Advice Request I need advice regarding data breach

[marhendray]

Hello MalwareTips member.

Yesterday, I received a notification about another password breach via Microsoft Password Monitor (feature on Microsoft Edge). A couple hour after that I received multiple login prompts to sign in into my account (Outlook and Microsoft 365). I have my Outlook account passwordless. Should I stay on changing password and enabling 2FA (Microsoft Account) or purchase security key like YubiKey/Nitrokey?. Which one is safer from cybersecurity point of view?. This is because my Microsoft 365 account is very critical to my work.

Spoiler: Breach

Spoiler: Login attempt 1

Spoiler: Login attempt

Thank you MalwareTips member.

 

[Razza]

Hello MalwareTips member.

Yesterday, I received a notification about another password breach via Microsoft Password Monitor (feature on Microsoft Edge). A couple hour after that I received multiple login prompts to sign in into my account (Outlook and Microsoft 365). I have my Outlook account passwordless. Should I stay on changing password and enabling 2FA (Microsoft Account) or purchase security key like YubiKey/Nitrokey?. Which one is safer from cybersecurity point of view?. This is because my Microsoft 365 account is very critical to my work.

Spoiler: Breach

View attachment 270949

Spoiler: Login attempt 1

View attachment 270950

Spoiler: Login attempt

View attachment 270951

Thank you MalwareTips member.

Just to be safe you should change you're passwords and enable 2fa everwhere you can , btw the screenshots is leaking your personal email address I doubt you want everyone to know it.

 

[Ink]

Microsoft Edge (Password Monitor) is saying your associated email/password has been leaked.

For every website in that list, it's advised to change your password. By default, 2FA should be for all online accounts.

Question about those 8 domains:

• how did you generate the passwords?

You can check when and what was leaked using https://haveibeenpwned.com/

PS: Your email address is visible in the screenshots.


As for the Microsoft Authenticator login request, only Approve requests that you have made - location, device and time.

Manage your recent account activity: See when and where you've used your account and remove any unknowns.

How to recover a hacked or compromised Microsoft account - Microsoft Support

Learn how to recover a hacked or compromised account, what to do next, and how to prevent your account from being compromised in the future.

support.microsoft.com

 

[marhendray]

Microsoft Edge (Password Monitor) is saying your associated email/password has been leaked.

For every website in that list, it's advised to change your password. By default, 2FA should be for all online accounts.

Question about those 8 domains:

• how did you generate the passwords?

You can check when and what was leaked using https://haveibeenpwned.com/

PS: Your email address is visible in the screenshots.


As for the Microsoft Authenticator login request, only Approve requests that you have made - location, device and time.

Manage your recent account activity: See when and where you've used your account and remove any unknowns.

Question about those 8 domains:

• how did you generate the passwords?

Answer: I generate my password using mathematical expression sometimes well-known such as x^2+y^2=z^2, a^2+b^2=c^2 or s^2+y^2=x^2 I use it across my accounts due to infinite amount of options.

For the email address, I always publish it publicly due to mathematical research purpose. Do you think that my technique (password) is flawed from cyber security point of view?

 

[marhendray]

Just to be safe you should change you're passwords and enable 2fa everwhere you can , btw the screenshots is leaking your personal email address I doubt you want everyone to know it.

Thank you for your advice. For the email, I already share it to my colleague publicly (research purpose). I think this is related to multiple breaches happened lately in Indonesia but I am not sure.

 

[Ink]

It's easier and/or safer to use a secure Password Manager to manage (ie. generate/fill/store/check) your passwords.

And if what you're saying is true, that your Microsoft account may be compromised, then any Sync'd browsing data and credentials may be at risk. Research purposes or not.

 

[marhendray]

It's easier and/or safer to use a secure Password Manager to manage (ie. generate/fill/store/check) your passwords.

And if what you're saying is true, that your Microsoft account may be compromised, then any Sync'd browsing data and credentials may be at risk. Research purposes or not.

Thank you. I have contacted people that knows cyber security but still no respond till now. I think I will migrate my data elsewhere based on your advice. Once again, thank you.

 

[Ink]

Check this thread to see what members of the forum are using.

Poll - Password Manager Poll (2022)

Password Manager Poll (2022)

malwaretips.com

Some password managers are local only, others sync via the cloud, there are also paid options.

 

[marhendray]

Check this thread to see what members of the forum are using.

Poll - Password Manager Poll (2022)

Password Manager Poll (2022)

malwaretips.com

Some password managers are local only, others sync via the cloud, there are also paid options.

Thank you. I choose Bitwarden for my passwords (popularity), and it has password generator too.

 

[Kongo]

Thank you. I choose Bitwarden for my passwords (popularity), and it has password generator too.

This might be helpful for the future:

GRC's | Password Haystacks: How Well Hidden is Your Needle?

 

[marhendray]

This might be helpful for the future:

GRC's | Password Haystacks: How Well Hidden is Your Needle?

Thank you for your solution. To be honest, I always get the fastest solution about cyber security here than the security team. I will always report anything cyber-related incident here.

 

[DDE_Server]

1. I recommend using trusted Password Manager. There are multiple options which are trusted and open source you could use local password manager like keepass or Bitwarden
2. Enable 2FA in the email
3. Change all the password of all accounts related to this email " it is recommended to change your password for your account each 3 months "
4. use password generator "in the above solutions" to generate complex passwords with character not less than 16 with special characters / Number / letters included"

 

[mkoundo]

Hi,

In addition to the great advice given by others, I'd add:
a) you may want to use a 2fa authenticator that generates a numerical code instead of using an authenticator that asks you to approve/deny a login request. The advantage of this approach is that you wont be notified every time someone tries to get into your account and removes the possibility that you may accidentally approve the request.
b) yes, a yubikey is considered more secure than using a 2fa app. If you consider your security that critical, I would go for a yubikey. If you decide to go down this route it's worth buying two or more yubikeys from the start so that during setup you can create backup yubikeys which you can keep safe, perhaps at different locations, to ensure you don't get locked out, should you lose/break your primary yubikey.