Password reset - different name (Investigating)

[aaaanditsgone]

Hi,

My virgin media account password has been reset by someone else several times since last Friday. Shortly after it happens, I lose access to my email and have to reset the password to regain access. I have also changed the recovery answer to a long random string which didn't help.

Is there some kind of exploit with the password reset system that allows an attacker to bypass the recovery question? The last two password reset emails even show a different name to the one from my account.

Thanks

[MOD EDIT: Currently under investigation. Multiple threads merged]

[Chromeboy]

@ravenstar68 - Text of email message received on 14th November 3.37pm UK time.

Subject:  Virgin Media - You've updated your password (KKM78795976V40194L0KM)

From:  Virgin Media Web Team  (webteam@virginmedia.co.uk)

Hello ROGER,

You have successfully reset your password.

You'll need to use the new password wherever you use your My Virgin Media account to log in.

If you haven't tried to reset the password for your My Virgin Media account and this wasn't you, please contact us.[hyperlink to help pages]

Kind regards,

The Virgin Media team.

[oakleyd]

Very good assessment. There was a data breach in 2020 where 900k emails were stolen from virginmedia. They were supposed to contact all of those affected but I never received any notification, but that of course does not mean that my email was not one of them.
I concur, the main target here was definitely cryptocurrency. If you had emails from exchanges etc, then this would have been their primary target as gaining access to someone's crypto assets would be both lucrative and almost impossible to trace. Fortunately I no longer have any of those assets, so they were wasting their time 🙂

[ravenstar68]

The text of an email can be very easily replicated - all you need is access to one password reset email.

Scammers will also use genuine resources such as Images or links from the company who's users they are targeting.

It's the full original mail I'm interested in.  If someone can provide one, drop me a PM and I'll give you my address - It's important that the mail be forwarded as an attachment in order to retain the original source.

Tim

[用心棒]

---

@ravenstar68 wrote:

I'd be interested in seeing the source of one of the ORIGINAL emails that triggered this thread

Something doesn't sit right with me - If it had come from Virgin Media's systems themselves then why did they all have the wrong name?
⋮

---

Virgin Media's action of locking affected accounts strongly suggests the emails being received were authentic but I guess there is no harm in confirming.

BTW: a year ago there was a similar naming issue affecting account, see following:

• https://community.virginmedia.com/t5/Security-matters/No-one-at-Virgin-media-can-give-me-an-answer/m...
• https://community.virginmedia.com/t5/Security-matters/VM-don-t-take-security-seriously/td-p/4860316

[kennyc]

I also got the email about changing password from Roger about 5 days ago and unable to access emails since.

What can be done? Won't let me reset the password it said I was to call Customer Services so I did but still no further forward.

[ravenstar68]

TBH I haven't been on here nearly enough as I used to be, I've been busy looking after my family.

I have had a copy of an email sent to me via dropbox, and it definitely appears to come from VM's own systems. Both DKIM and SPF validate.

It's definitely a strange issue.

[jem101]

---

@ravenstar68 wrote:

TBH I haven't been on here nearly enough as I used to be, I've been busy looking after my family.

I have had a copy of an email sent to me via dropbox, and it definitely appears to come from VM's own systems. Both DKIM and SPF validate.

It's definitely a strange issue.

---

Tim

Yes, I’m quite sure that the email which people have reported as receiving, did indeed originate from within VM’s infrastructure. But that is simply an automated response to a change request, ie a password reset. Now, the issue is not the email itself but what triggered it? Was it a software error which caused erroneous messages being sent out, but quite a few people have found that they have been locked out of their email and (true these are apocryphal stories, but so), reports of this event being closely followed by attempts to change passwords on other sites. So it does look as if, for some users, their passwords have indeed been changed without their knowledge or consent.

Now I’m sure that you are just as aware as I am of the dangers of misattributing simple coincidences to something more sinister, but still, something isn’t sounding quite right. The almost total radio silence from any official VM source for a week other than a generic ‘yes we know and are looking into it’, followed by a ‘some email accounts have been locked and to unlock them you now need to call customer services on ……’, does sound ever so slightly suspicious no?

And then there is the universal lack of any posts or comments from the VIP members until yesterday, which again is unusual, of course a more cynical person than I might well wonder if ‘you know who’ has asked the VIPs to not comment until a damage limitation team has worked out what has actually happened? But, of course, I’m just speculating!

Of course, there is the possibility that this was all just some kind of glitch in the matrix software issue, dodgy update etc. and the lack of comment from VM et al was purely a coincidence, this thread just got overlooked, until now! Everything is secure, everything is fine, really nothing to see here, move on….

Or…….

So what do you all think?

[emailfried]

My email apps wouldn't log me in to my virgin media email on the morning of Saturday 12th November. Phoned virgin and chose option 5. After 40 minutes my email password was reset by the operator. I immediately logged in and changed the password. My inbox showed an email with no name specified after the Hello text timed at 12.01 which was around the time of my change. OK I'm sorted then, but what's this.. . Scroll down to earlier emails and there's one from Web server team timed at 05:59 on the 12th addressed to PHILIP You have successfully reset your password.  So for 6 hours my account was not accessible by me, but PHILIP could have had total access. I was also ROGERED on the 14th. If it was internal issue the fact that ROGER and PHILIP were the names addressed in the email should allow Virgin to track the issue and explain what happened eg test system accidentally pointing to live accounts, but I would want to see batch logs to prove this. Virgin raise a complaint option doesn't appear to work. On Twitter virginmedia.com totally ignored my tweets on the 16th and 17 so https://ico.org.uk/make-a-complaint/data-protection-complaints/personal-information-complaint/  appears to be the way to go. I have all the emails to prove this. 

[kennyc]

Has anyone had any success getting into their email after receiving the ROGER email? I got mine 4 days ago and can't login since. For context I have a virgin.net email.

I called VM for 50mins but they said since I do not have an active account with them they cannot reset my password. It will not let me reset password online.

[emailfried]

Hi kennyc, virgin reset my password over the phone after I had the ROGER email. I do still have a broadband subscription with them. While trying to find out what had happened to me I resorted to twitter and there were some posting that their email access had been removed because they no longer had a virgin subscription so their email had been flagged as orphaned without giving them any notice. The last post I saw was from somebody who reported that virgin had said that as their account was orphaned nothing could be recovered. Hope that's not the case for you.

Not sure if this link will work https://mobile.twitter.com/virginmedia/status/1592616486392147969