How Scammers Can Hijack Your Account Without a Password or 2FA [practical]

[MisFoxie]

I know many of you already know about browser cookie sessions but still this is a reminder for those users who do not know much about cookie sessions.

In this thread I have shown how I logged into an account in another browser just through the cookie session without a password or 2FA, while the account was already logged in to another browser. If a scammer somehow gets your session cookie they can access your account just as easily as I did, post through the account and edit the forum profile information since no password is required there.

If they can access your account they will not access it just to show off. Of course they will use it for some illegal activities such as

• Using your earned reputation to take huge amount of loan.
• By checking your private messages they can identify who is close to you and scam them while stealing your identity.
• Since they can change your profile they can add a new signature and add a link to it for phishing or promote a scam platform.
• They can make posts to scam people which can damage your account's reputation.

How to protect your account:

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.
• Always avoid using untrusted scripts and never install untrusted browser extensions or software on your device.
• If you ever think someone else has accessed or might be able to access your session cookie, immediately log out of your account from that browser so that the cookie can no longer be used to access your account.

Here is some questions:

In what other ways can scammers steal browser session cookies?

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

And what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Should forums provide an option to revoke all active sessions remotely, view recent login activity or require reauthentication before changing sensitive profile information?

I will consider awarding merit to replies that provide useful information, technical insights or practical advice that benefits the community.

Note: Again browser cookie sessions are nothing new but I still made this thread just to remind those who don't know about them.

[_act_]

I do not know much about protecting my account than only me is using my device to access this forum. I always avoid malware which I think is helpful to some extent.

Other things that are important
Stake your bitcoin address. In case someone was able to compromise your Bitcointalk account.
Always check the IP logs often for suspicious IPs: https://bitcointalk.org/myips.php
I protect my gmail with 2FA.
You can use this forum 2FA also.

[Ashawowo(OS)]

In what other ways can scammers steal browser session cookies?

For now having access to your device and manually collecting the session data. I also got this from the net

* Intercepting cookies over unsecured Wi-Fi networks
* Using malware or spyware installed on your device
* Exploiting weaknesses in website security
* Guessing weak session IDs when security is poor

https://voxiant.com/session-hijacking-how-attackers-steal-your-online-access/

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

theymos already stated it here

. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

[Sandra_hakeem]

• If you ever think someone else has accessed or might be able to access your session cookie, immediately log out of your account from that browser so that the cookie can no longer be used to access your account.

Well, what happens when they're not close at the time when you begin to notice some weird changes? Just change your passwords mate, don't even think twice about it.

In what other ways can scammers steal browser session cookies?

Typoglycemia.

Aside from the ones you've exposed, and perhaps posing a fake proxy server between you and the original login page where, If not noticed, can convince you to type in your login details, I don't think there's any other way? There could be IDK.

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

Yes!

And what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Avoid clicking on malicious links, no matter how you might feel tempted to, maybe to carry out an investigation or anything else.

Should forums provide an option to revoke all active sessions remotely, view recent login activity or require reauthentication before changing sensitive profile information?

The forum does require reauthentication before changing sensitive informations. Maybe modlog has a list of login activities or you can find that on your profile information Account related settings. Emm, about the option to revoke sessions remotely, i guess you might just need to change your passwords when ever you feel unsafe.

[LoyceV]

How to protect your account:

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.
• Always avoid using untrusted scripts and never install untrusted browser extensions or software on your device.

Isn't this just common sense? I'm surprised by how easily people install userscripts on Bitcointalk, even from fairly new users. I've never installed a userscript, the small convenience isn't worth the additional risk.

In what other ways can scammers steal browser session cookies?

Old-fashioned brick-and-mortar burglary.

what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Don't run Windows

[DYING_S0UL]

I used to do something similar when I was into cracking (as a hobby), to watch series on Netflix/Amazon Prime without actually paying for it. (It's probably illigal right?)

So there we had this checker and the logs collected from certain cracking community/forum/TG groups. And when we fed that into the checker, it checks for valid cookie seesions. Then we take that cookie, load it into the cookie editor (an extension found in Chrome/Mozila store), and visit the targetted site. And there we were, watching movies.

So yeah, it seems the same concept applies here! Info stealer malwares steals your logs or you expose it some other ways (cookies, login credentials etc), and checks it's validity! And illigally takes over that session. 

Old-fashioned brick-and-mortar burglary.

Is there no way to prevent cookies from being used that way?

Like a countermeasure where the site actually checks whether the cookies being used originated from the same device/browser/system/IP address/environment?

Don't run Windows

Which distro are you using? Just being curious. 

[LoyceV]

Old-fashioned brick-and-mortar burglary.

Is there no way to prevent cookies from being used that way?

Encrypt your data.

Like a countermeasure where the site actually checks whether the cookies being used originated from the same device/browser/system/IP address/environment?

That would be very annoying on mobile, when my IP switches a lot.

Which distro are you using? Just being curious. 

I tend to switch once in a while. My suggestion: just try a few, and see what works for you.