Hacked account?

[Guy 1]

Hi - I just got an email saying, " You recently attempted to send an email message from your Evernote account. Unfortunately, we are unable to deliver the email to your intended recipient(s). "

However, I didn't try to send any such email (there were 2 of them, both with the subject, "Hey"

Does this suggest that my account has been hacked?  I also got a password reset notification from Soundcloud yesterday, saying they are resetting my password due to suspicious activity.

Can someone please help me understand what's going on?

[gazumped 11,663]

Hi.  This is a public forum and email addresses can easily be harvested by spammers so you're doing the two addresses you quoted no favours by leavig them out here - I'd suggest you edit your post to remove them.

There is an option in your account to send notes by email to others,  but AFAIK it's sent from a no-reply@Evernote address,  so it may be that some spammer sent an email spoofing your address and claiming that an Evernote note was attached,  in the hope that the recipients would open it.  Clearly it would be a good idea to change your Evernote password regardless,  and do a malware scan on your computer.

You should also contact Support if you're a paying customer or tweet them if not..  https://www.evernote.com/SupportLogin.action or https://twitter.com/evernotehelps

(We're a -mainly- user-supported forum,  not a direct line to the company.)

[JohnLongney 83]

Yes, there is every chance your computer has been hijacked and is used as a bot. Your ISP would be another source of help to get in contact with. Malware scanners do not always detect infection because at the mildest level of infection your PC/internet connection does no more than help distribute these mails.

I reported your request for help to the admins of the forum to get those 2 mail addresses removed pdq.

[DTLow 5,736]

1 hour ago, Guy said:

I just got an email saying, " You recently attempted to send an email message from your Evernote account. Unfortunately, we are unable to deliver the email to your intended recipient(s). "

 

[JohnLongney 83]

6 hours ago, DTLow said:

Unfortunately, maybe for security reasons, the explanations given by gbarry are somewhat vague. The instructions how to proceed are standard enough. However, only if one can nail down the culprit can one give real advice on what to do.

Web services that do not insist on  2step verification play into the hands of hijackers.One of the reasons why customers  are made to pay fees is to cover those costs as well.

 

[gazumped 11,663]

4 hours ago, JohnLongney said:

One of the reasons why customers  are made to pay fees is to cover those costs as well.

Evernote offers 2step but it's not compulsory,  and AFAIK none of the web services I use - gmail / google drive etc - make it compulsory to use 2 step verification,  though it is available. 

And what extra costs does a service incur through being hacked?  Any web service should continually be keeping its online security up to date and effective.  Being hacked is a wake-up call that there's a vulnerability in the system somewhere that needs to be fixed.  That's a normal operating expense.

[JohnLongney 83]

@gazumped

no, no, there are lots of services which make 2step verification mandatory. One may have almost forgotten that this is so until one wants to use a new device or needs to access  account settings or contact support. 

 2step verification is a cost factor, mimimal for one customer, but in total not to be neglected. Whenever one has heard about company servers being hacked with millions of accounts potentially endangered, in 99% of cases you need not worry because by the time the general public gets informed another set of shields have been implemented on the server-side. 

Free accounts run by the giants in the business are not unsafe. However when it comes to the terms of the business, there is a world of difference between free, cheap, somewhat more costly or fully supported, guaranteed etc accounts. 

As to risks of hacked accounts? For the individual the risks may seem small. But they do exist. People have had their bankcards frozen because they did not inform their bank about a massive email account incident. Be aware that there is an awful lot of data exchange between institutions who not only want to protect themselves against claims for damages but who are compelled by law to keep the risks of further damage to others very very low. 

 Laws differ from country to country but as the risks of attacks by certain militant groups with their intents of practically overthrowing all civilised life across the globe are evident in almost daily news, and as these people fund themselves to a growing degree through internet  use, including demands for ransom payments, there is a growing degree of consent that higher level of security measures for all are the only way of keeping abreast. 

Even in the world of 2step verification a variety of tools are available. My bank for instance suspended txt messaging of transaction codes to phone because that particular bank anticipates risks of phone tapping. At first I thought, yet another way of ***** money out of customers, because with neither transaction list of unique codes nor unique SMS codes allowed any more but having to use a (paid for) device plugged into the PC with bankcard inserted to prove identity, giving access to a special bank app which then okays transactions, internet banking away from home PC is practically not possible any more. I had quite a long talk with one of my banks IT clerks and that way learned why SMS (txt) messaging was dropped. Txt message had to show transaction number plus transaction details, as such in the wrong hands, too much of a risk for the legal parties concerned.

How does that relate to Evernote? There is certainly more than one possible scenario. Negligence on the part of a user is one, accounts hacked at the server end also possible. 

Evernote, with the current set of security standards would not qualify for business use in the EU. Not even for storing a list of customers. 

Ever had a 'happy dropboxing mail' to tell you that they'd spotted your login point a few miles away from your wifi home address? German Telekom have a habit of switching over clients to a less loaded server quite regularly. Through Dropbox alert system I learnt about Telekom server sites with precise geographical data. I wonder if the sleepy bunch at Telekom know all that.

So yes, normally when you pay a small amount goes into more advanced levels of protection. Sometimes legal requirements (of real use or not) see to that. 

A rail ticket bought online with credit card here is tied to verification on a particular device. I once forgot my mobile charger and luckily a friendly fellow passenger helped me out with his charger because the printout of the ticket shown together with credit card was not guarantee enough to prove legality.

What can seem over much may have it unknown reasons.

 Evernote stores notes. Used with common sense fine. I would prefer to see Evernote going public. Do I need to explain why?

 

 

[gazumped 11,663]

Hi John.  Thanks for the long reply.  You are perfectly correct - I had a phone meltdown recently so dug out an old 'phone while the normal one went for repair.  I've had a barrage of emails from various services saying 'someone logged in from a different device!  Was this you?' as I installed back my current apps and got it up and running.  So there is a lot more Evernote could do - although security can go too far;  I tried to pay a new company from my bank account today.  The normal 30-second process eventually took an hour and a phone call to beg (after practically supplying a DNA sample to prove who I was) them to release my money. 

(And yes,  I appreciate they were looking after my interests,  that's why I let the nice man lecture me for 5 minutes about viruses and malware and the nasty people out there who want to scam me,  without being rude or abrupt,  even once. That was my good deed for the day...)

[hugh o'donnell 0]

I am seeing the word Evernote alongside names of people emailing me in legit discussions. It appears in the inbox listing but not in the main body of the message.

why is it piggybacking my emails I used to use evernote but closed my account

[hugh o'donnell 0]

I am now seeing the word evernote in most of my incoming messages in the title

[gazumped 11,663]

On 03/12/2017 at 12:48 AM, hugh o'donnell said:

I am now seeing the word evernote in most of my incoming messages in the title

Hi.  If your emails are being received through a standard email client like Outlook,  or an internet mail service like Google,  I can't think of any way that Evernote could influence what's shown in your message titles.  Could you mail yourself a test message and post a screenshot of how it looks when received,  so that we can see exactly what the altered content looks like?

[ubaidsameja 0]

On 4/9/2017 at 6:18 AM, gazumped said:

Evernote offers 2step but it's not compulsory,  and AFAIK none of the web services I use - gmail / google drive etc - make it compulsory to use 2 step verification,  though it is available. 

And what extra costs does a service incur through being hacked?  Any web service should continually be keeping its online security up to date and effective.  Being hacked is a wake-up call that there's a vulnerability in the system somewhere that needs to be fixed.  That's a normal operating expense.

2 step verification is a sure way to know that hackers don't get to misuse the account. it is basically for people who want to use that account on various devices. never the less it should be opted for as it adds to the security of your account

 

On 4/9/2017 at 6:18 AM, gazumped said:

Evernote offers 2step but it's not compulsory,  and AFAIK none of the web services I use - gmail / google drive etc - make it compulsory to use 2 step verification,  though it is available. 

And what extra costs does a service incur through being hacked?  Any web service should continually be keeping its online security up to date and effective.  Being hacked is a wake-up call that there's a vulnerability in the system somewhere that needs to be fixed.  That's a normal operating expense.