this post was submitted on 07 Jan 2024
182 points (95.5% liked)
Technology
59402 readers
4015 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Perhaps a better question would be to ask why they are allowing 14k separate logins from (what was probably) the same IP address? If you ask any big email provider, they will tell you they immediately shut down any access from that IP due to suspicious behavior, while simultaneously resetting the passwords of all the accounts that appear to be compromised. Typically you should have records of the IPs used for previous logins so it's fairly simple to compare records having suspicious activity and see if the accounts in question had any previous relationships with each other. And once you have that information on hand you can use it to monitor the compromised accounts for any further login attempts by unknown IPs and then block THOSE addresses as well.
When you have that many active user accounts, you do not just settle for simply accepting the correct credentials.
You are aware that IP spoofing exists? It's not impossible for the hacker to have appeared to have been connecting from many different connections.
Yes I am, as I'm sure you are aware that IP spoofing is pretty much only relevant where you are sending outgoing packets (like in a DDoS attack) and do not expect to receive any information back. If you need two-way communication over TCP, spoofing doesn't work because the returned information naturally gets routed back to the host of the real IP and not to the spoofed address. Obviously these attackers received some information back.