How Scammers Can Hijack Your Account Without a Password or 2FA [practical]

[Lucano]

Ignoring all scripts and clearing cache and cookies once a week is my way of keeping my privacy safe.
We don't know what's installed on a website, so prevention is a priority.

[SamReomo]

• Never share your browser cookies with anyone and if you ever log in to your account on someone else's device log out from there as soon as you finish your work.

I think no body in their right mind share browser cookies with anyone, and someone who knows the importance of privacy will never log in to their accounts from someone else's device because such a thing can be very risky. The hackers often convince others to install software and via those software they steal cookies of someone. So that's why one should trust no one and one should never install any software or extension or any kind of user script that is not open source. Otherwise the consequences can be very bad.

[LoyceV]

Aren't sessions tied to IP? I'm not sure how Bitcointalk handles it's sessions but for some sites the session could automatically become invalid if it's coming from another IP. I'm guessing Bitcointalk handles it the same way because of I'm using Tor  for instance and I change my circuit I automatically get logged out.

I use "Always stay logged in:" when logging in, and changing IP-address doesn't log me out.

<A long list of different IPv6 addresses>

[Mia Chloe]

I use "Always stay logged in:" when logging in, and changing IP-address doesn't log me out.

<A long list of different IPv6 addresses>

I don't know if it is settings related but that has actually been my experience with Tor. Anyways I just noticed something kinda weird on my IP log history when I checked it just now. The forum marked some IP logs as tor and a few were recognised and registered  the normal way.

Well I'm curious how the forum is able to tell I'm using Tor at some point and why it's not able to register some of the visits via tor as tor visits.

[LoyceV]

I don't know if it is settings related but that has actually been my experience with Tor.

It could be just your Tor browser settings, designed for privacy. Do other sites also log you out when switching IPs?

The forum marked some IP logs as tor and a few were recognised and registered  the normal way.
Well I'm curious how the forum is able to tell I'm using Tor at some point and why it's not able to register some of the visits via tor as tor visits.

I assume the forum's myips.php uses a geolocation service to get this data. I guess it doesn't know all (new) Tor exit nodes (yet).

[Mia Chloe]

It could be just your Tor browser settings, designed for privacy. Do other sites also log you out when switching IPs?

Yeah they actually do regardless of the site most cases whether it is a bitcointalk or altcoinstalks I'll get logged out immediately I change my server or I reroute. Infact most times I'm always very careful to make sure that I don't accidentally close my current tab else I'll have to re-login again.

I assume the forum's myips.php uses a geolocation service to get this data. I guess it doesn't know all (new) Tor exit nodes (yet).

So basically the forum actually tries to keep record of which of the IP addresses pop up more frequently than the others and mark that as original?

[Supreme Donvic]

Some people also share a computer with their family and children; perhaps friends also have access. I speak so confidently because I see my friends allowing their children to play games on the computer or watch cartoons. The problem may be that the child unknowingly installs something, and there may be a virus or RAT in this "something" that will later gain access to the computer.

True and that is the way some people get hacked without knowing, in terms of your family members using your computer's or phone is very wrong and should not be allowed, when it comes to children, I know sometimes we try to pamper them and make them happy and because of that we give them our computers or phones to use, but it will be better that you buy a computer or a phone for them so they won't disturb you with yours and make sure you download a lot of games and cartoon movies on it and try not to have all those in your system.
We need to take our systems as a personal stuff it's very important.

[Basels]

I think most forum users are relatively safe from hackers because the incentive for the hacker is quite low, unlike when the target is a high-value business. Many of us don't ven log out from the forum in our devices. The effect is that lost devices could give another person complete access to our forum account. Also, there are users that save their passwords in browsers, making it easy for anyone to log into our accounts. We should be grate ful that highly skilled hackers are not intereswted in forum accounts. Otherwise, I doubt that there is a forum account that cannot be compromised.

I think one step that could ensure that this rarely happens is making 2FA a compulsory path to routine logins.

[LoyceV]

So basically the forum actually tries to keep record of which of the IP addresses pop up more frequently than the others and mark that as original?

If that's what you got from my post: I don't think so. The forum just lists all IPs it registered at "myips".

I think most forum users are relatively safe from hackers because the incentive for the hacker is quite low

We've seen countless accounts hacked, and many scammers who scam for any amount they can.

[MisFoxie]

I used to do something similar when I was into cracking (as a hobby), to watch series on Netflix/Amazon Prime without actually paying for it. (It's probably illigal right?)

Actually I can't say whether using someone else's cookies is legal or illegal but since nobody was harmed because you used them we can't blame you. I know you're not a hacker so someone must have given you those cookies.

I'm thinking what if the people who collected these cookies also collect cookies from the Bitcointalk forum in the same way (I don't know how they collected them maybe the previous method no longer works).

Our biggest problem is that we always log in to the Bitcointalk forum with the 'Always stay logged in' option checked. Because of this if we forget to log out the account stays logged in on that browser forever. If we log in by selecting a specific time period instead I think we will never face this kind of problem.

[DYING_S0UL]

I used to do something similar when I was into cracking (as a hobby), to watch series on Netflix/Amazon Prime without actually paying for it. (It's probably illigal right?)

Actually I can't say whether using someone else's cookies is legal or illegal but since nobody was harmed because you used them we can't blame you. I know you're not a hacker so someone must have given you those cookies.

I'm thinking what if the people who collected these cookies also collect cookies from the Bitcointalk forum in the same way (I don't know how they collected them maybe the previous method no longer works).

Our biggest problem is that we always log in to the Bitcointalk forum with the 'Always stay logged in' option checked. Because of this if we forget to log out the account stays logged in on that browser forever. If we log in by selecting a specific time period instead I think we will never face this kind of problem.

Yes, no harm was done, I only watched a few movies without disturbing anyone!  

As for the logs that's a mystery for me as well, I don't know the process. But there are many telegram groups, certain commuity or forum where these logs can be found. Most of the juicy stuffs are paid though. And they charge good amounts for these leaked data.

Forever isn't literally forever you know! it's 3153600 minutes (or hours, can't remember exactly which). That's already a long time, but it's not forever. You cookie session would always expire (eventually afaik).

Try to login with wrong credentials but make sure to tick the "Stay Logged In" box, you'll see 3153600.

[MisFoxie]

Forever isn't literally forever you know! it's 3153600 minutes (or hours, can't remember exactly which). That's already a long time, but it's not forever. You cookie session would always expire (eventually afaik).

Try to login with wrong credentials but make sure to tick the "Stay Logged In" box, you'll see 3153600.

Basically if we keep this "Stay Logged In" box checked it stays logged in for almost 6 years. now I understand why the cookies I set in my scraper haven't caused any problems even after almost 3 months.

I think most forum users are relatively safe from hackers because the incentive for the hacker is quite low, 
-snip-
I think one step that could ensure that this rarely happens is making 2FA a compulsory path to routine logins.

Your assumption is wrong because we constantly see many accounts getting hacked. I think hackers collect usernames, passwords or email addresses from a large number of Bitcointalk forum accounts and perhaps sell this data on the dark market to make huge profits. I don't know how they do this. However in this situation 2FA would definitely work very well.

[Mia Chloe]

I think one step that could ensure that this rarely happens is making 2FA a compulsory path to routine logins.

Making 2FA. compulsory is crap if you ask me. It's very ok as an optional stuff not something you are compelled to do. If you follow good security measures and habits you are literally as safe as someone using 2FA besides the captcha on the login page already prevents your password from getting brute forced.

The major stuff I'll ask to prevent is logging in on public computers and using public WiFi frequently because that's where most security vulnerabilities are being exploited.

[NotFuzzyWarm]

Any site that requires 2-factor auth should always accept both normal 2FA (which really is *not* that secure but is better than none) and the far better choice of using hardware keys like Yubikey. Many sites do not give the option of using a HW key. Using hardware keys forces creating a new cookie that always checks for the key to be plugged in nullifying the risk of a stolen 2FA cookie issue.

[philipma1957]

Any site that requires 2-factor auth should always accept both normal 2FA (which really is *not* that secure but is better than none) and the far better choice of using hardware keys like Yubikey. Many sites do not give the option of using a HW key. Using hardware keys forces creating a new cookie that always checks for the key to be plugged in nullifying the risk of a stolen 2FA cookie issue.

yeah Yubi keys stop most everything but the 5 dollar wrench attack

[SamReomo]

Your assumption is wrong because we constantly see many accounts getting hacked. I think hackers collect usernames, passwords or email addresses from a large number of Bitcointalk forum accounts and perhaps sell this data on the dark market to make huge profits.

Most of the account sales you see aren't because someone hacked those accounts but those were mostly created by the farmers when merit system wasn't introduced. The hackers won't be able to make any profit from account sales whatsoever, they could make tens or hundreds of thousands dollars by selling the whole database. The hackers don't have time to sell single accounts as they're in hurry to make huge amounts by selling the all users data if they somehow manage hack the forum.

[lovesmayfamilis]

Your assumption is wrong because we constantly see many accounts getting hacked. I think hackers collect usernames, passwords or email addresses from a large number of Bitcointalk forum accounts and perhaps sell this data on the dark market to make huge profits.

Most of the account sales you see aren't because someone hacked those accounts but those were mostly created by the farmers when merit system wasn't introduced. The hackers won't be able to make any profit from account sales whatsoever, they could make tens or hundreds of thousands dollars by selling the whole database. The hackers don't have time to sell single accounts as they're in hurry to make huge amounts by selling the all users data if they somehow manage hack the forum.

Well, you're kind of "idealizing" hackers here, putting them in the place of the almighty and assigning them the same level of knowledge. It is enough for someone to send a phishing link and get into an account that will later be sold for pennies, while someone needs to hunt for a larger "fish" to take out a loan or deceive even more people later. Yes, we are already "literate" in this regard on the forum, but there are other places, and there are always those who want to call themselves hackers, but at the same time they are content with "crumbs."

[Z_MBFM]

How to protect your account:

Add some points.
1. Never save passwords in your browser or someone else. If you log in to someone else's device, clear the browser history for the time you used their browser after logging out of their account.
2. Verify the source before installing any application on your device.
3. Be careful when connecting to public WiFi. Avoid if possible
4. If someone sends you a link via PM, verify that it is not a phishing link before clicking on it. Especially if it is a newbie PM. If necessary, turn off the option in your settings so that the newbie can't send you pm
5. Set a Secret Question on your account.
6. Hide email address from public
7. Always keep the first Bitcoin address used in the account safe and do not lose it. Because even if your account is hacked, you can easily recover it through this address.

If the password of a Bitcointalk account is changed are all existing login sessions automatically invalidated?

Yes, changing your password will definitely log you out of other devices.

But another interesting thing is that you can log out of other devices without changing your password. The thing is, if you log out of your account from one logged-in device, then your account will be logged out from all other devices.

Example
Device 1 - Logged in
Device 2 - Logged in
Device 3 - Logged in

If you log out of your account from any one device here, account will be logged out from all other devices instantly.

Should forums provide an option to revoke all active sessions remotely, view recent login activity or require reauthentication before changing sensitive profile information?

https://bitcointalk.org/myips.php
From here you can see from which IP your account is being used. The location will be written there, but you can also copy the IP address and see the details through various third-party platforms. If you suspect that the IP shown is not yours, you can change the password for the security of the account and of course always keep 2FA on

[LoyceV]

1. Never save passwords in your browser or someone else.

I'd go crazy without this!

If you log in to someone else's device

Just don't do this. Bring your own laptop if you need it on the road.

5. Set a Secret Question on your account.

This only gives someone who knows the answer the possibility to lock your account. This feature is useless on Bitcointalk, and a social engineering risk on many other sites.

[Catenaccio]

1. Never save passwords in your browser or someone else.

Even it is my own phones or laptops or computers, I don't save my passwords in browsers. They can have default notification to ask you whether you want to save the account password every time you log in your accounts, but let's skip this step and never accept it.

If you log in to someone else's device, clear the browser history for the time you used their browser after logging out of their account.

I don't feel the need of logging in my accounts on devices of the other people, it's too risky for my account security and privacy.

If people can feel they can do that with accounts, perhaps they will feel comfortably to do the same with Bitcoin or cryptocurrency wallets, and it will lead to nightmare and fund loss.

2. Verify the source before installing any application on your device.

Always visit official sites, get download links there, but remember to verify digital signature if you can technically do that.