Active Hacker in process

[winston-smoker]

At work they're advising that fake e-mails are proliferating with links to change your password. DO NOT RESPOND. Instead, go to your institution's website by typing the web address in the toolbar to change your passwords.

I don't write my passwords down (I agree that it's a bad idea in the event your 'post-it note' gets misplaced). But it does get challenging devising combinations of letter and numbers in a sequence that I can easily remember, especially considering that I use at least three differing user IDs and passwords. Some sites force me into changing passwords on a regular basis (the university is one of them, and it won't let you reuse your past three passwords).

 

[Knucklehead]

Received from McAfee today:

Dear McAfee Customer: Recently, a major security vulnerability named "Heartbleed" has made headlines around the world. This is a severe vulnerability stemming from a coding mistake in a widely-used security utility called OpenSSL. The bug affects the encryption technology designed to protect your sensitive data on the Internet, like usernames, passwords and emails. This is a flaw in the OpenSSL encryption code, not a virus that can be stopped by McAfee or other consumer security software. Because this vulnerability takes advantage of servers, and not consumer devices, businesses need to update to the latest version of OpenSSL to mitigate and address the dangers posed. McAfee is currently in the process of auditing all of our services, and the services provided by our partners, for any dangers posed by Heartbleed. If there is any instance that the vulnerable version of OpenSSL is in use we will remediate with the utmost urgency. The severity of the Heartbleed vulnerability cannot be overstated: several major enterprises use OpenSSL, and are likely affected by this vulnerability as well. The dangers posed by this vulnerability are very real and could affect you if exploited. So what do you need to do? Right now, the best thing you can do is wait to be notified about affected services and patches or you can investigate this list provided by Mashable that has some well known brands listed. If you'd like to investigate whether or not a website you frequent has been affected, you can use this tool. Reset your password for every online service affected by Heartbleed. But beware: you should only change your password after the afflicted business has fixed its servers to remove the Heartbleed vulnerability. Changing your passwords before a company's servers are updated will not protect your credentials from being leaked. For additional details, please click here. We at McAfee apologize for any inconvenience this may cause you. We will be contacting you again as we update our services that use OpenSSL. Thank you for your time, and safe surfing. Sincerely, Gary Davis

 

[Brown Thumb]

That looks worse than a Hornworm Infestation.

 

[webmost]

"The severity of the Heartbleed vulnerability cannot be overstated"...


Humbug. Anything can be overstated. Even sex can be overstated. Get a grip. Have a cigar. Chillax.


Here's how it works: Let's say you are logging into your account at Bailedout Bank. Your username is taxslave and your password is bendover. You load the bailedout.com login page in your browser and enter taxslave and bendover. Before sending them, your browser asks Bailedout "Are you there? I want to talk in private. I'm sending you the six letter word bohica." Bailedout's server replies "I got bohica" in acknowledgement. All cool so far. Here goes password and username.


In the very same exact fraction of a split nanosecond, Sum Dum Chinaman hits Bailedout's login page with a program which asks Bailedout "Are you there? I want to talk in private. I'm sending you the seventeen letter word ricecake." Wait a minute... that's not seventeen letters long.


Right now, this thing can go one of four ways. 1) The server may not be using openssl. No prob. 2) The server may be using any version of openssl previous to the one with a flaw in it. No prob. 3) The server may be using a version of openssl subsequent to the version with the flaw. No prob.


Nobody talks about the likelihood that those three results will happen the vast majority of the time. Soon as I heard about heartbleed, I tested every server I am associated with (and I am an IT geek)... not a one affected.


OR, bailedout.com may be on a server with the affected openssl version. In which case it sends back: "gobbledeegookgobtaxslavebledeegookgobbledeegookgobbledeegookwrongciphergobbledeegookgobbledeegookgobbledeegookgobbledeegookgobbledeegook"


It's the old stack overflow. The gobbledegook and the message inside it may be 500 characters long. That gobbledegook is whatever just happens to be whizzing through memory at the speed of light at that exactimundo instant. The server has got at the very least four or eight gigs of RAM with jumbles racing through. One gig is a thousand megs is a thousand kilobytes is twice 500 letters. That's a whole stank crapload of characters. You can write the Bible with that. But only about 500 characters of all that dumps out. The chances that BOTH your two words happen to land in that same 500 bytes of gobbdegook and can be distinguished from the rest of the turmoil are somewhere between yeah right and are you kidding me.


Here's the worst that could happen: Sum Dum hits your account with a charge for a new laptop. You spot it on your statement, go to the bank, and repudiate the debt. Provb solved.


Here's the best that could happen: It took two years for some guy to discover this flaw. He may be the first guy to ever have discovered it. Sum Dum may never have caught on until after the news came out and Bailedout's IT department scrambled to update their openssl version. We don't know that anyone at all has ever been hit by this bug.


Here's the very worst that could happen on the Fair Trade Tobacco forum: Sum Dum hacks Jitterbug's account, logs in as him, and posts: "Knucklehead is a poopoo head". Gosh. I for one am terrified.


We live in an era when a man's maturity is measured by his timidity. "Circumspect" and "wise" are taken as synonyms. I ascribe it to not enough cave bears. Man was bred over many millennia to drive the bear out of the cave so Olga and the younkers could get in out of the snow. Then he posted himself at the cave mouth to keep off the wolves. Alas, no more cave bears. No more wolves. Just paper work all day and "what's on tonight". Now, he has to invent a bear to fight.


Paranoia will destroya.

 

[FmGrowit]

Yep, something like that...unless the hacker wasn't so interested in calling Knucks a poo poo head as they were intent on destroying the forum. I understand all of the built in redundancies of backed up files and license retrieval etc., but it's a lot easier to prevent such a situation than to fix it.

If a hacker got into an admin account, they could close the forum, delete every single thread and post, change the domain name and open with a fresh new forum. Unfortunately, there are also a good number of "do gooders" who are hacking sites for social-political purposes and tobacco is (as everyone knows) an easy target.

My guess is...the forum is not simply being hacked just to call Knucks a poo poo head, (all anyone has to do is register to be able to do that) but for reasons somewhat more sinister.

 

[Matty]

Revenue Canada's site got hit. They shut the site down for several days. Possibly 900+ SIN numbers may have been compromised. Sounds like it's been fixed, their sites back up and are sending registered letters to anyone who's info has been compromised.

 

[deluxestogie]

I'll have to agree with Don on the matter. [I too am an IT geek.] Obtaining little bits and pieces here and there, from all over the world, over a span of time generates a mess of big data. For a dedicated acquirer of such content, it is not too big of a project to create an unguided machine algorithm that uses high-order matrix regressions to assemble usable material (password matched to a userID) of thousands if not tens of millions of users. [Check out Andrew Ing's course on Machine Learning (www.Coursera.org), if you're up for a brain ache.]

The "big sky" theory (why jet fighters don't collide more often) does apply at the level of an individual user or an individual site, but it's just damn foolish to not use care.

Bob