Module 2 · 2.5

English

Nederlands English Deutsch

Leaked? Checking and recovering

Module 2: Passwords and logging in · Reading time: 10 minutes

Learning objective: After this lesson, you can check for yourself whether your data appears in a leak, respond to a leak in the right order, and recover and clean up a hijacked account.

Key concepts: Have I Been Pwned, k-anonymity, breach notifications, revoking sessions, session cookie, recovery details, forwarding rules

How you find out something has leaked

Often you don't find out. A leaked password can sit in a combo list for months before anyone tries it. So watch for these signs:

A service emails you that there has been a data breach. First check whether that email is genuine (module 3): go to the site yourself instead of clicking the link.
You receive a login code or approval notification that you didn't request yourself (lesson 2.3).
You see a notification saying "new sign-in from an unknown device".
Customers or colleagues receive strange emails "from you", or you're missing emails that were actually sent.
Your password manager warns that a password appears in a breach.
You suddenly can't log in any more, or your recovery details have changed.

Checking for yourself with Have I Been Pwned

Have I Been Pwned (haveibeenpwned.com) is a well-known, free service that collects data from publicly known data breaches. You can search it yourself using your email address. You'll see which breaches the address appears in and what kinds of data were involved: just email addresses, or also passwords, names, phone numbers or addresses. With the "Notify me" feature, you get an email if your address turns up in a new breach.

Do this yourself, on the service's own website. In this course, we never ask you to enter your email address or password anywhere.

There is also a section called Pwned Passwords, which password managers and websites use to check whether a password has ever been leaked. This works using k-anonymity: your password is converted into a hash (a fingerprint) on your own device, and only the first 5 characters of that hash are sent to the service. The service sends back all known hashes that start with those 5 characters, and your own device checks whether your full hash is among them. The service therefore never sees your password, and doesn't even know which of the hundreds of returned hashes is yours.

Two caveats:

Not being on the list doesn't mean you're safe. A breach that isn't (yet) known won't be listed. Infostealers (lesson 1.4) also steal passwords that never end up in a published breach.
Being on the list doesn't mean all is lost. Check what data leaked and when. A password you haven't used for years isn't a problem; a password you still use everywhere is.

What to do first after a leak

Order matters. The most important rule: your mailbox first, because with your mailbox an attacker can take over almost all your other accounts via "forgot password".

Step	What	Why
1	Work from a clean device if you suspect malware	An infostealer on your laptop will steal your new password too
2	Change the password of your mailbox	The key to all "forgot password" links
3	Revoke all sessions (log out everywhere)	Otherwise an attacker who's already in stays in
4	Check two-factor authentication (2FA): is it switched on, and has no unknown device or number been added?	An attacker sometimes adds their own phone
5	Check recovery details: recovery email address and phone number	Otherwise they'll simply take back the account later
6	Check forwarding rules, filters and app passwords	These are back doors that keep working after a password change
7	Do the same for every account where you used the same password	Credential stuffing: they'll try it there too
8	Let contacts know that fake emails may have come from you, and check whether this is a data breach you need to report	Lessons 3.5 and 8.2

Why you revoke sessions

When you log in, your browser receives a session cookie: a kind of temporary access pass, so you don't have to log in again with every click. Whoever has that cookie is logged in. No password and no second step needed.

That's exactly what infostealers steal: not just your passwords, but your cookies too. And an attacker who has logged in with your password also has a session. If you only change your password, that session can simply keep working with some services.

That's why, after a leak or a strange sign-in, you check the overview of active sessions or devices for every important service, and log out everything you don't recognise, or everything except the device you're currently working on. With many services, a new password also logs you out everywhere; check it anyway.

The forwarding rule as a back door

A case like it often goes. The bookkeeper at Bakkerij Example clicks a phishing email and enters her email password. The attacker logs in to factuur@example.com and does three things:

He creates a rule: every email with "invoice", "payment" or "IBAN" in the subject is forwarded to an external address at leverancier-administratie.example and then moved to the bin.
He sets his own phone number as the recovery number.
He logs out again.

The bookkeeper notices something is wrong and changes her password. Sorted, she thinks. But the rule keeps working. The attacker reads along with every invoice for weeks, and one day a customer receives an "amended" invoice with a different IBAN (lesson 1.2). Via the recovery number, he can also take back the account.

So always check a mailbox for:

rules and filters: especially rules that forward or delete;
forwarding in the mailbox settings and in your hosting panel;
automatic replies that you didn't create yourself;
app passwords and linked apps: remove anything you don't recognise;
recovery details and the list of devices registered for two-factor authentication.

When an account has really been hijacked

If you can no longer get in, use only the service's official recovery procedure. Find it by going to the site yourself, not via a link from an email or a search advert. Be wary of "recovery help" that you approach yourself on social media, or that approaches you: these are often scammers trying to hit you a second time.

After that:

do steps 3 through 8 from the table above;
create new recovery codes and switch on a stronger second step (lessons 2.3 and 2.4);
report fraud or phishing to the Fraud Helpdesk (Fraudehelpdesk) and report it to the Dutch police if there's been damage;
write down what happened and when. If customer data was involved, it may be a data breach (lesson 8.2).

In practice: what it looks like

In the WebOké environment, you'll find the Active sessions card under Login details in My WebOké, showing the browser, system, IP address and since when, for each session. You can log out a single session or log out everywhere except the device you're currently using. In Nextcloud, under Security you'll find the Devices & sessions overview, where you can also revoke a device or wipe it remotely. Forwarding and filters for a mailbox can be found in the hosting panel and in webmail. Other providers work in a similar way: look for "sessions", "devices", "security" or "recent activity".

Summary

Check haveibeenpwned.com yourself to see if your email address appears in a known breach; Pwned Passwords works using k-anonymity (only the first 5 characters of the hash are sent).
Not being on the list isn't the same as being safe.
After a leak: mailbox first, then revoke sessions, check two-factor authentication and recovery details.
A password change doesn't remove forwarding rules, app passwords or stolen sessions.
You can only recover a hijacked account via the service's official route.

Quiz

Exercise

Exercise D2.5: Your own breach check and clean-up round. Check haveibeenpwned.com yourself for your business email addresses and turn on "Notify me". For your mailbox and your most important accounts, review the active sessions, forwarding rules, app passwords and recovery details, and clean up anything you don't recognise. Tick off the checklist and answer the reflection questions. You won't enter any email address or password in the course itself.

Exercise D2.5: Your own breach check and clean-up round

Here's how to go about it: (1) Look up your business email addresses yourself on haveibeenpwned.com (for example info@ and factuur@ on your domain). Note down which breaches they appear in and what data was involved. (2) Turn on "Notify me" for these addresses. (3) Change passwords that appeared in a breach and are still in use, and any password you used in more than one place. (4) Check the active sessions or devices on your mailbox and your three other most important accounts, and log out of anything you don't recognise. (5) Check your mailbox for rules, filters, forwarding (in the webmail and in your hosting control panel), auto-replies, app passwords and connected apps. (6) Check recovery details (recovery email address, phone number) and the devices registered for two-factor authentication.

Looked up my own business email addresses on haveibeenpwned.com
Turned on notifications for new breaches
Changed leaked and reused passwords
Checked active sessions on mailbox and three other accounts
No unknown forwarding rules, filters or automatic replies
Unknown app passwords and connected apps removed
Recovery details are correct and belong to me

What did you find that you didn't expect (for example an old session, rule or app)?

For which account is the recovery route the weakest, and what will you do about it?

Who in your business does this check from now on, and how often?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing