Total Takeover: Hacker Gains Full Control of Personal Account
Co-Authored By: Andrew King & Chad O’Sullivan
Ever since the beginning of COVID businesses have worked tirelessly to upgrade their Cyber Security tools, but for many people this has not translated into our personal lives. The truth is its easier to live without security controls, they can be hard to setup, tedious to work around and not always easily facilitated by 3rd party services, and so the question arises – why should we go out of our way to secure our personal accounts?
During a recent conversation with one of our clients – whose identity has been withheld for privacy – we uncovered a sobering answer to that question. This client experienced the nightmare of having their bank account compromised, their mobile number hijacked, and numerous other personal accounts taken over by cyber attackers, all due to a single account compromise. What unfolded should serve as a stark warning to anyone who thinks, “It could never happen to me.”
The Attack Begins
Now that we were in, we could assess the damage. Immediately, we found the inbox and deleted items were empty. However, the recovery tab of deleted items allowed us to restore all the emails deleted by the attacker.
At this point, you—like us—might think all is well and the job’s done. Unfortunately, after restoring the emails, we found the real damage.
The Real Impact
Worse, there was a request to have their mobile number transferred to a new provider and their bank details changed. Both companies requested identity documents to confirm the request—and the attackers were able to satisfy this using a photo of the user’s passport stored in an old email.
The Fallout
- Accessed third-party accounts such as Amazon, Facebook, and a home loan account.
- Accessed the users bank account and made thousands of dollars worth of transactions.
- Successfully initiated a transfer of the users mobile number to their own provider.
- Sent hundreds of spam emails from the user’s account, resulting in the email being blacklisted on anti-spam lists.
Lessons Learnt
Events like this serve to not only break that bias but also teach us lessons on what to do better. So, I’d like all readers to review the below list of questions based on our lessons learned and take the time to do a self-assessment of their personal security:
-
Is my password complex?
- Between password cracking algorithms, leaks, and educated guesses, it’s no longer safe to use simple passwords. In this instance, the user’s password was a name, date, and special character.
- Our recommendation: use a passphrase—multiple words joined with a randomly chosen special character.
- For more information, follow the US Government’s guide:
👉 https://www.cyber.gov.au/protect-yourself/securing-your-accounts/passphrases/creating-strong-passphrases - Also, use different passwords for each service. If you struggle to manage them, invest in a secure password manager like Bitwarden, LastPass, or any other vendor of your choice.
-
Do I use strong Multifactor Authentication (MFA)?
- In this case, MFA was not enabled for the user’s email, removing a critical barrier from the attacker’s path.
- Most third-party services allow email to be your primary MFA type, which means once your email is compromised, so is everything else.
- Our recommendation: use an Authenticator App on your phone for everything. This means if they don’t have your phone, they can’t access your accounts—and if they do, they’ll still need your PIN, fingerprint, or face.
-
What data is kept in this service?
- As mentioned above, the user’s bank and mobile service were manipulated using an old passport photo stored in their emails.
- Best practice: delete any unneeded sensitive data and prepare for the worst.
These checks aren’t exhaustive, but they’re a huge leap forward in personal security and help break that bias. Start with your email account, then check your services in order of priority—financial, messaging, social media, and so on.
