didn't stay there but were in the vicinity and used their wifi, its possible someone could've intercepted your credentials. Or, if you didn't, its possible they gained the credentials via another method and were simply staying at a HHG hotel in DC when they tried to check the validity of your credentials...

As you can see, lots of possibilities here. :)

Someone tried to get into mine two days ago..

1 Million Android users were infected which leaked their gmail

use https://gooligan.checkpoint.com/ to see if you've been breached

http://money.cnn.com/2016/11/30/technology/android-phones-infected/index.html

Whew, I managed to dodge this one! ZoneAlarm is absolute shit though, would not recommend.

TBQH I can't recommend any free antivirus software, they usually act more like viruses. Popups telling you to buy more shit, like "PC tuner" software claimed to speed up your computer when really all it does is delete your cache and clear your cookies.

Best to just reformat every once in a while, and only sanitize the data you transfer to the new install.

Thank you! I've got a Macbook and I'm an Iphone user so it's still a little frightening, haha.

1 Million Android users were infected which leaked their gmail

use https://gooligan.checkpoint.com/ to see if you've been breached

http://money.cnn.com/2016/11/30/technology/android-phones-infected/index.html

And how safe is this checkpoint site ?

Exactly

I'm wondering why I would need a third party site rather than just having google tell me themselves.

Well apparently they will tell you if someone tries to log in from a new location. But they're not going to publicly advertise that they're compromised if they don't have to. It's only when leaks go public (think Sony, Dropbox, Myspace) that apologies are made.

The news article says the Gooligan campaign doesn't have access to passwords, just "tokens" that primarily let them rate up "legitimate" apps on the Play Store under your name.

Well it's not like it's asking for your password, too. I assume it operates similarly to http://haveibeenpwned.com in that it has access to the leaked data but only in a sanitized version which doesn't have the password hashes associated with each account.

Its to check if your email credentials have leaked, you just put in your email, it doesn't scan your device

Interesting. I'll look into the IP for you in a sec.

My phone rebooted itself 2 days ago, and then wouldn't accept my pattern to unlock it, said "invalid pattern". I was flipping my shit 'cause I had just had a vivid dream the previous night about all of my systems being hacked (as a test to join a hacktivism group) until I googled it and saw it's a pretty common bug and I just had to reboot.