Sketchy activity detected last night
24 2016-12-01 by incognito_truth
Last night my Google account informed me that someone in the Washington, D.C area has my password and tried to log into my account. Should I be worried or is this a normal occurrence? Edit: I took a picture of this activity, but I don't know how to post as this is my first reddit post.
29 comments
16 M1GHTYEAGLE 2016-12-01
My acct. was hacked shortly before r/Pizzagate was shut down; funny thing is my acct's are monitored BY an FBI security contractor (I have a gov't job so since all gov't employees details were hacked a year ago they now give out free cyber security), so basically I was informed by the FBI that the FBI had hacked into my personal acct. and that I should consider changing my password, haha
5 Itmustjustbeme 2016-12-01
Best thing I ever read.
4 incognito_truth 2016-12-01
lol that's too funny, but your saying that if you work for the govt. your not safe so in terms no one is safe.
5 M1GHTYEAGLE 2016-12-01
Yep, no one is safe. It's been suggested that TOR uses intelligence servers to bounce off of, and most encryption software is developed by the CIA and such. So really our only hope at the moment IMFO is to overload them with data.
Edit: For instance But basically the idea is to insert flagged language and searchable words in everyday language, perhaps even redefine their meanings via slang.
4 CredAndBercuses 2016-12-01
Don't forget who invented the internet! DARPA! I too have heard that a good 80%+ of Tor exit nodes are compromised.
1 [deleted] 2016-12-01
How can other govt employees get this?
2 M1GHTYEAGLE 2016-12-01
You would've gotten the option to sign up about a year ago from "myIDcare" if you held a position that was effected or could be effected by hacking.
4 Majnum 2016-12-01
Yesterday they publish about the hacking of more than a 1M accounts. For that reason is better to activate the two steps authentication process
3 incognito_truth 2016-12-01
http://imgur.com/a/KXefR
edit: This is the picture of the ip address.
1 BigPharmaSucks 2016-12-01
Ip address showing as hotel in California from google search results
3 incognito_truth 2016-12-01
Ya I looked it up too, but why is it telling me from Washington, D.C?
2 fat_osvaldo 2016-12-01
VPN?
Fake email possibly?
2 CredAndBercuses 2016-12-01
This is a possible explanation, especially if the email has a "click here to reset your password" link... and if that link makes you type your current password (which it then steals).
2 fat_osvaldo 2016-12-01
Really popular phishing method, my company gets them all the time.
1 Basilthebatlord 2016-12-01
It wouldn't be a VPN, when you connect to a VPN, your entire public IP is different. If it were the same address, there would be no point in having a VPN.
2 CredAndBercuses 2016-12-01
Nothing from MXtools' reverse IP lookup.
Interesting that it's a hotel, wouldn't expect them to have compromised servers acting as VPNs/proxies. Unless someone was hacking from their room?
With a mac address spoofer that's pretty untraceable since the hotel can't be expected to respond to that activity within the timeframe of the stay, and they anyways they can't see specifically which room was using the WiFi, just which AP (corresponding to what area of the hotel they were in).
1 mik0r 2016-12-01
The IP block owned by Hilton Hotel Group is registered to their Operations HQ in Beverly Hills, CA:
ARIN Lookup Info
This is why a whois of the IP shows you the CA address. Image related:
HHOpsHQ
The IP addresses for each hotel location within the region are distributed by ARIN to Hilton Ops HQ in Beverly Hills, and from there HHOps distributes them to the various hotel locations internally. This is why relying strictly on geoip lookup tools also fails and shows only CA.
When Google does their calculation, they rely on additional data, including browser information, wifi and gps-based (if on a mobile device) location estimations that they calculate, and additional pieces of data which are almost guaranteed to be more accurate than the geoip results.
In this instance, it implies that the location of the login was a Hilton Hotel in Washington, DC or in close proximity to Washington, DC. Have you recently stayed in any in that area? Or did you stay near one, use one's wifi in passing, etc? If you stayed at one, did you use one of the business center shared computers and forget to logout?
If you didn't stay there but were in the vicinity and used their wifi, its possible someone could've intercepted your credentials. Or, if you didn't, its possible they gained the credentials via another method and were simply staying at a HHG hotel in DC when they tried to check the validity of your credentials...
As you can see, lots of possibilities here. :)
3 Phlangston 2016-12-01
Someone tried to get into mine two days ago..
2 highclasshole 2016-12-01
2 CredAndBercuses 2016-12-01
Whew, I managed to dodge this one! ZoneAlarm is absolute shit though, would not recommend.
TBQH I can't recommend any free antivirus software, they usually act more like viruses. Popups telling you to buy more shit, like "PC tuner" software claimed to speed up your computer when really all it does is delete your cache and clear your cookies.
Best to just reformat every once in a while, and only sanitize the data you transfer to the new install.
1 Phlangston 2016-12-01
Thank you! I've got a Macbook and I'm an Iphone user so it's still a little frightening, haha.
2 highclasshole 2016-12-01
1 Million Android users were infected which leaked their gmail
use https://gooligan.checkpoint.com/ to see if you've been breached
http://money.cnn.com/2016/11/30/technology/android-phones-infected/index.html
2 babaroga73 2016-12-01
And how safe is this checkpoint site ?
2 fingerbang_fun 2016-12-01
Exactly
2 thetruthful 2016-12-01
I'm wondering why I would need a third party site rather than just having google tell me themselves.
2 CredAndBercuses 2016-12-01
Well apparently they will tell you if someone tries to log in from a new location. But they're not going to publicly advertise that they're compromised if they don't have to. It's only when leaks go public (think Sony, Dropbox, Myspace) that apologies are made.
The news article says the Gooligan campaign doesn't have access to passwords, just "tokens" that primarily let them rate up "legitimate" apps on the Play Store under your name.
1 CredAndBercuses 2016-12-01
Well it's not like it's asking for your password, too. I assume it operates similarly to http://haveibeenpwned.com in that it has access to the leaked data but only in a sanitized version which doesn't have the password hashes associated with each account.
1 highclasshole 2016-12-01
Its to check if your email credentials have leaked, you just put in your email, it doesn't scan your device
1 CredAndBercuses 2016-12-01
Interesting. I'll look into the IP for you in a sec.
My phone rebooted itself 2 days ago, and then wouldn't accept my pattern to unlock it, said "invalid pattern". I was flipping my shit 'cause I had just had a vivid dream the previous night about all of my systems being hacked (as a test to join a hacktivism group) until I googled it and saw it's a pretty common bug and I just had to reboot.