What software do hackers use?

Discussion in 'Software' started by markem, Feb 26, 2015.

  1. markem

    markem Private First Class

    Last year a hacker invaded our computers. I was running a server from my house. Now the server is online at www.ipage.com. I had already wiped all of the other computers except mine and (of course) a hacker (or THE hacker) got on my system about two months ago. I detected them and immediately shut down my computer. Since then I have wiped the hard drive and reinstalled everything. I'm feel I have finally gotten rid of the hacker. We are behind a 512 bit encrypted firewall which I also recently changed the password to just to be safe. No more server at the house should mean (with all of the software we have installed to protect us) no more hackers, viruses, spyware, malware, and so on.

    So I'm posting today to ask: When a hacker invades a system - what all do they do to make it so they can then get back on without it interrupting what the user is doing?

    The only reason I knew the hacker had gotten back on to my system was because it suddenly began running slowly and my internet usage went through the roof. Normally, I use somewhere around 0.01% but it went up to 5% usage with me just sitting there doing nothing but watching via Task Manager and every time I brought up TCPView - it would be killed after a few moments. The same with Process Explorer. A minute or two would go by and BLAM! Killed. Both TCPView and Process Explorer showed Network Services running programs it shouldn't have been running. So I am assuming they somehow made it so they could log in and get on that account. But I am wondering just how they did that.

    If this is the wrong area to ask such a question - please move this thread to the right forum. Thanks in advance for doing so. :)
     
  2. AtlBo

    AtlBo Major Geek Extraordinaire

    markem...

    I know nothing about hacking to speak of, but I watched a video at YouTube, and some brazen idiot went through everything he did to break into a server/computer. I don't want to provide a link, but, if you search YouTube for "Kiddie Hacker", you will find what you are looking for, basically. There are other tools that hackers use I am sure, the video being 4 years old.

    I ran across the video while researching for a way to absolutely know that noone can access my PCs from the outside. The video really surprised me, not at how easy it was for a decent programmer, but, instead, at the persistence and absolutely conscienceless nonchalance of the type that do this. This guy acts like wrecking lives is just a funny game he gets to play.

    I understand how it feels after an episode like you have had. I have had similar things happen before, also, and I responded like you. If you have any specific questions on how to combat all of this, please feel free to ask in this thread, and I or someone with more knowledge will surely come along with a good answer.
     
  3. idssteve

    idssteve Private E-2

    What would it take to backtrace "hackers"??
     
  4. markem

    markem Private First Class

    Well originally I had thought I had found some software on my system that was left by hackers. It was called MrT. After searching online for information about MrT I found out that it was Microsoft leaving files just laying about when windows Defenders updated. So a no go.

    Some of the programs hackers use are the graphical keyboard that is a part of every system since 98se. It allows you to bring up what looks like a keyboard. You can then type on it via the mouse. If two people are on the same system at the same time then the graphical keyboard allows for entry of information and commands without bothering the other person who is on the system.

    I had installed a ram disk program on my system. It turned out the hacker knew how to use this software and had put a copy of the OS on the ram disk. So he was running one copy of Windows while I was running another. Ramdisk is now deleted as is the disk image.

    I know there are more bits of software being used since they have to be able to see the desktop but I also know that RDP is not being used UNLESS they somehow got Windows XP to allow two people on at the same time. I'm sure this could happen but do not know how to do it. (Unlike Linux where the system is set up to handle multiple people to begin with.)

    So I know they are running SOME KIND of software - but I am not sure WHAT KIND of software.
     
  5. markem

    markem Private First Class

    To answer that question you would have to already know what they were using. So the first step is - know what hackers are using to do the things they are doing.

    You see, one of the things the hackers did was to turn on File and Printer Sharing and set all of my disk drives to be shared. Then they just mounted the drives and began copying files. You may go "So what?" I have four 2TB disk drives and three of them are almost full.

    "SAY WHAT!?" you say? I spent the last five years converting all of our VCR tapes, DVD movies, and CD music over to being stored on the disk drives so: 1)I had a backup in case anything happened, and 2)So we could watch our old favorite movies without the need of a VCR (which are now very hard to find). Why not just Netflix or Amazon Prime things? A lot of the movies we have simply are not on Netflix or Amazon Prime. These are oldies. And although we do own The Matrix - it is on VCR tape and not DVD. So it is fun to watch the TV go through the old VCR thing of syncing with the TV even though it isn't even on a VCR tape anymore.

    And before you ask - yes. We DO still have all of the old VCR tapes. They are just put up in Rubbermaid Roughtotes in the attic now. I'm sure they are no longer any good. But we do still own all of the tapes. Which I have had friends make copies of their DVDs and then give the DVDs away. THAT is what is illegal although you really can't convince them otherwise. But the copyright law allows you to make a copy. But it also specifically forbids you making a copy and then getting rid of the original (either by selling or just giving it away). It is the "You must keep the original" part that always throws everyone. Like an empty headed three year old - most people can't connect the dots to ownership and the copyright laws. They see it as a "I can do whatever I want to with this" kind of thing. The two ways to look at the copyright laws are : 1)You buy a book. You read the book. You can let others read the book. You can even resell or give away or throw away the book. But you can't make a copy of the book and sell the copy. The author of the book OWNS the rights to the book. Not you. So only HE gets to say who can print his books. - and 2)You buy a hammer. You can use the hammer. You can let others borrow the hammer. You CAN make your own hammer also. But you can't create a hammer and use the other guy's mark/brand on YOUR hammer. Or lie and say the hammer was made by the other guy. This is the basis of copyright.
     
  6. AtlBo

    AtlBo Major Geek Extraordinaire

    markem...

    Interesting to hear you mention a ramdisk program. Can you say which one? That is the sleaziest thing I have ever heard of in my days of computing. I don't want to find myself running anything like that program.

    I have to say that in my investigations over the years into this area, I have come to point that I really hope we see more governance over things like program updates and so on. Seems to me developers are becoming openly unashamed of snatching information they don't need from PCs using the updates mechanism in their program. I have just decided it's best to shut them all off with Private Firewall.

    The situation is strange when it comes to security I feel, because there are a gajillion holes in Windows. Yet, I don't think the answers will all come from Windows. I do think it is possible to secure a PC, ultimately. By this I mean will be possible some day. For now, I think we just have to develop a super sense to what's happening on the machine to know when something isn't right. It's crazy to expect this from a normal every once in awhile user (most PC users I guess), so I suspect we will see more oversight of the industry as things move forward. Usually, I am against this, but I think it will be good to have some oversight or someone like the government laying down the ground rules for how some things happen on the net.

    The best example I can think of would be to create easily whitelistable IP ranges for certain activities of net related companies or net divisions of companies like MS or net providers. Companies and individuals who use the internet could then be required to submit to government scrutiny of their activities and, for example, tracking cookies could be declared unlawful. This would make it easy to whitelist many connections by their range classification and also make it easy to identify them. Also, this would work with internet domains, too. The idea is not to regulate content but practices like redirect downloads and so on. Strong laws could make things alot better, but there would be the need for international cooperation.

    I have found some crazy things on the PC in my days, most of which I eventually discovered were harmless. There have been a handfull that I couldn't explain, though.
     
  7. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    Hi

    Generally the route into a PC or Server is via malware or a un-updated app (adobe and Apple QT are good exploits over the years) or Windows/Server software thats un-patched.

    How do these things happen, well we let them, malware is generally always due to user downloads and surfing habbits, but on Servers and using Server OS, then its usually being un-patched and if hosting a website, the website is also not upto date with patches for malware code injections, usually a plugin for media files, Flash, Java etc

    Not going down the route of what software is used as that for me is not something I want to openly post what apps could be used. However you can do your own research into Packet Crafting, vulnerability exploitation, packet sniffing etc

    But best way to keep safe is update update and make sure any 3rd party software used on a server is updated and has no know vulnerabilities, but in the end the dedicated hacker will find a way in, but this is rare for SMEs as the hacker would need to be targeting you for a reason, most are not and hacking attempts you see in the press are not, more they are just DDOS attacks, plus hacking in large corps is more an insider job with disgruntled employee or ex-employee who has passwords.
     
  8. sexyandy81

    sexyandy81 MajorGeek

    most hackers don't use windows as their OS they use open source OS like Linux and they is few hacking tools on the internet that are free to download but some are being monitored by authorities so have to becareful.
     
  9. markem

    markem Private First Class

    Actually open source software comes on all operating systems now and there is a whole lot of it out there. You need to go to www.sourceforge.net. That is the major hosting site for open source software. You will be surprised to see just how much is out there.
     
  10. Adrynalyne

    Adrynalyne Guest

    open source OS != open source applications.
     
  11. markem

    markem Private First Class

    hmmmm. Well, in my case it was they got in through my server. I do updates religiously (unlike a friend of mine who goes "Who cares?"). My problem was - I was naive about how a hacker could get into and take over a server. Since then I've done a lot of reading up on SQL injections and the like. Plus, as I said, not doing it at home anymore. Letting someone else take care of my needs and I have developed an entirely new methodology to ensure the sites can not be taken over.

    I've worked in the computer field since the early 1970s. So I've done the Windows, Macintosh, Apple (like ][+), Linux, Unix, GEOS, MVS, TSO, Univac, etc... operating systems. I used to be a systems programmer also but that was up until the 1990s. So I already know about the various programs that can be run to look at a computer over the internet. After all, I had to do it to monitor what was going on where I worked. But times have changed and a lot of the newer ways to doing things are coming from Russia or China. These I am not so familiar with.

    So like the hacker who got onto my system (which I immediately shut down) I knew he was there from the change in how my system was running - but I could not detect him. Not via the Task Manager and I only got glimpses of him via Process Explorer and TCPView because he kept killing them.

    When I pulled the plug on the wireless and ethernet cable and I examined what software had been installed - there is no record. This means that the programs he/she was using didn't need to be registered. Which also meant it probably had a ".ini" file or just had everything built-in.

    Here is another hint: My system - even though I have taken ownership of the C: drive and the D: drive - they are both being shared. >I< did not set them up to be shared and the Windows OS does NOT automatically share them. Since I just completely wiped my system and re-installed the OS - this means someone _else_ had to do it. And I can not get it to stop re-sharing them with someone.

    That is one of the things I want to put a stop to.
     
  12. markem

    markem Private First Class

    Obviously. Windows is NOT open source. Apple's MacOS X is based on BSD unix which IS open source - but they consider it to be closed source because they paid a lot of money for it. Linux is an open source Os but it is NOT the only open source OS out there. There are flavors of unix besides Linux just as there are alternatives to Windows.

    Why do you think I meant open source OS == open source applications? I do not believe I ever said that.
     
  13. markem

    markem Private First Class

    (I used the ellipsis (...) because I didn't want to have the entire post reposted and not to change what you have said.)

    I believe it is called ImDisk. It is a free (and I think open source) program. It works really well. On my laptop - it can actually handle up to 8GB even though it is a 32 bit system. It's one of those weird things that Dell did. I think they were thinking of making my laptop do the 64bit thing but changed their mind halfway through the design phase. So I can put in 8GB of memory but I can only access 4GB under a 32-bit OS. But the hardware can access the full 8GB of memory. So I thought I'd try ImDisk and it really does work very well to make a ram disk but I never figured out how to move the Windows OS over to it so it could boot from there. Obviously the hacker knew how - but I just never invested the time it would probably take to do this. So it just sat there.

    Actually, updating is a good idea. Also, did you buy a copy of Private Firewall or are you using the free version? I always used the free version but found that it became unstable after a while. So now I use Comodo's free firewall. But I do strongly feel that updates are important.

    Strong laws would be great if the megacorporations didn't buy our government officials and have them pass laws in favor of them all the time. That is to say - you have more of a chance of Microsoft actually fixing Windows than you do of the government passing laws that actually say Microsoft has to fix windows.

    As an aside - I was listening to NPR the other day and they were talking about things to come and things that are here. The "things" part was computer hacking related. I thought it very interesting to know that most pace makers are now digitally equipped with a way to plug them in to the internet. This is mainly so your doctor can monitor what is going on. Well, some of these pace makers are now wirelessly connected so they can be monitored 24/7. The hacker part comes in when the hacker takes over the pace maker and holds your life for ransom. "Pay up or we give you a heart attack." After all, that wireless connection is just another TCP/IP address. Doctors can do this already. They log in when your pace maker alerts the doctor that you are going into a heart attack and they tell the pace maker to give your heart a jolt. It stops heart attacks most of the time.

    Another scenario was that the car industry is telling us that soon our cars will be able to drive us around without us doing the driving. This is a great idea until you think about hackers again. Since most of these "OS"s are just Windows you get into the "Well, ya see. Harry was in his car when suddenly hackers took it over, locked all of the doors, rolled up all of the windows, and drove him to a barn in the boonies. They demanded he turn over all of his money to them. Of course they also shut down his phone so he.....well....he died of starvation and dehydration." Now, this scenario just will never happen because all it takes is a few good kicks to knock out a windshield or window and you can then escape. Also, if you turn off the car - it generally speaking stops. And it is highly unlikely that the lights and horn and other items in the car will ever be totally controlled. It is more likely just the driving part will be controlled. So you just turn the car off at the next light, use the unlock button on your remote, and you are free.​

    There have been some things you couldn't explain... Yeah - that's me. I want to know what anything I don't recognize is. Like the MrT stuff. Turned out to be Microsoft but I thought I really had found something significant. :)
     
  14. Adrynalyne

    Adrynalyne Guest

    You equated the two with your comments.





    No mention of OSS apps, Yet:


    I know Apple's history and they consider it closed source because it is. They are kind enough to provide the open source portions in Darwin, however. I wasn't discounting open source OSes, I was commenting on you discussing open source apps while replying to a comment about open source OSes.
     
    Last edited by a moderator: Feb 28, 2015
  15. AtlBo

    AtlBo Major Geek Extraordinaire

    markem

    It's the free version, 7.0.30.3. It's unusual to hear for me that PF became unstable, because I have never had any problems with PF over the last year and a half. Could this have been some time ago with an earlier version? At any rate, you are using a good firewall with Comodo.

    My only qualm with Comodo is the way the program has been sort of at the same time improved for common use (everyday users) but then also made more difficult to use for serious use (managing process and connection rules). The settings are all over the place in Comodo I feel, while in PF they are easier to reach for me. I have been sensing that Comodo is getting closer to a user friendly firewall, which is a noble goal, since there really isn't any such thing at the current time.

    Actually, I have tried various iterations of Comodo Firewall, and I have every time had the same difficulty you mention having with PF. I know CF is a very sophisticated program installing at around 200 MB. PF installs at 8-10 MB I think.
     
  16. markem

    markem Private First Class

     
  17. markem

    markem Private First Class

    (Using ellipsis to cut down on the size of the quote.)

    I used the older Private Firewall and then when they upgraded it I went to the newer version. What would happen is at first everything ran fine. The I would get one error and soon the software would barely allow me to log on. I can not help but wonder if hackers or some virus or other simply would infect it somehow. Really unknown but I do know I did like the interface quite a bit more than Comodo's interface. You are right in the Comodo's interface is a lot more complicated to use. When I was running my server it would take me days to get the free version to work properly. I was told though that the paid for version was a lot easier to use.

    Yes. You are right. Comodo USED to be more oriented towards serious users but now it is more point and click. So long as you are not trying to run an FTP server or WEB server (or any kind of server I guess) - then it works really well. As I think I posted earlier - after I had installed Comodo I got a message "The internet is trying to connect to you". The number one rule I follow is "If I connect to X that is ok but if X is trying to connect to me it is NOT ok." I immediately told Comodo to "STOP-BLOCK-TERMINATE". Unfortunately, that "TERMINATE" makes it so you have to reboot your system. But the real thing this told me was - the hacker had our password on the router. So I immediately logged in to the various computers we had, changed all of the passwords to the new one and then logged in to the router and changed it. It has been quiet since then. But I know the hackers want back in so I check the router's log and I can see hundreds of attempts to log in to the router from the internet. Which is weird since I do not have the box for that to be allowed check marked. So I would think they could not do that - yet I do see attempts to log in.

    In past versions I have, seldomly, had the same problem as I had with Private Firewall. The current version though - has been stable so far. The reason I use Comodo is because it is the only one of the firewalls out there that has passed all of the tests. MajorGeeks has a website listed in their list of firewall software that shows the Comodo is the only one to make it through all of their tests. There was one other one that is now free that also can pass all of the tests but you have to know how to set it up and I have no idea what those tests are or how to set that program up to handle them. Still, it was listed the last time I looked about a year ago.

    Oh well - off to bed. Have to be up around 5:00am and it is almost 11:00pm here. Later!
     
  18. Adrynalyne

    Adrynalyne Guest

    I'm afraid that it doesn't work like that. You mentioned about OSS apps to an OSS OS comment, and I replied in what I thought you were saying. Then you questioned what I said and I explained why. I did not change your words at all, but simply quoted you. Now you want me to stop relaying my opinion? I think not. We don't always like the answers we receive, but if you wish me to respect your comments, respect mine as well. It is a two-way street friend.

    You seem to seek quarrel where there is none. There is no need for that.
     
  19. AtlBo

    AtlBo Major Geek Extraordinaire

    markem...

    Just another angle on this:

    I used to think the same way, but I am now thinking a little bit differently. Hackers want personal information, so, to me, this means they have to get the information off of the PC. Not that the incoming connections aren't as important to me...they are still just as important as ever. However, I now place my most serious emphasis on determining what is trying to connect from my PC to another server in an effort to protect the integrity of the information on the PC and keep it from being lifted.

    I like this approach, because I am finding that protection based on process behaviors can stop much of what hackers can do even before a connection comes into play. If the hacker can get into your PC with a program, but the program is unable to record keystrokes, take screenshots, copy the clipboard, or simulate mouse or keyboard usage, then the effort is for nothing. I will say that I don't think today's firewalls have all of the possible avenues of this type covered, sadly. At least there has been some progress. Anyway, behavior blocking is not, o/c, protection against a dedicated hacker who is determined to break into your PC while working over the net. That's the stuff of the video I mentioned in an earlier post. That appears to be more difficult but perhaps not as much so as hackers would like us to believe.

    Focusing on outbound connections has really opened my eyes to how unsafe current practices are when it comes to internet connections. This is why I say I feel we will eventually see cooperation between government and the PC/internet industry to define clearly what is safe internet traffic. I also suspect that the government will end up with certain rights when it comes to monitoring traffic to and from companies and other certain entities within the internet industry...also companies like MS and Apple could be facing some serious scrutiny at some point when it comes to data collection. There is just so much at stake that I don't see a way around some government intervention and monitoring of internet traffic.

    I agree with you on all points with Comodo. That's exactly my experience with the program. There is so much user friendliness on top of the firewall that the actual settings are hard to find and set. Well, it's the best thing going security-wise for sure in spite of everything.

    Reading your post, it occurs to me to consider who might have had your router password. Then again, who knows what ways there are to find the password.

    I get lots of blocked connections with PF. Most of it has to do with blocks I have placed on programs that try to connect. For example, I use Comodo Programs Manager, and I have set its connections to block. Well, there is also a Facebook feed in the program interface and there are some others associated with the program that get triggered every time I open the program. The PF log goes crazy when I run CPM. There are many others, too, though, that I have blocked for various reasons.

    By the way, if you are into net security and have not looked into script blocking, I recommend taking a look at Ghostery and NoScript (this is for Firefox (not sure about Chrome or IE)). I also now use BetterPrivacy, which blocks Flash cookies from being left on the PC. NoScript definitely changes the internet experience in alot of ways. Videos are unavailable to run unless you can figure out which blocked element is the actual video to allow the element. You can wholesale allow a page or site, which is nice and which makes the job much easier. I am really enjoying learning to use these programs, and I feel like it's a step in the right direction.
     
  20. markem

    markem Private First Class

    You continue to misquote me and to change what I have said into what you want it to say. That is what >I< am saying. Simply mentioning OSS apps DOES NOT MEAN OSS OSs. Yet you continue to try to equate the two together.

    The quarrel is this - learn to actually quote what people say. Show me the quote where I said OSS OSs are OSS apps and I will be fine with it. Sadly - you can't because I never said that. YOU said it on your post and I can quote it.

    THERE IT IS! OH MY GOSH! At least >I< know how to quote. Please - show me where I said they were the same. Or shut up. Because you are not adding anything to this conversation that is constructive.
     
    Last edited: Mar 2, 2015
  21. markem

    markem Private First Class

    Ah! That _kind of_ is what I was saying. But you are saying you take it further and distrust to whom you connect. Correct?

    I'm not sure if I would agree on this. The Big Brother scenario just doesn't sit well with me and I am sure a lot of others as well.

    Ghostery and NoScript. I'll look them up at work today. Gotta go! :)
     
  22. Adrynalyne

    Adrynalyne Guest


    You said something, I replied in kind to what you said thinking you meant something else. Then you replied back and I explained why I replied the way I did. I gave direct quotes as well, so your lies of me changing what you are quoting are just that. This temper tantrum you are throwing is just childish.

    Pro tip: Don't look for an answer if there is a chance that you will not like what you receive.

    Have a nice day, your immature tantrum is tiring. I'll not continue posting here because I've already said my piece and don't feel the need to rehash nonsense from you.
     
    Last edited by a moderator: Mar 2, 2015
  23. AtlBo

    AtlBo Major Geek Extraordinaire

    No, not distrust...just learn everything possible about the IPs where data is going once it leaves the PC. An informed decision is a good decision.
     
  24. markem

    markem Private First Class

    Ah. That is so true.
     
  25. Colemanguy

    Colemanguy MajorGeek

  26. Adrynalyne

    Adrynalyne Guest

    Yup. We don't even make shares at work, we just use administrative shares.
     
  27. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    The whole goal of hacking is this.... the end user is not aware of anything going on in the background.

    Nice resume!


    Crux of what is happening now and not only those two big players but DPRK, USA, UK, All EU states, and well pretty much every nation has a superb hacking capability, then noted ones earlier are active as hell, some better than others, just the usage is not geared towards low end users, in that meaning not strategically significant, as I mentioned a hacker will target someone if they need something of value from said company, or have in some respects a gripe at the owners.

    Indiscriminate hacking is not so much used.

    Think you already know what signs to look for and secure your system in the event of an attack or during this attack so thanks for the info on what you used and Process Explorer and TCPview are great small apps.

    One new question from me is what Server OS and security do you use now and what have your learned to secure yourself in the future from attacks? Curious as I have a home server and use Windows Server 2012 R2.
     
  28. markem

    markem Private First Class

    Thank you! No college degree though. Still a freshman. Most of my knowledge comes from working at the university's computing center and reading every book I could find on computers. Since we were allowed to build and run any application we wanted - I wrote one of the first e-mail programs that was used for quite a long time and then I did an administration program that they used up until the Univac 1108 was decommissioned. Yes - I was a legend in my own MIND. :p Actually, until around the year 2000 - people still knew my name. Then all of those people began retiring and now I'm known as "Who?" I keep going many I should start saying "That's Dr. Who" - only I don't have a doctorate. Instead, first I went to work for a company called Digicon (which is now a part of Western Geophysical) and then NASA asked me to come an help them. So a guy with no degree helped program the Space Shuttle. Go figure.

    Well, for about ten years (mid 90's to early 2000's) I did the white hat thing and shut down hundreds of locations. But it just got to be too much. I even went so far as to automate a lot of things but then I just had a computer sitting there chugging away twenty-four hours a day. Finally I went - this is a job for Google or Microsoft - not me. All I'm doing is attracting the wrong kind of attention. After several DDOSs - I began switching ISPs. It would take a while but then whoever was attacking would start back up. (Especially since I used the same domain name. Easy to find but we'd be down for a few months which I guess made them go "We got him!" and they would leave us alone for a while.) Last DDOS was when I was with AT&T. But then AT&T mucked everything up because I used DSL and AT&T shut it off because I dropped one of my business lines. That was something like three years ago. I'm pretty sure they've stopped. We are with Clear now but are going to have to switch because Sprint is shutting down Clear. We went from having 100Mbps to something like 20Mbps because they turned off the cell tower near us. So looking for a new provider.

    I'm not sure I agree. There are some excellent books out about internet hacking showing how to jump onto routers and get in to people's systems. Mainly because up until Windows 7 you were not required to have a password. Anyway - I would think by now most hackers either have or can buy programs that just scanning the internet for routers and testing to see if they are secure or not. Easiest way to get a zombie hoard going.

    You are welcome. I know some of the signs. But every year sees new ways for a hacker to get in to a system. As I said above - been a while since I wore a white hat. Know a lot but at the same time know nothing.

    Well right now I'm using iPage for my server and the OS is Linux on iPage. However, all of my web pages do not have any kind of input areas on them. So unlikely anyone can do anything other than break in to iPage itself. Then everyone is hosed.

    My own home security is to use 64 byte security codes randomly generated by PassKey. So 512 bit encryption. That only slows them down. About every six months I have to change the codes because we have had, after six months, someone trying to log in to our systems. On an android tablet I once had (battery died) I actually caught the TCP/IP address of the person who had hacked in to that device. The person's name was Steve (at least it said 'Steve's iPhone') and it gave a TCP/IP address in China. I just went "I have no idea why someone named Steve in China wanted to hack my android tablet - but reset and reload."

    To go back to your question I use Comodo, Avira, Hitmanpro,Malwarebytes,SuperAntiSpyware, and RogueKiller. For the most part, I use C-A-S. Once a week I run M. Once a month I run H. If anything starts to look weird I run R. Like today. I got on because of your post and I saw green words with double underlines. That's one of the programs that the Conduit program will install. So I ran HitmanPro because it is the only one that can get rid of that. It found it and removed Conduit and the sixteen other adware programs that were installed. How it got there I have no idea. I come here sometimes, Google, Google Images, my website, and I get my e-mail. Occasionally I will go to something like FontForge and read up on creating fonts or I go to PHP.net because I need to look up some command. Or W3C for HTML, CSS, or Javascript information. Otherwise - I'm at work. The only games I'm playing right now are FreeCell and Solitaire. No time for anything else. 14 hour days, 8 hours of sleep only leaves 2 hours for everything else (like bathroom, eating, etc..). So for the most part - my system at home is off. That is probably helping me to stay safe more than the software. :)

    I am actually thinking of switching from Avira and SuperAntiSpyware to just having Comodo's entire suite of software. Trying to find write-ups about their software that isn't marketing hype though is not that easy. You can go to the forums but there it's mainly people having problems installing it or using it. Not a review of how well it actually works. Although the approach is one I do like. If everyone is allowing information to be sent back to the main server then when viruses are detected it doesn't take much to be able to update everyone. So maybe a couple thousand people's computers get infected but after that it pretty much grinds to a halt. And with over a million new viruses being produced each year you really do need millions of people giving updates just to stay up with it. I wonder if they keep track of new programs? If a lot of people started having the same new programs - would that constitute an infection starting up? Might be an early warning system.

    I will leave you with this: I was talking to someone on another forum. I asked him how he kept his system free of viruses because he had said he didn't use any antivirus program or spyware, malware, anyware kind of a program. He said he only accepts plain text in e-mail and he just wipes and re-installs his system every time he starts having problems. He also backs up his system before going online each time. A differential back up - but a backup still. So I asked him what he used to back up his system. He says he uses xcopy. I was like "I thought xcopy had problems". He said he didn't think so. He had sent me a link to Wikipedia's page about xcopy and right there - they say it shouldn't be used because there are problems with it. And then it struck me. Since he didn't have any programs checking his system - then his backups all probably have viruses. He was rather adamant about how he hadn't had a virus in years since he started doing this. I didn't argue with him. But I can't help wonder how long it will be before he reaches the point of no return. It is like a saying I once heard years ago from a friend from Egypt. It goes: "You can stick your head in the sand if you want to but then the sand fleas will still bite you."
     
  29. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    Wow neat and what part of NASA? as I know a few folk at KSC and they are on this forum as well.

    I'm design/imaging to start with then UK Gov image data analysis then NHS and medical research and imaging.

    You and me both would be looking for new provider.



    Ok I agree but random hacking is a layman's way, those that want data do not go after home PCs, they may in malware for data mining security passwords for banks and shopping etc but to ruin a company thats targeted.

    Do DDOS attacks go after single home servers, not in general unless someone pissed someone off, but more these are large corps attacks.

    I like you know loads but know nothing as well, its an ever increasing learning curve, similar to my medical ophthalmology work, in medicine you have a general idea but not always a final ... thats IT fix, same in computing.


    Bascially the apps sort of I would run or suggest, I dont use commodo or Avira but use so secure as you can be. I do have on my server test PC System Centre which is basically Forefront/Endpoint. However I do think we need more 3rd party small apps as in spywareblaster, malwarebytes, etc...

    Personally look into Malwarebytes over Superantispyware

    I have never had malware, I do backup on a schedule and use Acronis True Image, and do full image files, differentials are useless for me, too much hassle, rather a full no holds barred backup.

    I agree with you in the last part, do we really know what's going on, unless you use the likes of Process Explorer etc, and know what should or should not be running on your PC/Server then you are open to malware and hackers gleaning your data, the trick I guess is knowing what should be running, but not an easy task for most end users.

    Markem great subject and discussion BTW
     
  30. markem

    markem Private First Class

    And I close them and modify the registry entries so they won't come back up again. When they do - it's not a good thing. :)

    I eventually simply removed "File and Printer Sharing" from the network items (like wireless and local) the last time hackers got onto our systems. Now I do it automatically since we do not use that anyway. There are other ways to move files around and with PDFs now we just make a PDF and send it to each other if need be. We may do that once a year - if that much.
     
  31. markem

    markem Private First Class

    I worked at the Johnson Space Center which used to be a part of Webster but is now a part of Houston. How they did that I really do not know. I always thought that once you were a part of some city you were just stuck with being there. Guess not. From 1984-1988 I worked for Univac at NASA via Singer-Link. Went through the Challenger accident. Then I left and came back in 1989 and went to work at the IGOAL (Integrated Graphics Operations and Analysis Lab). They are currently in Building 9C, 2nd floor. Next to the high bay. I left NASA in 2001. The day before the second Space Shuttle blew up. Both days very emotional days.

    Similar to what I've done - only in the US and the data analysis was mainly to ensure the crates sent into space in the Space Shuttle's cargo bay actually could fit.

    I think I may have found one to go to but their website says one thing and what the sales people are telling me is another. A bit disconcerting although the sales person keeps thanking me for finding these webpages and he/she says they will fix them as soon as they can.

    Yeah. I think it is probably personal. Someone I probably made very mad. But that's just probably a persecution complex speaking. Could just as well be a totally random thing.

    I just read this and went "That's just what I said!" I am hoping that since I now have the server on an independent web hosting service that when we switch to the new provider that will be the last of it. Before, I was always running a server at my house. Now that it isn't at the house - there is no direct link to where we are. It will be very nice to not have to go "Why is it saying 'The internet is trying to connect to you'." Or to have one of my older programs I keep up and running go "Someone is scanning your system's ports."

    I used to think I knew everything about computers. Then I had it shoved in my face several times that i did not. Since the open source tools came along (do you remember "Satan"? The program that attempts to break in to other systems? You could download it and try it out on yours or anyone's computer. I did so on my system and was amazed at just how many vulnerabilities it found. Windows of course. Luckily it also came with information on how to fix the problems. That was in the 90's. I am sure that either "Satan" has been updated or dumped because it probably became obsolete.

    Since I bought and use SAS - I was really surprised at just how many things Malwarebytes found. The thiing is - SAS finds things that malwarebytes does not find. Or HitmanPro. Why is it the only program that can get rid of the Conduit program? None of the others even see it and it doesn't kill any of them (ie: Avira, SAS, Malwarebytes, etc...) but they don't see it running.

    *nod* But as I said - each of these sees things the others do not. Should they not all see the same thing?

    I use SyncbackSE. You have a million and one ways to set it. I used to go through each option to make sure everything was set up. Talk about a headache. Now I've even stopped using the compression options. I let it back everything up to an external USB drive, then compress the backup there (because otherwise SyncbackSE just seems to take forever) and then I move the file to a backup disk. I don't go directly to the backup disk because the other drive has over 600GB of free space and if it crashes it is no big loss. So I do all of the work on there and then just copy the file over.

    That is a very true statement.

    I am glad you like it. It is not possible without everyone else's contributions though. So it is not just me and never could be.
     
  32. solaris89

    solaris89 First Sergeant

    Hi Markem,

    I work at KSC and not to nitpick, but no shuttle "blew up" in 2001. In face, neither shuttle blew up. Challenger was destroyed when the external tank exploded and the resulting shock waves from G forces broke the orbiter apart. In 2003, a chunk of ice from the ET punched a hole in the leading edge of the carbon-carbon wing tiles during launch and the breach was not confirmed (although depending on whose opinion you get, management at the time knew about it) until the heat from entry melted the structural components of the wing and broke the orbiter apart.
     
  33. markem

    markem Private First Class

    The term "blew up" can mean many things to many people. You can think bombs or you can think it came apart. Since I was the person who was called to come back in 2003 and created (with Sharon's help - she did the interface, I did the software to stitch together all of the data points) the software that allowed Mission Control to determine if a tile had become damaged - I know why the second one blew up and since I was at the Rockwell building (now called the USA building) when Challenger blew up. I know why both blew up.

    So you can knit-pick if you want but to me - they both blew up. But yeah, maybe it was 2000. A lot has happened since I left NASA. Two hurricanes, major flooding, bankruptcy, relatives dying off, and things like that. But you are more than welcome to call JSC and ask for the IGOAL. Talk to David or Sharon. They will confirm when I worked at the IGOAL and when I left and when I returned and when I left again as well as what I did there. :)
     
  34. markem

    markem Private First Class

    You mean it's half-life has been reached and it is decaying fast? :-D
     
  35. markem

    markem Private First Class

    I thought I smelled fire. But I thought it was from the Mexican Food we ate! :-D
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds