Due terzi compiuti

Pensieri e esperienze di un’anatra selvaggia di ottanta e un anni.

Avram Miller by the sea
EN | IT

587 post pubblicati dal 2006

Tag: hacked

  • Stop waiting to be hacked and take action now.

    A while ago, I was hacked.  I discussed what happened and my recommendation on a blog post on my blog.  I strongly suggest you read it.  I was very much reminded of the issues when the Adobe web site was hacked. I determined that my information was part of the info that was taken.

    I have copied over an article from the New York Times to make sure you read it.  It explains how even sites from companies like Adobe can be hacked not to mention all those sites you signed up for that you no longer remember.

     

    NOVEMBER 12, 2013, 6:33 PM  New York Times

    Adobe Breach Inadvertently Tied to Other Accounts

    By NICK BILTON

    This week, Ammon Bartram, a software engineer and co-founder of SocialCam, was talking to a friend about a recent security breach at Adobe in which hackers were able to gain access to tens of millions of encrypted passwords and email addresses.

    The friend, Mr. Bartram said, did not think anyone would be able to find out his pass code from the stolen data. ”I’ll bet you $10 you can’t figure it out,” the friend said confidently.

    Mr. Bartram went to a file-sharing website, downloaded a nearly 9-gigabyte file the Adobe hackers had posted online that is said to contain 150 million emails and encrypted passwords for Adobe user accounts, and began searching.

    Soon after, Mr. Bartram said in a phone interview, he informed his friend: “Your password is ‘dinosaur.’”

    While he took glee in winning the $10 bet, Mr. Bartram was shocked by what he found during his search.

    “I’ve been able to break roughly one out of every six passwords I attack. That’s something like 25 million broken passwords, with associated emails,” he said. “This is a big deal. Due to password reuse, these passwords will give access to all sorts of accounts.”

    While Adobe “hashed” its passwords — which involves mashing up users’ passwords with a mathematical algorithm — the company did not apply this level of security to people’s e-mail addresses or the hints they use when they forget their passwords.

    So Mr. Bartram was able to search for his friend’s email address, then copy the “hashed” version of the password and search for other people who used that same string of letters and numbers. He found 500 people with the same password as his friend, and then searched the nonencrypted hints that people had written if they forgot their password on the Adobe website.

    Adobe did not respond to a request for comment.

    Even more disturbing, he said, was the number of people who used the same password for their bank accounts, email, Facebook and home garage door codes as a password on the Adobe website. Some even used their Social Security numbers as passwords.

    In tens of thousands of instances people write a hint to themselves that says “same as my Facebook password” or “same as my bank password.”

    Mr. Bartram said this could all have been much more difficult if Adobe had “salted” the data it stored on its users, meaning it would have appended random digits to the end of each hashed password to make it harder, but not impossible, for hackers to crack.

    Brian Krebs, an investigative reporter and security researcher with Krebs on Security who initially discovered the Adobe breach last month, said in a phone interview that Adobe did not put enough effort into securing its users’ information.

    “This is a perennial problem for most organizations, even the largest ones, which should know better, but they are still relying on approaches from a long time ago to protect people’s passwords,” Mr. Krebs said.

    And while Adobe appears not to have done well in protecting data, the problem is compounded by users who write password hints that tie back to their banks, home addresses and Social Security numbers.

    “The best advice is for people not to recycle the same password in multiple places,” Mr. Krebs said. “It’s prohibitively complex for hackers to crack passwords that are over 13 characters long; people have to think pass phrases instead of passwords”

     

    Mr. Bartram said he found a number of email addresses tied to government institutions, including senate.gov. “All of this happened because Adobe did not follow best practices for password storage,” he

     

     

     

  • Hacked! How it happened , what I did and what you should do

    My email account was hacked and how I learned about it

    I was recently hacked in a very serious and scary way and am still dealing with it.  I got an email from the person that administrates my accounts at one of the major investment banking companies.  It was in response to an email that appeared to come from my account but was not sent by me.  The email referred to the administrator by her first name and requested that $25,000 be sent “to one of my clients.”  The administrator’s reply, which I saw, asked me for the wire information and a signature.  While the email looked normal, any one that new me well would have guessed that it was not from me because of the writing style.  

    I called the admin right away.  Incidently, I was not in the USA at the time.  I told her that the email was not from me and that I had been clearly hacked.  I asked her to report it to the security people at her firm who never bothered to contact me. As we were speaking, a second email came in from the hacker.  It has the wire transfer instructions with my signature which they had clearly gotten from another document in my email account.  I felt a chill go up my back.

    Then I went to work in a very intensive way to change all my passwords, starting with my email accounts.  Then I changed my emails on my bank accounts.

    I called the officer that handles my regular bank account.  She was very sympathetic and said this was happening a lot.  

    I then called the bank which was suppose to receive the wire transfer.  It was a credit union in Tennessee.  I spoke to a security person there and gave them all the information.  I figured that the hacker might be using this sleepy credit union to accumulate the days haul and then transfer the funds out.

    Strangely, I had just been talking with friends who are staying with us about the importance of good computer security. I boasted that I had never been hacked.  I explained that I use strong passwords as well as 1password.  I use different passwords for different accounts and I am very careful with clicking on links in emails to avoid phishing sites.  

    So how did this happen to me?

    Well, my main email account goes to an ISP and then is forwarded to my iCloud  account and a Gmail account. I don’t really use the ISP account. So here is how I think I got into trouble.  I used to use a common password on all these sites, like many of you.  I forgot that I had used this password on my mail account at the ISP and maybe dozens of other internet sites.  Some of these sites could have been easily hacked and my email address and password taken.  My email address uses my domain but it is easy to use a DNS look up programs to find out where the domain is hosted.  Then it would be very easy to log into my email account to both send and receive emails.  I actually think that the hacker did not use my email account to send the the email to the administrator since I could not find a trace of that, but the hacker did read my emails to check for the response from the admin. Once I changed the passwords on my email account, the hacker (who might even be reading this blog post) was cut off unless he/she has some kind of virus on my computer.  I did run virus detection and did not find anything.

    I should mention that just before I saw the email response from the Admin to the phony email, I got a message that someone tried to change my password on Dropbox.  But they did not change it successfully because drop box would have sent an email saying it had been changed.  Not sure why this happened.

    It could have been worse and it might still be worse

    The hacker could have changed the passwords on my email account and I would not have been able to get into my email.  This may have actually happened, but the hacker did not really understand that the control panel at my ISP would not have removed the forwarding to my iCloud account.  Once you are locked out of your email, you have a very difficult time changing passwords because most sites send you an email with the instructions and a link for changing them.  I would have called the ISP and had them change the password so I could get into my account, if I could convince my ISP that I was indeed me.

    The hacker had access to all my emails.  He probably spent sometime trying to figure out how I bank. Maybe he used a robot to look for emails from financial institutions.  But in looking through my emails he could or did learn a great deal about my life.  He could see investment reports.  He could have realized that I use a voice over IP service and actually gone into that service and had my calls forwarded to his own phone service so he could intercept calls to me. 

    Once a hacker has control of your email account, they can go about finding sites where you have accounts and resetting the passwords thereby giving them access and locking you out.  So sites that only require you to click on a link in an email sent to you are very risky if you ever loose control of your email account.

    I don’t know if the hacker copied all my emails and will be doing additional data mining.  It is a very frightening thought.  

    What I learned and what i suggest you do

    We are totally dependent on email and, for most of us, we must make our email passwords very secure and never use them for any other purpose.  That will limit the ability of a hacker to get into our email.  They could still hack the ISP that we use or we could get some malware on our computers.  We should always forward our emails to one or more accounts.  That way, if the hacker does not realize that we have done that, we can still see emails sent to us and we can reset passwords if we need to.  Many sites will send emails if someone tries to change a password so we would at least see that they tried and maybe succeeded. 

    Some sites now use two step verification such as Google and Dropbox.  This relies on something you know, your password and something you have, like your cell phone. I suggest you use this on every site that supports this capability.  

    • Protect your email like it is your life (it might be) by
      • having a very strong password that you only use for email
      • have one or more additional email accounts where you forward your email. Gmail is good for this if it is not your main account.
    • Use a two step verification when ever possible.
    • Use strong passwords in general and consider using an application like 1password that remembers your passwords on your computer and will generate new passwords for you.
    • Move sensitive documents out of your email account as soon as you no longer need them.
    • Make sure that your banks will not do a wire transfer without a verbal confirmation.
    • Assume that a hacker is reading everything you write and receive. My hacker could have been hanging out in my account for months.  

    Comments anyone?

    I welcome comments and suggestions about this.