Azure : Users | Sign-ins -> IP Address query

[kennysarmy]

We've had an incident of a student claiming their account has been "hacked"

 

On checking the "Sign-ins" in Azure I can see the same IP address has been used by two different students! Suspicious. They live streets apart.

 

Correct me if I'm wrong, but IP addresses logged will be unique to the router in the property?

 

The only way the "hacked" student could have the same IP address is if they were physically at the same location as the other student?

[MatthewL]

Not necessarily depends on the ISP.

 

Could be carrier grade NAT in use same ISP but same external IP, similar if wireless provider provides internet not always have their own IP, could be using the same proxy just to name a few.

[jnfarmer]

That's my understanding of it. Most ISP IPs are dynamic though, whether it was just (mis)fortune that meant that IP for one friend then moved to the others...? Most of the time though, best to go with your initial thought.

[kennysarmy]

A lookup of the IP normally used by the "hacked" user is shown to be an EE one.

 

The "rogue" IP address used is with a different ISP.

[chaplic]

Mobile users (so 4G on a phone or a 4G dongle etc) share IP addresses with carrier-grade NAT so can appear on the same IP at the same time.

[kennysarmy]

The "hacked" student appears to normally use a Windows 10 device using Edge 88.0.705 to access Teams.

 

When the incident occurred her account was using Chrome 88.0.4324 on a MacOs

 

Curious

[kennysarmy]

One of our pastoral team has just sent me this....

 

I have just come off the phone to student X, who has said that he has not hacked/been onto anyone else's account and thinks someone maybe trying to frame him. I asked him if he had fallen out with anyone etc and he said no.

 

He said he thinks someone maybe using his IP address when they do this. I asked him how that can happen, and he said that he did not know, but knew it was possible. He intimated some of his friends could so I said that he needed to think tonight about whether he knew who was doing this/could be doing this and let me know. I told him I would speak again to IT to see what you thought of what he has said.

 

Thoughts please.

 

 

 

I know what I think!!!!!