4 ms·
I guess I'll share in this thread. ---1--- I have a OnePlus 6T with the stock ROM exclusively for my British phone number. On the 25th of December, someone fr
by jotm 7y ago
I guess I'll share in this thread.
---1---
I have a OnePlus 6T with the stock ROM exclusively for my British phone number. On the 25th of December, someone from Canada logged into the GMail account used on that phone, from a OnePlus 3T.
The password was one randomly generated in KeePass (all of them are except for useless websites). They managed to change the password to the account, but seemingly nothing else, so that's just weird.
I received the notification on my other email, and recovered the account, reset the password, replaced with a new one.
---2---
Last week, I opened up a laptop I use for storage (3 drives fit inside, perfect for backups) and noticed a network drive with a Chinese name. It disappeared when I clicked on it. The laptop is always on connected to my router and to a VPN server.
Now I need to completely wipe the phone, root and use a custom ROM, as well as wipe the laptop (and two other computers?), upgrade OpenWRT on the router and change all of the passwords I guess. Yes, I still haven't done it heh.
---
----------->I am curious about your comments on this.<-----------
---
Never had anything really suspicious like this actually happen to me.
I don't even have anything good/useful on my devices, except a Keepass database with passwords to all bank accounts/emails/etc. If that's been opened, I'm a bit fucked, but I'd be receiving notifications on my phone and other emails.
- therealmocker 7y agoSounds like maybe a SIM swap attack? In addition to password changes I would look into Google's advanced protection program (https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/) and get U2F or FIDO2 setup on your account.
- ColanR 7y agoI would assume that whoever that was now has a copy of your keepass database. However, it may be that your computer was simply added to a botnet, in which case the harm done to you personally may be minimal.
- whatactuallywat 7y agoWhy are you under the impression that accessing your KP database is guaranteed to alert you. I can't imagine how that could possibly be true without the master key being stored in some service running somewhere and you're notified when it's used. Which, well, would explain how your key was compromised. Otherwise it seems highly misleading to assume that no email = no compromise. Doesn't really matter though, it would've been mitigated by not keeping the KP database decrypted at rest or by using 2FA. Both of which are SOP for hardware token users. For real, at this point if you don't have a yubi/nitrokey on your keychain, I assume you just don't care about actual account security.