Hacked?

[Bad Aim]

So recently I had reason to believe that I was hacked. My response to that was to do a hard reset of my phone and clean install of my PC.
Note: I believe the hack came from a Google Store app called "Mistplay".

After the hard reset and clean install, I changed all the passwords to everything I have and I am in the process of deleting my 2 email addresses.

I was on the phone with my lawyer today when my phone started to act up. It disconnected the call and started playing my MP3's. It started to announce the time at random intervals.

I am going to do another hard reset of the phone. But could this have been a bad reset or could I still have a hacking issue? I would think a hard reset would kill whatever Mistplay did to my phone.

Should I take the phone back to the cell company I use?

Please help.
Thank you,

[emoticorpse]

When you re-logged into your phone did you use the brand new email you are using for the first time or the old one? Did you use an old email even once like for the installation part?

[Bad Aim]

Originally posted by emoticorpse:

When you re-logged into your phone did you use the brand new email you are using for the first time or the old one? Did you use an old email even once like for the installation part?

I did use my old email. I have not even created the new one. Okay, and Windows is registered under my old email as well. I will need to fix those problems.

Thank you.

[emoticorpse]

Originally posted by Joshua Ballard:

Originally posted by emoticorpse:

When you re-logged into your phone did you use the brand new email you are using for the first time or the old one? Did you use an old email even once like for the installation part?

I did use my old email. I have not even created the new one. Okay, and Windows is registered under my old email as well. I will need to fix those problems.

Thank you.

Yeah, In this case I would create fresh brand new ones for each. Now do you have a license or key attached to your old account? not sure if you can transfer that or how that works.

[Cathulhu]

Hijacked, not hacked. You leaked your account credentials somehow.

Do not trade until your account is secured.

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Steam does not return inventory items or wallet funds: https://help.steampowered.com/faqs/view/3B6E-B322-2400-8D24

If you no longer have access to your account, read this:
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

[HypersleepyNaputunia]

shows you how dangerous using a prime hack target like a phone can be for any authentification uses

[plat]

You can look into changing the ip addresses and see if that helps. This would apply to your phone AND computer.

https://www.businessinsider.com/guides/tech/how-to-change-your-ip-address?op=1
https://www.lifewire.com/securing-your-home-network-and-pc-after-a-hack-2487231

[Bad Aim]

Originally posted by Cathulhu:

Hijacked, not hacked. You leaked your account credentials somehow.

Do not trade until your account is secured.

Take the following steps to secure your account:

1. Scan for malware. https://www.malwarebytes.com/
2. Check that the email and phone number on the Steam account are still yours.
3. Deauthorize all other devices. https://store.steampowered.com/twofactor/manage
4. Change passwords from a clean computer.
5. Generate new backup codes for your Mobile App. https://store.steampowered.com/twofactor/manage
6. Revoke the API key (there should be no key). https://steamcommunity.com/dev/apikey

Steam does not return inventory items or wallet funds: https://help.steampowered.com/faqs/view/3B6E-B322-2400-8D24

If you no longer have access to your account, read this:
https://steamcommunity.com/sharedfiles/filedetails/?id=1126288560

It isn't steam acting up, it is my phone. I have already changed my passwords and emails on all my accounts, including steam. I am also seeing no unauthorized use of my bank or accounts anymore.

Why wouldn't a hard reset take out anyone who has remote access of my phone? And I am assuming that because they are disconnecting my calls, starting up my mp3 player randomly, and having my phone tell me the time randomly, that they are just attempting to annoy me. To me, this says they are either REALLY dumb because now I know something is wrong or I have locked them out of everything and they are now screwing with me.

As soon as I got ahold of my cell phone companies tech support, my phone hung up and my MP3 player started playing. When they called back, the phone hung up on them then the phone actually said "Got You".

[HypersleepyNaputunia]

my guess

they using your phone password to log in and control your phone
or they have an exploit for your model of phone to gain access they have your hardwareid or something identifiable and locateable
or your router is compromised

[Bad Aim]

Originally posted by Megami Blanc:

my guess

they using your phone password to log in and control your phone
or they have an exploit for your model of phone to gain access they have your hardwareid or something identifiable and locateable
or your router is compromised

Never considered my router. Time to change passwords on that too.

[HypersleepyNaputunia]

for testing heres what i would do

reset your phone one more time
dont connect to your home wifi just use cell data
try to use phone and see if things start happeneing again
use same password
dont install any apps, barebones phone

if yes more strangeness- youve narrowed compromise down to your phone or cell tower
if no strange things - then its not as likely phone related

step 2:
reset phone
new phone account
no apps
use phone if no strangeness then account compromised

[Bad Aim]

Originally posted by Megami Blanc:

for testing heres what i would do

reset your phone one more time
dont connect to your home wifi just use cell data
try to use phone and see if things start happeneing again
use same password
dont install any apps, barebones phone

if yes more strangeness- youve narrowed compromise down to your phone or cell tower
if no strange things - then its not as likely phone related

step 2:
reset phone
new phone account
no apps
use phone if no strangeness then account compromised

I just had a MAJOR head/desk, head/desk, head/desk moment.

I just realized that while I did do a hard reset of my phone, I did not do a format of the SD card in the phone. As I have my phone set up so most everything is installed through the SD card, I made an opps.

HEAD/DESK

[emoticorpse]

Originally posted by Joshua Ballard:

Originally posted by Megami Blanc:

my guess

they using your phone password to log in and control your phone
or they have an exploit for your model of phone to gain access they have your hardwareid or something identifiable and locateable
or your router is compromised

Never considered my router. Time to change passwords on that too.

Update the firmware and disable wps

[Enigman]

Didn't read the other responces: take it to a certified computer expert ((or have one come to you)), sounds like you caught something mixed in with flame core my dude. even zeroing each wont get rid of flame.

Just my 2 cents for you.

[Bad Aim]

Originally posted by emoticorpse:

Originally posted by Joshua Ballard:

Never considered my router. Time to change passwords on that too.

Update the firmware and disable wps

So, it took me a bit to relearn how to get into my router and change my settings. I did disable WPS after looking up what it was. That is a good call, thank you.

The router actually updates itself. The router had auto-updates enabled. When I attempted to update the router, it said I was fully up to date.

I changed the password for both WiFi and the Router itself.

This router does have a couple of features I have never heard of. I bought the router because it was recommended by the Best Buy employee and it had a pretty good review at Amazon.

It has 4.4 stars and over 1000 reviews on Amazon.

It does have some features that I am unaware of. The guy at Best Buy said that my router was designed for for gamers as you can give priority to things like online gaming. I just saw some settings in my router that eludes to that. But, I really don't know how I would take advantage of it. I can't exactly take my computer setup to a computer shop and I doubt that the computer shop simply having the router is going to help.

Maybe I need to find a "Routers for dummies".

I have a Linksys Dual-Band WiFi 5 Router.

https://www.linksys.com/ea7200---dual-band-ac1750-wifi-5-router/EA7200.html

If anyone can give me a push in a direction that will help with gaming and more security, I would be grateful.

Thank you!

[HypersleepyNaputunia]

look in router logs for unique devices that might have connected to it too. If its not yours, some passerby might be hacking in