hacking through wifi?

[arcticcs]

Hi,

Long story but will make it short.

My gf, her flatmates and I have had our gmail account hacked. She got a warning saying someone changed the password on her account but was able to revert this yesterday. I checked on device history on gmail and there was a new device associated to her gmail account using the IP adress of her home. Also her facebook account got deactivated.

I got a similar experience after connecting to her wifi, this time a new device was associated to my account with an IP adress from Indonesia. I was able to change my password for gmail and facebook.

We called the internet provider which only told us to change the wifi password (it is the same as originally, so a very complicated password composed of letters and numbers).

So far, internet is off and we are scared to put it back on. I have no idea what happened.

Could it be a virus ? Have they hacked her internet connection? How is it possible that after using her wifi for a short time this morning, I got hacked? So many questions to understand better what have happened, and to be able to secure better our internet use...

Thank you for reading
Thomas

 

[COLGeek]

Have you scanned all connected systems for malware and viruses? Also, have you changed both the administrator password on the router itself, as well as securing the wireless network with a complex passphrase using WPA encryption? Also, on your router, do you have a "whitelist" of the MAC addresses that are allowed to connect to the network (all others not allowed to connect)?

 

[plaintuts]

Thru wifi no.

Internet yes, some websites have tracking cookies or somehow tricked you in installing software with elevated privileges to track your online traffic.

Or someone is mad at your girlfriend

 

[boosted1g]

If you are using WEP encryption or WPS then these are very easily hackable.
FYI WPS is the button some routers and devices have to allow you to connect two devices without the just horrifically complicated step of knowing the network name and a password. This feature is so easy to hack you can get smartphone apps for it to almost instantly hack it for you.

If you have WPS disabled (or router does not have it), and are using WPA1 or WPA2 encryption then it is almost un-hackable, and anyone with the knowledge resources is not going to care about a gmail or facebook account that's for sure


Now with all of that said, even if they hacked into your wifi and watched your data packets, your login to gmail is encrypted so they would not be able to just get in.

What is much more likely is that there is malware on her network.

 

[arcticcs]

Thank you all,

COLGeek, that's the next step we will take when we turn the router back on.

I thought as well that this might have been caused by a virus. I have scanned my computer with avast and malware bytes and they found nothing. However, I suspect my girlfriend's computer to be infected. We will save her data and re-install it clean.

The thing I find weird and don't understand is how I got my gmail account and facebook account hacked only by surfing on the web through her wifi this morning? Yes they are encrypted so I don't get it. Maybe it's because I tick the boxes "keep me logged in"?

They use WPA for their router. I don't really understand what you mean by a malware on her network. I'd expect her to have a malware on her computer but could it infect other computers using the same network? Is that what you mean?

Thanks again!

 

[boosted1g]

Yes, I mean a malware program on a computer that can spread over the network.

Make sure if the router has WPS button that you disable it in the settings.

 

[arcticcs]

Thanks again.

We changed the name of the router, changed the password and actived the mac adress system so only computers allowed will be able to connect.
I have looked into this WPS thing and it looks that it can't be disabled in the settings on the router. I've looked on the provider's website and it is said it can't be disabled. So I hope what we did will be enough.

Thank you

 

[boosted1g]

The mac address filter will circumvent the security flaw of WPS. Even though they will be able to hack around the password, the router will not grant them a connection with a MAC that was not added.

Now of course none of this matters if it is an "inside job"

 

[arcticcs]

Oh that's great ! Thanks
Sorry, but what do you mean with "inside job"? Do you mean a malware can go around all this?

 

[boosted1g]

You said she has flatmates, I don't know anything to accuse anyone of anything, just stating that if the one of the flatmates was doing it and you whitelisted the MAC for their computer then they can still do all the same stuff.

 

[arcticcs]

Ok, yeah, I see what you mean, but it really isn't the case here.
Thanks for your help,
good evening