My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Anonymous
2017-12-27T07:24:23+00:00

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2019-10-19T13:55:26+00:00

Dear Tech community,

as far as we know now, there was an UX issue on the MSA recent activity page, where a subset of unsuccessful IMAP syncs are erroneously shown as successful. This bug should be fixed in a couple of days and we hope that no one was ever compromised.

Cheers

Volker

P.S.: IP addresses are translating to countries like Bangladesh, Brasil, China etc. A hacker can  simply fake their source IP, therefore it is difficult to say, where the hack attacks are coming from. Please just keep using security best practices for your hotmail/outlook accounts with difficult passwords to be changed as often as possible and leverage multi factor authentication.

https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/

All other email providers have the same challenge to help their customers to secure their username/password authentications.

Was this answer helpful?

10+ people found this answer helpful.
0 comments

224 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-04-13T12:36:51+00:00

    Was this answer helpful?

    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  3. Anonymous
    2020-04-07T11:25:47+00:00

    Hi, to just repeat my previous post please note: Most likely nothing has leaked from your account at all. You can test this by yourself to use a simple LDAP client and try accessing your account with your username and password with all security tips followed from all the other posts here and check the activity log. You might see a success, but you can see that no data will flow to the LDAP client at all. I really recommend to reset all your app passwords, which are the weakest part for LDAP sync attempts and you can just reset all of them. Here once more some tips:

    1.) Reset your password to become really strong (use a trusted password manager to generate a really complex password)

    2.) Go to your additional security options and reset all your app passwords and remove all your trusted devices, which will prevent old leaked app passwords from being usable anymore especially from LDAP clients.

    3.) Enable Multi Factor Authentication with Azure Authenticator App on your smartphone or use a Fido2 key.

    4.) Don't use your MSA email address and related password anywhere else, besides for your MSA account.

    5.) Keep all your devices and used apps always up to date

    6.) Enable End Point Protection of your choice on any device (we recommend of course Windows Defender)

    7.) Business IT-Pros please use Azure Sentinel, Azure Security Center and Microsoft Advanced Threat Protection.

    Sorry for all your pains and irritations here in this thread, but please keep your trust in Microsoft Solutions, which already evolved to one of the most trusted, compliant and secured technologies available today globally.

    Take care

    Volker

    P.S.: If you think your email alias is really used for several attacks or leaked many times, you can also just change your alias in MSA to a brand new email address and remove the old alias, without loosing your data or unique ID.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-04-07T11:14:00+00:00

    the Bug still their ,They got your password and logged in and downloaded all your emails.

    They know your password so change everything that uses that Password.

    Turn on 2 factor authentication.

    If you have any personal information like bank details etc you may want to alert your bank. automatic sync usually refers to sync via email client like outlook desktop add..and successful sync usually refer to successfully access to account ..

    i will suggest you to update your security info ..and check weather any of security info is altered or not for any suspicious activity you can report to Microsoft and remove unknown devices from trusted devices ..i will suggest you to refer below article as it will provide you with detailed steps to secure your account and deal with such stuff,  https://support.microsoft.com/en-in/help/13782/microsoft-account-what-is-the-recent-activity-page   ,

    1. Right-click the folder, and then click Properties.
    2. Click Clear Offline Items, and then click OK.
    3. On the Outlook 2010 ribbon, click the Send/Receive tab.
    4. Click Update Folder.

    If these methods do not resolve the issue, we recommend that you rebuild the .ost file. To do this, delete the .ost file, and then let Outlook download the information again from Exchange Server. For more information, see the "More information" section.

    level 2

    Was this answer helpful?

    0 comments