Whack attack!

[Treval]

Believe what you want. Such inexperienced people..
Both of you go back under your bridge. ;O

[mroilfield]

Or maybe Treval is making up the bunch of crap.

Yeah I had that thought as well.

[Treval]

I bet you won't be saying this when you get hacked aswell.

[kpac]

I bet you won't be saying this when you get hacked aswell.

Haha, yeah right.

[Treval]

No, I'm not threatening. I'm saying, when you do get hacked sometime, you won't be laughing or saying those things.

[kpac]

No, I'm not threatening. I'm saying, when you do get hacked sometime, you won't be laughing or saying those things.

Yes, I know....

Haha, yeah right.

 

[BC_Programmer]

My point was we were speaking in the context of a home user; as somebody else said (I think it was Azzaboi) the <good> hackers are also smart enough to no to go after big targets. There is a lot more to gain for leaking source code, as well as revealing trade secrets or future plans of the company. A case could be made that "identity theft" can be done through hacking, but the reality is that a lot of the information needed for identity theft is not persistent; also, the main way to get such information has been through phishing, and no amount of protection can really stop somebody from filling out that form (you can detect it as a phishing attempt, you can notify the user, but if they decide to fill out the form anyway, game over for them).

Consider for a moment, a keylogger. Let's say one got installed on my PC this instant; for whatever reason, who knows. It could take months before they get a single password from me, simply because firefox has them all saved. (being that it's installed the malware could also acquire this information too, but I'm assuming just a "pure" keylogger.

"Black hat" hackers are almost summarily less skilled then security specialists; since, as Treval hinted, many of them are former black-hat hackers, or just hackers, period. Therefore it's safe to say that they have gained more experience in the meantime.

This is also attested by the fact that most of the "major" company hacks have bee ndone simply because that company has an obvious open hole. the Half-Life 2 leak, for example, and not because of some innate skill by the hacker themselves. For the most part they are just jabbing at a barn door looking for a knothole, pardon the implication... heh, when they find it, it's usually luck. perhaps they can, through experience, know where most knotholes lie. but their poking still makes sound on the other side of the door in the form of access logs, which will only be deleted if the hacker can gain access before  they are read. considering that many companies actually print hard copy of the network traffic between critical points in their network and/or make backups immediately it can be difficult to eliminate them all. Additionally, the fact that a log is gone at all often puts these companies into "red alert" state. the hacker would need to properly remove those relevant entries to mask their intrusion, as well as change any other data to remove any "hints"... for example, "total number of entries" and total size and other such data. Then additional problem is that some of that data is often sent to a database which uses another different password, so the hacker's job has gone from poking for knotholes in a barn door to trying to get into a horse's stable using the same method. Of course database logins are <additionally> logged elsewhere, possibly even in the original logfile.

It is when a company has <flaws> in it's security that hackers get in. not because said hackers are leet or skilled. for the most part they pretty much just use something like nmap to determine that a server is using, say, an outdated version of apache. they can then look for the documentation on that version and it's bugs and security "patches" to see what was patched afterwards and then take advantage of the fact that the version they need to access is not patched for it.

[Azzaboi]

Treval - generating 2.000.000 (2 million!) different passwords per hour

Yes, this is known as a rolling password and has been quite secure, they even use it as an extra security option for the game World of Warcaft. You have a small device you take with you, press a button and tap in the code by hand on the computer as the secondary password. Every minute, a new code is generated, so the device gets you the latest encrypted.

Someone able to brute your password as well as hack that code and gain access to your account within a minute or less before the next random code swaps over is highly unlikely. It's a very good device.

Friend has one for his crazy World of Warcraft playing due to also using the account on public computers like the netcafe. Those netcafe computers are the worst at stealing all your details with keyloggers and trojans. Even if the password is stolen, it's useless after been used once or timed and rolled over to another.

BC_Programmer - I've seen hundreds of keylogger reports and even found a server dump though using advance google indexing search. Honestly it was 335 txt files, each with about 20 to 80 username/passwords and various details stripped from all the typed junk. They are smart enough to scan the username and password areas of most sites. Also those Autocomplete passwords can be leached within seconds. There was some ways around detecting this, if the user types garbage inbetween the password, selects and delete, rather than backspacing, or have a key scrambler, etc.

Format from memory, looked like:

==================================================
Entry Name        : http://www.myspace.com/
Type              : AutoComplete
Stored In         : Registry
User Name         : xxxxxxxxxxx
Password          : xxxxxxxxxxx
==================================================

or

serv : https://ssl.rapidshare.com
login       : xxxxxxxxxxx  
password    : xxxxxxxxxxx

serv : http://www.youtube.com
username    : xxxxxxxxxxxxx
password    : xxxxxxxxxxx

Targetting popular sites, but as well as randoms.
And yes, they where all most all valid including credit card details, etc, it was scary what was collected. It's also amazing how many people don't take care of their computer and simply ignore that it would ever happen. My friend's brother is like that, pasted me a memory stick with old practice exams as well as a autorun virus which was detected instantly by Kaspersky (I've got autorun disabled anyways), but he's had it on his computer for a month or so and infected a number of others including some of the school's computer, pissed me off telling them all how to remove it!

Just to note, this keylogger dump site may/maynot still be up and running!
I still have record of the site url, the site has been reported, the log links are down, de-indexed from google but the main domain is back after just checking now says 'Bye ' and kicks you back to google.
I guess I'll pm the url if requested.

[Treval]

Very nice. =)

[BC_Programmer]

They are smart enough to scan the username and password areas of most sites

a keylogger logs keys. it does not see where these items are being typed.



This is all rather trivial anyway; In order to infect a PC malware of any sort needs a visible "vector"... for example, one common vector is to install a winlogon_notify hook. they can "hide" this key, but if they do that, winlogon won't see it either and therefore won't load it. Autoruns can help find such things. They could, theoretically, install a function hook globally after winlogon loads them, in which case autoruns will not detect them. rootkitrevealer will detect the inconsistency, though.

Additionally, there are a number of other vectors in which a dll may "force" itself to be loaded into other processes. these dlls are almost always easy to identify- random base names is a common attribute. such dlls can be found using process explorer's "dll" view in the lower pane. for self-repairing malware (which usually installs itself in "groups"... for example, a keylogger might also run and continuously make sure the trojan downloader "buddy" process is running, and if not, start it again, and vice versa. These are easily stopped by suspending one or both processes with process explorer and then ending them both. the tricky part is sometimes such buddy triads involve dlls loaded in other processes.

for me, when I have a infection (although it has been over a year and a half since my last one, since which time I've changed OSes twice) I simply use process explorer to try to determine the actual file names, and then boot to a seperate OS; maybe my Linux Mint install, for example, and delete those files. booting usually results in a few "missing DLL" type errors, but I can safely delete such entries via regedit.

[Azzaboi]

They are smart enough to scan the username and password areas of most sites

a keylogger logs keys. it does not see where these items are being typed.

You missed the sentence before that one.

...stripped from all the typed junk.

It looked like it logged all keys into one huge dumps named adminlogs####.txt per unique ip address, with the website urls and even click locations (or some weird data), and created scans from that file into varies other txt files with the format I've shown above. It also had separate files which seem to be all the saved passwords striped from the victims computer registry.