Jump to content
Required Reading for any Longhorn ×

Somebody took over my Netflix account

markstanco
 Share

Recommended Posts

markstanco

markstanco 12,616

Posted
Posted

So I got an email that my email, PW, and phone number changed on my account. I called Netflix and got it changed back to me within 15 minutes. It was done (VPN notwithstanding) in India.

 

My password was probably a 8 of 10 on strength. 9 characters, 2 capital letters, and 4 numbers.

 

I also changed my gmail password just in case, which was completely different.

 

My question is, what should I look for to stop this in the future? How did they get it? We dont log in to Netflix on mobile devices, at all. Only on the DVD player. And I dont have the password saved on one of those password websites that i think are super retarded.

Link to comment
Share on other sites
markstanco

markstanco 12,616

Posted
  • Author
Posted
I've never had netflix...
Q: does netflix lock you out after a certain amount of tries using the password?
Q: Also, does netflix use a secondary code to verify the login?  
 
I dont know. Wife uses it. The security was I guess my email I received.
Link to comment
Share on other sites
Francisco 2.0

Francisco 2.0 32,430

Posted
Posted (edited)
1 hour ago, Soldierhorn said:

I've never had netflix...

 

Q: Also, does netflix use a secondary code to verify the login?  

 

No to 2FA.  

My Netflix was taken over once before.  Initially, I saw a lot of "resume viewing" of shows I would have never watched in the first place (everything was in Spanish) then after a few days, all the menus, etc were converted over to Spanish.  The password was not changed, but somehow, someone who was either overseas or using a VPN based overseas was using my account.

Signed into the portal (wife had to interpret for me, after I signed in, everything was in Spanish), changed it back to English, changed the password, and signed out all devices using my account.

 

Edited by Francisco 2.0
  • Like 1
Link to comment
Share on other sites
HRSchenker

HRSchenker 2,274

Posted
Posted

Not only have I had my netflix account hacked but they created their own profile inside the account. Didn't bother to change the username or password. The only way they could have gotten it was from a leak of my previously used email/password or I got phished. That's why I use LastPass to change my passwords every month.

Link to comment
Share on other sites
Soldierhorn

Soldierhorn 206

Posted
Posted
1 hour ago, markstanco said:
1 hour ago, Soldierhorn said:
I've never had netflix...
Q: does netflix lock you out after a certain amount of tries using the password?
Q: Also, does netflix use a secondary code to verify the login?  
 

I dont know. Wife uses it. The security was I guess my email I received.

It could be any number of things but, yeah, most likely email phishing. 

Link to comment
Share on other sites
NoName

NoName 16,407

Posted
Posted (edited)
19 hours ago, markstanco said:

 

So I got an email that my email, PW, and phone number changed on my account. I called Netflix and got it changed back to me within 15 minutes. It was done (VPN notwithstanding) in India.

 

My password was probably a 8 of 10 on strength. 9 characters, 2 capital letters, and 4 numbers.

 

I also changed my gmail password just in case, which was completely different.

 

My question is, what should I look for to stop this in the future? How did they get it? We dont log in to Netflix on mobile devices, at all. Only on the DVD player. And I dont have the password saved on one of those password websites that i think are super retarded.

 

Check out Have I been Pwned: https://haveibeenpwned.com/

and Spycloud: https://spycloud.com/

to see if your password has been involved in other hacks/leaks/breaches in the past (almost guaranteed this where it came from?) - is it a shared password with other sites?

no clue if it is actually your email but markstanco@gmail.com is listed on 14 breached sites on haveibeenpwned, including Collection#1 (2.7 billion records, 773 million unique email addresses)

you can look here and see if that specific password was included in the list: https://haveibeenpwned.com/Passwords

---------

do you use a service like TeamViewer or any other remote desktop service? If so, that could have been breached - I know TV was a few years ago...

---------

Not to shit on your password complexity but 9 digits that is only letters/numbers and not symbols isn't super super super strong. Probably not an 8/10.

Just using the LastPass "complexity" tool, it shows that 9 digits of only upper/lower/numbers are generally a 3/5 on their little strength meter and sometimes a 4/5. Probably needs to be both longer and include symbols to actually be strong + be longer

Quote

Richard Boyd, a senior researcher at GTRI says, “Eight-character passwords are insufficient now… and if you restrict your characters to only alphabetic letters, it can be cracked in minutes.” In any case, to be on the safe side, a password length of 12 characters or more should be adopted.

---------

Going to spoiler the info about password tools below since you probably don't care about it...but seriously, it is way more secure.

Spoiler

 

I get that you think that using the password websites/tools is dumb, but it is the only way to actually have/use high quality passwords. Nobody can remember a bunch of long alphanumeric passwords for every site they visit. 

After a breach leading to temporary loss of a number of accounts I went through and updated almost everything to 16 character mix of upper, lower, numbers and symbols. Losing access to your main accounts that matter (if you use Gmail for your main email and lose access to it you are pretty much 100% fucked, you can't recover the account without access to the email)

Now, I am not going to sit here and say that you need to start using a Yubikey and change every password you have to like 24 digit alphanumeric password but losing access to main accounts is seriously terrifying and will make you reconsider how much you actually care about the inconvenience. 

Also, using 2 factor authentication is great too. Can't help you here with Netflix but in general it is awesome. Use an app like Google Authenticator because using 2FA over text is one more way you can lose your info. Probably better than just using a password, but still.  

 

 

Edited by NoName
  • Like 2
Link to comment
Share on other sites
Soldierhorn

Soldierhorn 206

Posted
Posted

Good post NoName. 

yes. anything of any value should have at least 12 alphanumeric/special character passwords. different, but with the same endstate, my hard drives have minimum 25 alphanumeric/special character passwords for encrypted hard drives.  

If websites dont have automatic lockout after a few tries (and I have no idea if netflix does), then they are highly subject to blast hacking... but that may be obsolete nowadays, or at least I hope so.  two factor authentication (secondary pass code) is helpful for any changes to the account

InsideTexas was hacked by a fake russian a few years ago but I think he got administrative access through email phishing and the person used the same password for several things; I could be wrong about that. 

  • Like 1
Link to comment
Share on other sites
NoName

NoName 16,407

Posted
Posted
29 minutes ago, Soldierhorn said:

Good post NoName. 

yes. anything of any value should have at least 12 alphanumeric/special character passwords. different, but with the same endstate, my hard drives have minimum 25 alphanumeric/special character passwords for encrypted hard drives.  

 If websites dont have automatic lockout after a few tries (and I have no idea if netflix does), then they are highly subject to blast hacking... but that may be obsolete nowadays, or at least I hope so.  two factor authentication (secondary pass code) is helpful for any changes to the account

 InsideTexas was hacked by a fake russian a few years ago but I think he got administrative access through email phishing and the person used the same password for several things; I could be wrong about that. 

Looks like they have 10 attempts before it locks you out fwiw

Link to comment
Share on other sites
0xdeadbeef

0xdeadbeef 1,652

Posted
Posted (edited)

Netflix, like almost every other major site, uses https:// to login. That 's' means that your password was not stolen by someone monitoring the internet traffic coming out of your box. 

Possibilities:

  • They didn't really have your password yet and the mail was a Phishing mail. Did they want you to click a link they gave in the email to to change it?  (or did they give you a number to call?  That technique requires you to give the 'operator' your id and existing password in order to change it.
  • Netflix.com was hacked and they stole your info from that side. 
  • You have some malware on your device  that stole your password when you typed it in. Seems unlikely if it was only on a DVD player, but then again I've not see a dvd player that was capable to getting to netflix.  (Game console, yes. smart tv, yes. dvd player? That's a new one to me)
  • You went to a fake site like  https://<hiddencharacter>netflix.com/  and manually typed your username and password because your browser seem to not remember it
  • you met some guy in a bar, got drunk, and told him your password. 

That's about it... take your pick.

 

Edited by 0xdeadbeef
  • Like 3
Link to comment
Share on other sites
Soldierhorn

Soldierhorn 206

Posted
Posted (edited)

Good post 0xdeadbeef

I'm back to being hooked phishing... or getting drunk and sharing your account with spanish guy at a gay bar. 

- If Netflix was hacked, it would get out and we would know about it.  I remember when LastPass was hacked and it was a big deal.  I wiped out everything I had in LastPass and havent used it since. LastPass came out and said they were in fact hacked but the hacker didnt get past the firewalls to the account passwords. 

- Malware: possible but unlikely. What would be the point? so someone can change the netflix account to spanish?  unlikely. And, as you said, even more so from a DVD player.  Malware attacks are generally after money: accounts, ransom, advertising, etc

- fake websites are often the tool used in phishing expositions and some look identical as the real sites if you dont pay attention.  

 

Edited by Soldierhorn
Link to comment
Share on other sites
Soldierhorn

Soldierhorn 206

Posted
Posted
1 minute ago, markstanco said:
3 hours ago, Soldierhorn said:
or... ask the wife if she happened to give the username and password to a neighbor or relative.  Someone may just be messin' with ya

Yea but no, as mentioned login on the DVD player only.

That doesnt matter. If you gave me your netflix username and password, I could watch it on my computer, ROKU, Firebox, etc

Link to comment
Share on other sites
crash_davis

crash_davis 23,115

Posted
Posted
On 6/17/2019 at 9:54 PM, HRSchenker said:

Not only have I had my netflix account hacked but they created their own profile inside the account. Didn't bother to change the username or password. The only way they could have gotten it was from a leak of my previously used email/password or I got phished. That's why I use LastPass to change my passwords every month.

what happens when lastpass gets hacked?

Link to comment
Share on other sites
ztejas

ztejas 43,540

Posted
Posted
17 hours ago, Soldierhorn said:

then they are highly subject to blast hacking... but that may be obsolete nowadays, or at least I hope so. 

You'd be surprised. Case in point, the website we're currently on. 

As for @markstanco - idk. Shit happens. Best to just not use that password anymore and forget about it. I've had weird stuff happen in the past but as long as you're using good passwords and different passwords and 2FA for anything important you should be fine. 

I'd always recommend a VPN but that is only relevant for your computer or phone, and much more useful if you're working with sensitive data or doing things you would rather not be tied to your IP (pron, gambling, less than legal streaming, torrenting etc.)

  • Like 2
Link to comment
Share on other sites
Soldierhorn

Soldierhorn 206

Posted
Posted
1 hour ago, crash_davis said:

what happens when lastpass gets hacked?

They were hacked a while back and, supposedly, it was not as bad as it could have been but I dropped it at that point. I keep my passwords on a spread sheet now.  The good thing about LastPass was that I had access to my most used passwords on all my devices through the site.  Now I have an encrypted partition or SD card that has my spreadsheet.  

Link to comment
Share on other sites
TXSooner518

TXSooner518 2,438

Posted
Posted

I got an email that I had a login to my Hulu from Thailand, so I went to the Hulu site and changed my password. Dunno why someone would do that and not change the login credentials? Maybe they just think the primary holder won't notice if they are just logging in for some free shit?

Link to comment
Share on other sites
torre

torre 1,286

Posted
Posted
On 6/24/2019 at 3:20 PM, Pogo said:

It might have been a sim card swap.

https://www.wired.com/story/sim-swap-attack-defend-phone/

 

This is another article on the results of a sim card swap.    Lengthy,  excerpts only.    Worth the read if you are having issues.

 

US WIRELESS CARRIERS ARE THE WEAK LINK

My Google and Twitter accounts were also stolen, and $25,000 was withdrawn from my bank account for a Bitcoin purchase

It appears the weak link in the chain that broke first and let the hacker gain access to my Gmail -- which in turn led to hacking my Coinbase, Twitter, and other accounts -- was my mobile carrier. In early 2018, T-Mobile issued a press release regarding unauthorized porting (SIM swapping) with some additional steps customers could take. I did not see this message, but I had a PIN on my account that I believed would help keep things secure. It turns out there is a PIN for when you call into customer service, but there is also a second PIN -- a 6- to 15-digit port validation PIN -- that you should also add. Had I been using this second pin, my SIM swap may have been prevented.

The thief was likely able to find enough personal information about me online to convince the T-Mobile representative that he was me; without the port validation PIN setup, they let the thief steal my number. And once my number was no longer in my control, the floodgates were open for the hacker to take over my other accounts using SMS authentication methods.

Stop using convenient methods to setup accounts. In the past I would just click the Facebook, Google, or Twitter button to setup an account or login. I'm done doing that and gave up convenience for better security.

Remove all personal and financial information from Google Drive and OneDrive. For now, I've moved all that data offline to physical hard drives. I plan to use cloud services only for photos, videos, and other data that has no privacy concerns.

Create unique strong passwords for every site. I was lazy before and often used the same three to five passwords on most websites.

If possible, use two-factor authentication means other than SMS. You can try methods such as Google Authenticator, Authy, physical means such as Yubikey, or solutions provided by your bank or other online service. My bank supports CyberCode Text and CyberCode Token options that should help increase security. I'm also in the process of setting up the Advanced Protection Program hardware from Google.

Make sure hackers do not enable any form of auto-forwarding of your email to another account.

Turn off the offer to save passwords. Then delete all saved passwords in both the Settings > Passwords and Google Account > Password Manager areas. I had over 320 passwords saved here that the hacker had access to when my account was taken over. I'll be entering passwords manually for a while until I figure out a safer option.

Close any unused accounts, especially cryptocurrency accounts. I was able to eventually login to my old Coinbase account and remove my bank from the account. I then had the Coinbase folks suspend my account. (I only used the account once to buy a $200 in Bitcoin just to see what all the fuss was about. But I but wasn't comfortable enough to continue without further researching cryptocurrency.) Apparently, this one-time Bitcoin purchase was the primary reason my accounts were hacked.

File all the reports I mentioned in my earlier post (FTC, local police, credit reporting bureaus) and work with authorities to help catch the criminals. I found some very interesting data in the security events log of my Google account, so make sure to check out this area of your account if it is ever hacked and you regain control. Hopefully, this data leads to an arrest of the person who stole my account and attempted to steal $25,000.

https://www.zdnet.com/article/how-i-survived-a-sim-swap-attack-and-how-my-carrier-failed-me/

Link to comment
Share on other sites
Buzzrock

Buzzrock 14,944

Posted
Posted

I like 1Password to generate complex passwords and keep them in an encrypted store that’s replicated to all my devices via Dropbox. Just make sure you use a complex password for your 1P vault.

And consider pass phrases instead of passwords for situations where you need to remember the password frequently (like your company login). You can see how effective pass phrases are here:

https://howsecureismypassword.net/

Try typing in the pass phrase purplemonkeydishwasher vs a password you’ve used before to see the difference.

Link to comment
Share on other sites
RPM

RPM 26,355

Posted
Posted

My bank really pisses me off. They require password changes so often I forget what it is. I set it to fingerprint, but when it's time to change I have to type in the old password and it won't take a variation of the previous one.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing


Football ... Basketball ... Baseball ... Other Sports ... Futbol ... 🤫995🤫 ... Gambling ... Movies & TV ... Music ... Hobbies ... Lulz ... Food & Travel ... Daily Texan ... Business and Markets ... Cloak Room ... Help ... For Sale ... Board Discussion ... Subscribe!... Donate!... Advertise... COOKIE MONSTER!

×
×
  • Create New...