Re: Grendel Good advice to the other poster. Regardless of if you do online transactions or not-- most people do not realize how much info they store on their machines or even how much info they release through email. A user id and password is not too hard to obtain if someone is resourceful and chooses what to do with that knowedge.
Re: Re: WEP I can understand that. Again, you already made my point: How do they get corrupt? Users. Users are the single largest security risk!
Re: Re: Bill beat me to it.... That's why I run virus scanners on my systems every night. I run 3 of them in rotation, one a night and on different schedules. For instance on one machine on Monday nights I might be running Norton and at the same time McAffee on another machine and Thunderbyte on still another machine. The next night each machine will run a different scanner than it did the night before until all of them have run all of the scanners and then it starts the cycle all over again. That should catch just about anything that does manage to get through.
Re: Re: WEP *laughs* Yeah that is the truth. Of course it is never a users fault. Speaking of hackers-- *laughs* where I work we have had people walked out in my department because during their downtime they thought it would be funny to hack into our own network and play just for fun. Always just to see how far they can go. So in any environment and if anyone is really intrigued enough and gutsy enough to try-- I think they will find a way. Similar to what one of my industry rags have a special hack week where techies try to hack into various machines and areas to find out current vulnerabilities and how to prevent the said vulnerabilities.
Re: Re: Bill beat me to it.... It should. Another good utility is ad-aware or something that detects spyware and trojan'd programs. AV Huristics are great, but they contain every negative. I also update my A/V twice a week.
Re: Re: WEP I actually teach an applied hacking course for SANS. It's amusing for the first hour or two. We have a question and answer session. Most people are unaware how easy it is to get into non-hardened OS. They're also unaware that most hackers come from within. 98% all of hacking activity in 2002 was precipitated by "social hacking".
Re: Re: WEP The only thing I ever wanted to HACK into was EXPERIAN, EQUIFAX, and TRANS UNION to ERASE ALL THE INQUIRES!!! I DON'T KNOW HOW TO "HACK" SO IT WAS A MOOT POINT...
Re: Classes and the such When I finished up my bachelors I took some of the networking and compsci courses for easy As... *hehehe* I have already been doing it for awhile so might as well just spend sometime getting an easy grade. I had a class where groups were divided up into Windows Servers, Novell, and RedHat boxes. Within 10 minutes of one group bringing their box live--- their little Win2k server was hacked into pretty visciously. Needless to say the professor who was waken and called late at night by the network engineers was less than thrilled. Apparently this one group thought all they needed to do to really secure their server was to run the critical update and apply a few patches.
Re: Re: Bill beat me to it.... Yes, I also run ad-aware on all my machines. Every time they boot up ad-aware runs. I've recently heard of another one that is suppposed to be better called spybot but I haven't even tried to find it yet. Been too busy with other things.
Re: Re: WEP The latest issue of PC Magazine (April 22, 2003) has a cover story about "spyware" -- software that attaches itself to your computer without your knowing and can transmit sensitive information to someone else over the internet thereafter. Needless to say, for those concerned about identity theft, this is a critical topic. Evidently one of the worst proffers of spyware is KAZAA (a file/song sharing service, sort of like Napster but still in business). It's evidently a very cool service if you like sharing songs (kazaa.com -- you may not want to go there given the circumstances), but it comes with a terrible price -- several different kinds of potentially harmful spyware being planted. Thankfully the article recommends (PC Magazine Editors' Choice) a freeware software called "SpyBot Search & Destroy" written by a German company that hunts and removes all of the major spyware programs currently released! Here's a link to that site: http://spybot.safer-networking.de/ The above site also has a lot of great general info about information-stealing spyware, btw. Doc P.S. I found it interesting to learn that spyware programs can attach to your computer by reading certain spam mails, by visiting certain websites -- especially porn or hacker sites, or by installing certain hacker programs (like file sharing programs)! If you read your mail, you're vulnerable and may benefit from running "SpyBot Search & Destroy" occasionally.
Thanks for posting, but anyone who gets an email asking them to go to some website to verify their identity, and they actually do it, deserves to be had. Emails like these are not new by any stretch of the word..
rackt3, I think you misunderstand. Spyware can attach itself when you simply read certain emails that incorporate HTML and ActiveX. Moreover, if you've even visited certain unsavory sites even by accident, certain kinds of spyware can attach. You don't have to go anywhere and give anything to fall victim. Please consider my suggestion to read the latest issue of PC Magazine. Doc
Actually, I had just read the first message on this thread and hadn't read any further before hitting the "reply" button. So I was responding only to the message about people going to websites and entering personal information because some email asks them for it. As for spyware, I did read the article about Kazaa's spyware... but thanks for posting the link to that german company
Re: Re: Re: WEP Spybot works very well. I have a dedicated machine for filesharing. I also run Kazaalite www.kazaalite.com. I also collect spyware, Virii, trojans and the like. Of course that box is on my DMZ. I also have a honeynet at home. Also, I don't know that spyware can be installed from HTML. However there are sites out there that can grab information from your browser. Information like login, email addresses and other personal info. ActiveX and Java get a little more risky. Should also clear out your cookies occasionally. There are sites out there that will read your cookies, to determine how to best serve pages to you. They're not supposed to cache that info but frequently do.
Re: Re: Re: WEP As of yet, HTML is safe. But as mentioned, HTML with ActiveX/Javascripting is where the threat lies. Cool thread for the geeks. Hehe. My 2 cents: 1. Antivirus: F-Prot - www.f-prot.com 2. Firewall (software): Zone Alarm - www.zonelabs.com 3. Anti Spyware: Ad-aware - www.lavasoft.de.
Re: Re: Re: WEP I have to say this is an excellent program. It was recommended to me by Witz the Genius, after I was unable to access my EQ Fico score. I downloaded the program, ran the detection and POOF, I was able to view my FICO. There was sooooo many hidden files on my computer. I think the Evil EXP is planting some of them.
Re: Re: Re: WEP Quote from the April 22 PC Magazine cover story I mentioned: "...hence Heatherington's suspicious traffic. None of the Heatheringtons remembered downloading Xupiter -- unsurprising, because Xupiter is a 'drive-by download.' If your Internet security controls aren't properly set, just visiting a Web site or clicking on a Web ad can install an app. Your PC may be similarly infested." Ugh. Doc
Re: Re: Re: WEP Doc, they had to have changed their settings in their browser. At the same time, it also had to have been something tunneled into HTML like ActiveX or Java. I don't run those natively in my browser, a lot of people do. HTML itself is harmless, but it can carry other types of not-harmless objects. That's what we're talking about.
