My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2018-08-06T10:11:22+00:00

    worth checking the dates, in my case I was lying on a beach so unless my corporate laptop which was hibernating in a desk drawer at home decided to wake up, sync only my personal email and not my corporate account and is now unable to auto-synch because I changed the password but is happy to log into MS directly (because I put the new password in to write this) then I can say it definitely isn't due to corporate VPN in my case.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2018-08-06T08:41:35+00:00

    I spoke to Microsoft support and they claim that those IMAP syncs were done by me via VPN as well.

    I do use a VPN occasionally for my work laptop but I haven't managed to verify if the dates matched.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Anonymous
    2018-08-06T08:38:13+00:00

    It happened because you had an easy to guess password on your account, you used the same password on a hacked website, or you have malware on one of your systems.

    I would suggest that you turn on multifactor authentication and be sure to have multiple devices setup.

    yeah but no, it's happened on my account in the last month, password was changed 30 days ago (and changes every 72 days), two factor authentication has been on since it was available and the password itself is 14 characters long, with mixed case, special characters, and a random number. Despite this I can see successful sync from Malaysia, Russia, china and Vietnam over a three week period. I've changed my password (obvs) and the last two attempts from China and Sweden are unsuccessful which implies its not an internal sync within the Microsoft network.

    Microsoft support have convinced themselves I am using a VPN but that doesn't explain what the syncs were, why it took 4 weeks to notify me or why two factor auth wasn't triggered for any of them.

    Also the VPN I use is for a corporate machine which wasn't in use when this was happening because I was on leave.

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments
  4. Anonymous
    2018-08-02T10:05:41+00:00

    Same problem here.

    This is very scary. I have 2 factor auth with my phone, so it shouldn't be possible for someone to sync, even with a successful guess of my password. I would receive an authorization request in my phone.

    How did they manage to sync WITHOUT triggering my 2 factor auth??

    Thlis looks like a very serious security bug with Outlook!

    Also why are the dates so all over the place? This happened 30th of June, but the dates go back to a long time ago.

    Was this answer helpful?

    20+ people found this answer helpful.
    0 comments