My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2019-06-22T04:10:57+00:00

    So what happened?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2019-06-26T16:05:12+00:00

    I believe what all of this stems from, in most of our cases, is our email addresses appearing - at one point or another - in a list of compromised usernames/passwords in hacked database leaks. I figure that multiple attackers are constantly running through these lists looking for accessible accounts.

    Sites like Haveibeenpwned are pretty good at telling you if your e-mail appears in any of the breaches that have been made public.

    Anyways, I think I figured out a fix or work-around for these issues. 

    Warning : go through these steps carefully. Going about this a different way initially, I was given a prompt that informed me I would permanently lose the ability to receive or send e-mail from the hotmail account I was trying to fix if I clicked Yes. Done right, you should not run into that prompt, and will merely be using the new alias to sign in.. you will no longer be able to sign in with your old email address, but will still be able to send and receive mail from it and use it normally.

    1. First, go to the Your Info link at the top of your Microsoft Account page. Click Manage how you sign in to Microsoft.
    2. Under 'Account aliases', add an e-mail address or phone number. Verify it, and then click Make primary on the new alias.
    3. Under 'Sign-in preferences' on the same page, click Change sign-in preferences.
    4. Remove the check mark next to your old, initial email address and only leave the new primary alias checked. Click Save.

    Just to be safe, for the new alias, I used a gmail account that I know hasn't been compromised in the past, has a strong password, and has 2 factor authentication enabled.

    After doing the aforementioned things, sync and login attempts instantly dropped to zero and have stayed that way. Hope this helps some of you find relief from this frustrating and anxiety-inducing debacle.

    Was this answer helpful?

    4 people found this answer helpful.
    0 comments
  3. Anonymous
    2019-06-26T16:10:03+00:00

    I would also like to note that I just tried syncing my account via IMAP with an incorrect password and the correct password. Even though using the correct password showed 'successful sync' on the security page, the IMAP client still gave the same error it did when I used the wrong password - it refused to sync. I believe 2 factor authentication does cause these syncs to be rejected even if the password was correct, meaning - for what it's worth - an attacker would never realize they had the right password or actually be able to sync anything. Could be wrong - don't have a ton of knowledge on this aspect - but did try it via Python's IMAPClient and on my iPhone and both refused to sync & returned the same errors.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2019-06-28T09:18:04+00:00

    Ok, so this morning I got all the messages and emails from Microsoft telling me someone may have access to my account (password was unique to outlook, 2fa enabled). First thing I do is change my password to then go and check my sign-in activity. 44(!) successful syncs over the past 30 days to countries all over the world!?!?! And I only get a message now that my account MAY be compromised. I'm a bit freaked out right now because I don't know what they can do with my e-mail history. Do I need to go change every single password for every account I've ever created? Do I need to replace my SIM-card since they somehow got past the 2fa without me ever noticing? Do I clean install all my devices since they somehow got my password?

    Was this answer helpful?

    0 comments