(SOLVED) Been Hacked Need Info ?

[Zebuddi123]

UPDATE --- Thanks to all of you guys for the replys I recievied this Email this morning from Google. Zebuddi.




Hi to All

Is the anyone here knowledgable with possible spoofing of IP`s Ive recently Had mine well I should say used to try download all my Google account except I was out when the request was made long story short google say my IP was used for the request except I was out no one home and router off unplugged ?

Zebuddi.

[NicTheQuick]

Sorry, I don't get what happened. Can you please write in proper English. It's hard to read for me as a non native English speaker. Thank you.

[BarryG]

I'm confused, too. What happened?

[Zebuddi123]

Hi Yea Sorry. I was visiting my son, whist there I recieved an Email from Google on my mobile phone stating a request had been made 12 minutes prior for my google archive download "all my data" having checked my google account security the request was made from my IP address (static).

No one was at my home and my router (cable modem Virgin Media) was disconnected from the power supply. Having arrived home 20 minutes late to access my computer Everything was off and disconnected from my power supply, no on else has access to my property,
yet google states my IP address.

I have contacted my supplier requesting confirmation my router was not connected to the network at that time, apparently they dont have that infomation to give me. I should have checked with the "Food & Agriculture Ministry - Snoopers Charter"

So I`m left with the puzzle

how and did someone spoof my IP,
how did the get my IP
how did they get my password 15+ chars "a-zA-Z0-9"+symbols

I`m not a network person (probably banged my head against the wall to many times) nor have I every been interested in the darkside of programming "Until Now"

Any way guys any enlightenment would help for a humble beginner

Zebuddi.

ps. They didnt get anythig I hope, cancelled the archive before being downloaded I hope, aldo change to multi point authentication.

[RSBasic]

Very odd.

[NicTheQuick]

Are you sure the mail you received came from Google? Did you check the mail header, did you verify the links you clicked in that mail?

[Zebuddi123]

Hi RSBasic.

Yea it is to me and after speaking to (virgin Media broadband tech +91 xxxxxxxxx for 1 hr) had a techie telling me they cant provide the infomation Im requesting also according to the techie my IP is "Dynamic" The only this that would of been Dynamic is the techie, had he gotten of his ass to speak to someone with a brain the of numbers times he said to speak to someone.

Zebuddi.

[Zebuddi123]

Hi NicTheQuick

Yea it deffinatley originated from google as the request info is still my security area, also had a security issue email follow up from google lol and I cancelled it from my secure area.

as far as i can tell it all look cosha

Gmails Cert Public Key
Key size: 256 bits
Base point order length: 256 bits
Public value:
04 c4 52 72 7f 24 93 aa b2 dc b1 d5 92 d5 99 5b
19 bf 32 ae 24 a3 09 44 77 14 07 e3 4c 22 8d 38
59 fb fe 49 ae a8 7a 52 55 a7 5a e8 ae 94 da 2b
1c 7d 83 11 6e 0e 91 22 ab 78 5a 18 cd ee f0 f0
ee

[Joakim Christiansen]

You can't establish a TCP connection without traffic to that IP being routed to your location. In other words, you can spoof the first packet of the handshake but without being able to receive the answer to it you can't establish a connection that you can send data through.

If what you say is true I guess someone at your ISP (internet service provider) hacked you (or the CIA/NSA), because I don't see how anyone else could manage to take control of your IP address. Even the best hacker on the internet can't just do something like that.

EDIT: Or your connection to the ISP has a security issue allowing another ISP user to authenticate as you. Maybe even the ISP itself has been hacked.

[djes]

I don't understand everything. You received a mail from Google to confirm a download of your archive (?), request coming from your static IP ?
1. So you recognised your static IP ? But your provider say you have a dynamic IP ? What's the truth ? What are you using now ?
2. Are you able to connect to your Google account ?
3. Have you changed your Google's pw with a strong one ?
4. Have you multiple recuperation options ?
5. Are your datas corrupted ?

Maybe it was an attempt to make you physically type your details on a spoofed navigator or hacked device.

[Bitblazer]

If any real harm happened to you - call the police and tell them about it. The ISP will then be called by the police during the investigation and things will officially proceed as they should (your ISP will likely get a call from the police during the investigation and will be asked to hand over the connection information).

If you just asked out of curiousity - for cable modem users in the USA, its actually laughably easy to have somebody else use "your IP". I don't know how the ISPs do it in the UK, but in germany and the USA, it can be easily done.

In german "Anzeige wegen hacking/abuse/datendiebstahl/verletzung der privatsphäre, gegen unbekannt erstatten" (sorry i couldnt find the correct english translation but maybe somebody else here can provide it). But only do that if you had a real harm done to you, never waste the police's time.

[tj1010]

If it's same IP it's nearly impossible your attacker chanced upon pulling your expired IP from your ISP DHCP... You have malware or a vulnerable service they use to proxy the HTTP session using logged credentials or cookie.. A lot of malware does RDP sessions on victims to get past 2FA and region checks..

They either got in through a download or an unpatched browser or OS. You need a proper anti-virus that has a HIDS(real-time heuristics and sandboxing) and anti-rootkit and don't run old software where anyone with an exploit can load anything they want on your machine..

Meantime.. Change credentials and cards that were in the dump, and freeze your credit the first time you see something happen. This is what those hacker-protection services people pay for do..

P.S. 2FA and U2F won't help people who download malware or run unpatched software. 2FA and U2F on patched modern hardened software makes it hard for anything but a government to get on your machine though..

[Zebuddi123]

Thanks All Solved info in first post.
Zebuddi.