Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Someone hacked my ebay / paypal and gmail. In gmail they added a rule to delete notifications from ebay / paypal. Then they proceeded to buy $5k worth of mac book airs over the last week. I just noticed because a vendor sent me an email to say thanks for buying so much. They were archiving the transactions in paypal and ebay so they didn’t show up in the default history views.

The scary part is I have 2-factor on gmail, so they must have remoted into one of my systems.

So far ebay and paypal have been very good and are supposedly proceeding to refund the money, but I’ll only believe it once it’s back in my account.

The only avenue I can think the culprits could have used was to remote into a system since I have two factor on gmail.

Could it have been a VNC server client I left on? It was the free version of Real VNC server, with no encryption and a two letter password. I forgot I had briefly opened the port to the internet, and never closed it.

The reason I suspect it is that I am careful with what I open on my systems and always have bitdefender running.

When I looked at the VNC event viewer, it was full of login attempts from unknown IPs. I assume they must have eventually cracked my two letter password and then google sync took care of the rest.

I feel like a moron.

But how likely is this to be how they got in? I know I'll never be able to be 100% sure, but I'm feeling frazzled, exposed and violated.

What else can I / should I do. I've reformatted every computer, requested new Credit Cards and renewed credit monitoring, but I fear there is something else I could do. I've also refreshed all my passwords.

share|improve this question
    
I would also check your router configs, or reset the router to make sure any port forwards they have setup have been cleared. After resetting your router, don't forget to change the default passwords ! –  Lawrence Jul 3 at 4:59
    
yes it may be due to realvnc it's according to the internet not that complicated to hack into realvnc hacking-tutorial.com/hacking-tutorial/… - but what i think may be the real problem is the design flaw behind openauth although you have 2factor auth on google/gmail it self it may be not that secure than you expect. Have you any other Social Accounts like youtube, facebook, twitter or even stackexchange ... where you use your google account to sign in (openauth)? if so maybe they get your gmail login credentials from there. –  konqui Jul 3 at 5:15
    
Did you use the same password for both the PayPal and Gmail account? Yes; A 2 character password was down right dumb. Yes; They could have logged into but unlikely. They likely comprmised you using traditional methods. –  Ramhound Jul 3 at 5:16
    
@konqui - How is it not secure? Do you know how the Google Authenticator even works? If they did access the vnc server, all they would have to do, is access the gmail account ( likely saved his passwords in his browser hence the reason thats a horrible idea ) and logged into the account that way. But thats a great deal of work just to access a paypal account. Hence the reason they likely just lucky. Best not to try to over think things and of course not do silly things like use 2 character passwords. –  Ramhound Jul 3 at 5:17

1 Answer 1

up vote 1 down vote accepted

Did you check your Gmail Location History? It provides IP address list from which your account was logged in.

Also have you logged into it from any street cafe/ free wi-fi points or sort of? It's an often place from which troubles can start.

My friend's gmail has been attacked and then hackers transferred all money from her bank account just by writing emails to the bank without personal or voice authorization. Just letting you know.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.