How Scammers Can Hijack Your Account Without a Password or 2FA [practical]

[MisFoxie]

I know many of you already know about browser cookie sessions but still this is a reminder for those users who do not know much about cookie sessions.

In this thread I have shown how I logged into an account in another browser just through the cookie session without a password or 2FA, while the account was already logged in to another browser. If a scammer somehow gets your session cookie they can access your account just as easily as I did, post through the account and edit the forum profile information since no password is required there.

If they can access your account they will not access it just to show off. Of course they will use it for some illegal activities such as

• Using your earned reputation to take huge amount of loan.
• By checking your private messages they can identify who is close to you and scam them while stealing your identity.
• Since they can change your profile they can add a new signature and add a link to it for phishing or promote a scam platform.
• They can make posts to scam people which can damage your account's reputation.

How to protect your account:

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.
• Always avoid using untrusted scripts and never install untrusted browser extensions or software on your device.
• If you ever think someone else has accessed or might be able to access your session cookie, immediately log out of your account from that browser so that the cookie can no longer be used to access your account.

Here is some questions:

In what other ways can scammers steal browser session cookies?

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

And what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Should forums provide an option to revoke all active sessions remotely, view recent login activity or require reauthentication before changing sensitive profile information?

I will consider awarding merit to replies that provide useful information, technical insights or practical advice that benefits the community.

Note: Again browser cookie sessions are nothing new but I still made this thread just to remind those who don't know about them.

[_act_]

I do not know much about protecting my account than only me is using my device to access this forum. I always avoid malware which I think is helpful to some extent.

Other things that are important
Stake your bitcoin address. In case someone was able to compromise your Bitcointalk account.
Always check the IP logs often for suspicious IPs: https://bitcointalk.org/myips.php
I protect my gmail with 2FA.
You can use this forum 2FA also.

[Ashawowo(OS)]

In what other ways can scammers steal browser session cookies?

For now having access to your device and manually collecting the session data. I also got this from the net

* Intercepting cookies over unsecured Wi-Fi networks
* Using malware or spyware installed on your device
* Exploiting weaknesses in website security
* Guessing weak session IDs when security is poor

https://voxiant.com/session-hijacking-how-attackers-steal-your-online-access/

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

theymos already stated it here

. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

[Sandra_hakeem]

• If you ever think someone else has accessed or might be able to access your session cookie, immediately log out of your account from that browser so that the cookie can no longer be used to access your account.

Well, what happens when they're not close at the time when you begin to notice some weird changes? Just change your passwords mate, don't even think twice about it.

In what other ways can scammers steal browser session cookies?

Typoglycemia.

Aside from the ones you've exposed, and perhaps posing a fake proxy server between you and the original login page where, If not noticed, can convince you to type in your login details, I don't think there's any other way? There could be IDK.

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

Yes!

And what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Avoid clicking on malicious links, no matter how you might feel tempted to, maybe to carry out an investigation or anything else.

Should forums provide an option to revoke all active sessions remotely, view recent login activity or require reauthentication before changing sensitive profile information?

The forum does require reauthentication before changing sensitive informations. Maybe modlog has a list of login activities or you can find that on your profile information Account related settings. Emm, about the option to revoke sessions remotely, i guess you might just need to change your passwords when ever you feel unsafe.

[LoyceV]

How to protect your account:

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.
• Always avoid using untrusted scripts and never install untrusted browser extensions or software on your device.

Isn't this just common sense? I'm surprised by how easily people install userscripts on Bitcointalk, even from fairly new users. I've never installed a userscript, the small convenience isn't worth the additional risk.

In what other ways can scammers steal browser session cookies?

Old-fashioned brick-and-mortar burglary.

what other security measures do you recommend to protect a Bitcointalk account from being compromised and abused by scammers?

Don't run Windows

[DYING_S0UL]

I used to do something similar when I was into cracking (as a hobby), to watch series on Netflix/Amazon Prime without actually paying for it. (It's probably illigal right?)

So there we had this checker and the logs collected from certain cracking community/forum/TG groups. And when we fed that into the checker, it checks for valid cookie seesions. Then we take that cookie, load it into the cookie editor (an extension found in Chrome/Mozila store), and visit the targetted site. And there we were, watching movies.

So yeah, it seems the same concept applies here! Info stealer malwares steals your logs or you expose it some other ways (cookies, login credentials etc), and checks it's validity! And illigally takes over that session. 

Old-fashioned brick-and-mortar burglary.

Is there no way to prevent cookies from being used that way?

Like a countermeasure where the site actually checks whether the cookies being used originated from the same device/browser/system/IP address/environment?

Don't run Windows

Which distro are you using? Just being curious. 

[LoyceV]

Old-fashioned brick-and-mortar burglary.

Is there no way to prevent cookies from being used that way?

Encrypt your data.

Like a countermeasure where the site actually checks whether the cookies being used originated from the same device/browser/system/IP address/environment?

That would be very annoying on mobile, when my IP switches a lot.

Which distro are you using? Just being curious. 

I tend to switch once in a while. My suggestion: just try a few, and see what works for you.

[DYING_S0UL]

Encrypt your data.

Ok noted!

That would be very annoying on mobile, when my IP switches a lot.

I totally forgot about this one. But there are other fingerprints, right? To identify a device!
Ignoring the IP switching, we can look at device info, time, location and maybe like browser or operating system information...

How about device bound sessions? Will that work? Afaik, even if attacker steals the cookies, he still needs a private key! CMIIW anywhere!

I tend to switch once in a while. My suggestion: just try a few, and see what works for you.

Always wanted to try Arch! No idea why people keep saying I use Arch BTW! So far, I have tested, Mint, Ubuntu, RedHat, Kali Linux, Manjaro, Zorin and lastly Garuda.

Imo, Linux distros are a maza! Once you enter it's realm there is no going back, you keep on jumping from one flavour to another! This is exactly what happens with me!

[LoyceV]

I totally forgot about this one. But there are other fingerprints, right? To identify a device!

This comes to mind:

A year or two ago I was researching fingerprinting techniques that'd work against pretty much anyone with JavaScript enabled, and I found several promising leads on that front. But then it occurred to me that I don't really want bitcointalk.org to be known as the #1 forum on the leading edge of de-anonymization technology, so I stopped pursuing it seriously...

(quote taken out of context, but I think it still applies here)

How about device bound sessions? Will that work? Afaik, even if attacker steals the cookies, he still needs a private key!

My scraper logs in by using a saved cookie. I like it that way, it's not a feature to disable.

Imo, Linux distros are a maza! Once you enter it's realm there is no going back, you keep on jumping from one flavour to another!

It's freedom, I like it

[Comeacross]

Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work

I find this incredible. How dumb do you have to be to login your account on someone's else device and not log out after your activity? How does it even make sense for someone to finish what they're doing and walk away leaving their account logged in in another person's device? This is not even about Bitcointalk but to me it's unethical to leave your session active on someone's else device even if you don't don't have anything to hide.

If you are that careless, you should never use other people's device to log in. It's as simple as that.

[LoyceV]

How dumb do you have to be to login your account on someone's else device and not log out after your activity?

I know it's quite common for many people to use their account on someone else's computer, but it's something I never do. The good thing from using a strong password and a password manager is that I don't even know my password, so I wouldn't be able to do this.

I don't trust computers that aren't mine. I'd assume there's a keylogger running, so .ogging out isn't even going to help.
If you really need to use a computer on the road: get a small and cheap 1 kg second hand business laptop, wipe it, install Linux, and just bring your own device.

[Lucius]

My way of using the forum (and everything else online) is to log in only on my computer, which I consider to be quite safe considering that I don't use it for any activities that could result in virus/malware infections. Additionally, I have a very good AV, firewall and MB Premium as protection if at some point I am not aware of the danger.

After each use of the forum and surfing in general, I delete all cookies, browsing history, etc.

[lovesmayfamilis]

Some people also share a computer with their family and children; perhaps friends also have access. I speak so confidently because I see my friends allowing their children to play games on the computer or watch cartoons. The problem may be that the child unknowingly installs something, and there may be a virus or RAT in this "something" that will later gain access to the computer.

Any browser has such a feature - to clear all cookies and all history after closing. This is very convenient where the device is shared by everyone.

Always wanted to try Arch! No idea why people keep saying I use Arch BTW! So far, I have tested, Mint, Ubuntu, RedHat, Kali Linux, Manjaro, Zorin and lastly Garuda.

I also love Linux very much, and if we talk about Arch, then CachyOS is quite convenient for those who just want to get to know it.

[LoyceV]

Some people also share a computer with their family and children; perhaps friends also have access. I speak so confidently because I see my friends allowing their children to play games on the computer or watch cartoons. The problem may be that the child unknowingly installs something, and there may be a virus or RAT in this "something" that will later gain access to the computer.

That's what user accounts are for If someone uses my computer, it's trivial to create a new account for them. And they won't be able to install anything system-wide.

[dkbit98]

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.

I don't know why anyone would ever think of sharing their cookies with other people, unless they just don't care.
You can easily change settings in your web browser to delete everything including cookies when all browser windows are closed.
To login it is better to use external open source password manager, instead of built-in browser save password option.

[Dunamisx]

How dumb do you have to be to login your account on someone's else device and not log out after your activity?

The best safety measure is to first avoid using someone's device to login the forum, another risk you may not know we have already been subjected to by doing this act of using someone else's device is that, even after you think you have logged out, the browser used might have saved your login details and suggested it to the user the next time they wanted to login the forum after you might have left, this is why it is more better to be extra careful by not using anyone's device or allow someone to have it using your own as well.

[un_rank]

That's what user accounts are for If someone uses my computer, it's trivial to create a new account for them. And they won't be able to install anything system-wide.

People are most times high trusting with people they share a close relarionship with. If it's not their banking app details and a few others, any other data does not compromise them and shouldn't be protected. We all use the same netfilx account, when can share a user account on a computer with no issues 

It is important for people to know privacy is not entirely about distrust, you will just prefer to be the only one responsible for your data and security. A mistake from someone else shouldn't cost you. And yes, do not trust still, always verify.

- Jay -

[LoyceV]

People are most times high trusting with people they share a close relarionship with.

Trusting a human doesn't mean I'm trusting their devices

[Boy_chef]

Is it possible to get hacked by simply sharing the same Internet connection, like, let's say mobile hotspot or wifi?

I know so many persons that would use their computers to connect to a public wifi for the cost of saving cash for Internet subscription because it's crazy over here.

[Mia Chloe]

~snip

Aren't sessions tied to IP? I'm not sure how Bitcointalk handles it's sessions but for some sites the session could automatically become invalid if it's coming from another IP. I'm guessing Bitcointalk handles it the same way because of I'm using Tor  for instance and I change my circuit I automatically get logged out.

Changing your circuit on tor totally re-routes your IP and that changes the final IP that the site seems on their end so it's basically the same case.