A Hacker's Paradise

Jeeeeez, why is it that virtually all the stories like this come from GMail users? Is it a coinsidence? :NOTSURE: 

This is why you memorize passwords instead of saving them on your system.

Leo, I think people have problem because they don't research and look at things close enough and yes, they always just have to have it because it's the new toy out.  :NOTSURE: 

Flash is the "new toy out"? IM is the "new toy out"? GMail is the "new toy out"?

Don't buy into that - my point is that it *IS NOT* just the "new toy out must clicky" people who have problems. I have used computers since 1982, been online since 1991, and have NEVER had "these kind of problems", which is why I make such a big deal out of this. I have a very secure system - the fact is that you can NEVER have a completely secure system unless it is unplugged from the net.

I am definitely NOT one of those who believes like many do now that losing passwords and getting hacked is "normal" - it is far from normal for careful users. Which is why when it DOES happen, it points out just how insecure computers really are.

You used an "autocomplete" service for your passwords. No, it's not "normal," but it greatly increases your risk.

Yes, I had Pidgin save passwords for the SIX DIFFERENT LOGINS it has. Do you type 6 seperate passwords every time you reboot your computer?

Insecure, somewhat. Storing all 6 of those passwords in a plaintext file in the user's home directory? Extremely insecure. Pidgin developers claim that to encrypt the file would not help. I disagree. My eBay password, my Paypal password, etc, are all stored by Roboform in an encrypted file. Were they stolen? No. The stolen passwords were the low-hanging fruit - clear text passwords stored in an easily readable file.

Fact is, 99% of users out there click the "save password" button on their IM clients. There is an expectation that the software would treat those passwords responsibly, and in the case of Pidgin, it did not do so. I just checked Trillian, and it stores obfusicated passwords. Are they hackable? I have no idea - I don't know what level of encryption the developers used - that's why they are developers and I'm a user. But at least it isn't clear text.

Anyway, the point of this article was about how hackers can get into your system. The number of holes in Flash Player is incredible - I had no idea that such a ubiquitous application was so insecure.

Actually...I use about a dozen different passwords on a regular basis, and I do remember them all. I had to learn how to memorize sometimes arcane combinations for a previous job.

I do sympathize. Getting hacked really sucks (for lack of a better term), and I'm sorry you went through such an ordeal. I'm also surprised that Flash has so many holes, though I shouldn't be - it tries to do way too much.

Okay, I'm reading this and since I don't have Vista you will need to perhaps enlighten me a bit. Anytime I've had problems has been a result of my own stupidity of connecting to the internet from a administrator account with full privileges.

Having AV, Firewalls, etc is the equivalent to leaving your keys in the ignition of your car, locking the doors and figuring everything will be fine. Chances are someone who knows what they're doing will be able to open those doors and steal your ride.

I agree with you that storing the passwords unencrypted in text format especially in today's world is a big blaring error. Sadly I'm not surprised and a little tour through my registry in the past has turned up other app's that store unencrypted passwords there.

You answered yourself. Ten minutes is all they need - 12hrs is a lifetime. Are you sure only passwords (kept in plain text...egads) went missing?

I wouldn't be suprised to find your pc is a zombie.

A fully patched Vista system should not be compromised without a hardware firewal, and I challenge you to show me that it can - not counting 3rd party software flaws (which appears to be what this is about).

It is this naivity which got you hacked. Even a modest expert can hack Vista in under ten minutes.
By all means go ahead thinking you are secure, I wish you well...

Yeah, exactly. although that totally sucks that that happened to you.

~I love Fuzzy Logic's icon. Spock! wow, I'm a nerd. although that was on last night

anyhoo..... yeah, vista is full of holes. what you have does make you significantly more secure but I'm bias and I say just get a mac. oh wait, no stardock stuff for Mac. um..... stardock should make stuff for mac, that'd be sweet!

?
So if I got it right about Firewalls
the firewall that comes with XP or Vista are not good enough by them selfs?

Fuzzy's right. In fact, I think I recently read somewhere that certain virus's can invade your system and can be in your boot up files which are not detectable by the usual commercial AV programs. If it's a 'key logger' then even remembering your passwords is not going to help as every move on your keyboard is being watched. This is how I read it but I maybe getting 'things arse about face'. I'm sure it was on the BBC website and I think they mentioned a program that I had never heard of that could deal with this problem :NOTSURE: 

Right. The built in firewall has no outbound protection. That means trojans and malware can communicate out, it also means once a hacker is in, the firewall may as well not be there. Vista pcs are just as prone to becoming zombies as any other.

If you are unsure, test your pc security here WWW LINK to Shields Up You may be in for a shock

I tested my pc security with that site there, Fuzzy, just for the heck of it

Was I shocked? No, not at all. More like surprised......

The results:

File sharing:
Your Internet port 139 does not appear to exist!
One or more ports on this system are operating in FULL STEALTH MODE!

Common ports:
Your system has achieved a perfect "TruStealth" rating. Not a single packet — solicited or otherwise — was received from your system as a result of our security probing tests.

All service ports:
Solicited TCP Packets: RECEIVED (FAILED)
Unsolicited Packets: PASSED
Ping Echo: PASSED

One of 1056 ports were detected as 'open'

Messenger spam:
Dunno what the heck this test did, but nothing what so ever happend......

Browser headers:
Did what it said it did..... not that I fully understood it

-------------------

And what type of "security" apps am I running?
One word: NADA!
Apart from Avast and Vista firewall I have nothing "protecting" my pc

Your Internet port 139 does not appear to exist!
One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.
Unable to connect with NetBIOS to your computer.
All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

Common Ports
Your system has achieved a perfect "TruStealth" rating. Not a single packet — solicited or otherwise — was received from your system as a result of our security probing tests. Your system ignored and refused to reply to repeated Pings (ICMP Echo Requests). From the standpoint of the passing probes of any hacker, this machine does not exist on the Internet. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system wisely remained silent in every way. Very nice.

All Service Ports
GRC Port Authority Report created on UTC: 2008-02-25 at 00:21:28

Results from scan of ports: 0-1055

0 Ports Open
0 Ports Closed
1056 Ports Stealth
---------------------
1056 Ports Tested

ALL PORTS tested were found to be: STEALTH.

TruStealth: PASSED - ALL tested ports were STEALTH,
- NO unsolicited packets were received,
- NO Ping reply (ICMP Echo) was received.

The Messenger test was negative. I recieved noting on MSN.
Not sure about the Web Browser test. Secure and unsecure pages were exactly the same....

Does it make you feel good to paint me as a clueless n00b? Does it make you feel more secure?

Fact is, I have taken every precaution I could. I do not believe it was a firewall issue, as there are much more obvious security exploits available that do not require getting around a firewall. I don't believe I was being targetted personally, so a "drive-by" exploit is most likely - and they are extremely common.

I have been using the internet since 1994 and BBS systems before that on a DAILY BASIS and have never gotten a single virus on my system, perhaps until now. Very few people have that kind of track record. I never got a Gator Infection, never had IE stuffed so full of toolbars I couldn't use it, and have had a hardware firewall ever since I've been on broadband.

You try getting a technician to reset your internet connection when he won't talk to you unless you detach your router. Apparently RR can read through the modem what is connected to it - he told me the brand of my router and refused to continue unless I took the router out of the loop. I reiterate, however, that I do not believe it was the router.

I have identified numerous KNOWN holes in POPULAR software that I used on my system. None of these are actually holes in the base OS. I'm not saying there aren't holes in the base OS, and I'm not saying that an experienced hacker couldn't get in. What I AM saying is that most of these kinds of hacks are done using PUBLISHED EXPLOITS. There's no need for a Russian Hacker to sit there and hack at my system when he can put up a website which takes advantage of a hole in a plugin such as Flash or Acrobat, or Pidgin, or Firefox, etc, and can just grab info from any random Joe that lands on that website. This is how it is done. If a hacker personally targetted and hacked my system, I'm sure he would have bothered to get things such as my PAYPAL or EBAY password, for instance. Instead, it was low-hanging fruit.

I have taken additional security measures - such as reinstalling my OS - even though I am relatively certain it was itself clean. I do not take chances, as you seem to imply.

You seem to believe that you are somehow immune - I propose that you have been fortunate. Proper security measures definitely make you MUCH safer - I can attest to that with my own lack of problems over the years - but you are never 100% safe unless you are completely unplugged from the internet. In fact, that's not even safe if you consider cases such as the recent fiasco where digital photo frames sold at several retailers had a particularly nasty virus in the firmware this holiday season. How many people got infected by that who had taken all the necessary security measures?

Buy a computer. Wrap it in bubble wrap. Put it in a air-tight box. Place the box in a firesafe. Dig a hole 12ft deep. Bury the firesafe. Then you won't get a virus
Unless you don't use the computer, you could always get a virus. Thats why you gotta be secure.

Hey Fuzzy, thanks for the link, after a first failed test, two ports open, I removed some not required items from the exceptions list of WindowsXP firewall and second test was a pass, completely stealth.

In a home environment, you can easily keep a notebook with passwords, account numbers and log-ins, and the like by the machine. If someone breaks into your house, well, you've got other issues. I never keep potential blackmail bait on here - any "private" photos or the like are placed on a disk and cleared from the hard drive. The idea is not just to make it difficult to get into my machine, it's to make it not worth the energy spent. If someone does get on here, well, they can look at pictures of giant robots.  

I once setup a computer with a fresh install of XP Pro ....and AVG...went online and downloaded the AVG sig update and logged off again.

Ran the update and scanned the machine...I was dirty already.  Probably online not much longer than a minute or so...;)

Same here, Jafo. I did a clean and reinstall for a friend a couple of years ago and in the three minutes we were on line getting the AV downloaded the damn machine was infected and I had to start all over again.

Actually, Lotherius....I've NEVER had a virus on my PC. EVER. Period. And I've had the 'net since....ummm....well, a long-ass time ago anyway. I'm a freak about internet security. Probably comes out of being obsessive-compulsive.

I change my passwords frequently. I run my AV scanner daily (as well as a spyware scanner). I don't go to websites I know nothing about. I don't trust GMail, Hotmail (although I do have a Hotmail account for MSN Messenger), or any other web-based email proggy (I like my Outlook Express).

I don't store passwords on my PC, encrypted or otherwise. I've got them stored in the safest place of all...my memory. And unless someone wants them bad enough to put bamboo slivers under my nails or threaten to kill my loved ones, well....I figure they are safe from hackers in my brain.

There is no perfect one-fix for hacker prevention. But with the right combination, you can sure stump the hell out of 'em!

I like to put all my files in strnage file formats( I store my Pictures in Stardock's .SDC format, since I figured it out). So if someone breaks into my comouter it will be somewhere along the lines of: "WTF??!?! HOW DO I OPEN THIS **** THING!" Since there is no SDC extractor that I know of,(except the one I made that a Wizop told me not to post.) Maybe you should invent your own archive format? .bob maybe?