Computer Security

Hello,

As some of you may be aware, I am quite fanatical about Information Security, having also recently switched to using Elementary OS Linux as my main home computer operating system.

A few days ago, I received an email from an unknown source claiming they had my outlook.com password, reading through the email, it transpired that they did indeed have it. But they also were trying to blackmail me for $900 of bitcoin, claiming that they had infected my PC with malware, remotely turned on my webcam and filmed me and my wife / girlfriend having sex. Well 2 things are wrong with that last bit. I'm currently single ish and 2, I don't have a webcam. So I'm ignoring the email.... apart from them having my password.

It wasn't that worrying, because I do have 2 factor authentication switched on for everything that supports it, but I decided to change the passwords anyway, just to be sure. I don't believe the malware story since PC has been scanned to within an inch of it's life and found nothing, but the fact is they still had my password. The most likely source has come from a data breach elsewhere that is not in our control.

The moral of the story is, use a strong password and also use 2 factor authentication for everything that supports it. And if you do own a webcam and get caught like they claimed I was, get on to pornhub, find your video and bump up the views... you may get some advertising revenue :wack:

Crist i see these all the time, folk get them through at work loads.

Good luck getting into my home lan, secured with multi layered security - Voda router doing nothing but VDSL connectivity, pfsense, dns filtering, own proxy, managed wireless,client virus checker as well as online malwarebytes mode and everything patched as soon as it comes out (heck i even have a windows update server running)

But all my passwords are 123456 :wack:

Quote:

---

Originally Posted by sideways14a

But all my passwords are 123456 :wack:

---

Should upgrade them all to “password” :thumbs:

Quote:

---

Originally Posted by Chriscooke

Should upgrade them all to “password” :thumbs:

---

And write it on a postit note and stick to each monitor :wack:

Quote:

---

Originally Posted by sideways14a

Crist i see these all the time, folk get them through at work loads.

Good luck getting into my home lan, secured with multi layered security - Voda router doing nothing but VDSL connectivity, pfsense, dns filtering, own proxy, managed wireless,client virus checker as well as online malwarebytes mode and everything patched as soon as it comes out (heck i even have a windows update server running)

But all my passwords are 123456 :wack:

---

Besides I'm also trying to de-tech myself at home..... :wack: says the man with a Wifi module plugged into the CONSULT so I can read all the codes on my iPad. LAN, Fiber to the garage, 60TB NAS, VMs running on ESXi and a dead printer. If I need to send a letter, I hand write them with a Quill Pen (Even have a Wax Seal with the Family Coat of Arms on it :D )

Quote:

---

Originally Posted by Asht_200

Hello,

As some of you may be aware, I am quite fanatical about Information Security, having also recently switched to using Elementary OS Linux as my main home computer operating system.

A few days ago, I received an email from an unknown source claiming they had my outlook.com password, reading through the email, it transpired that they did indeed have it. But they also were trying to blackmail me for $900 of bitcoin, claiming that they had infected my PC with malware, remotely turned on my webcam and filmed me and my wife / girlfriend having sex. Well 2 things are wrong with that last bit. I'm currently single ish and 2, I don't have a webcam. So I'm ignoring the email.... apart from them having my password.

It wasn't that worrying, because I do have 2 factor authentication switched on for everything that supports it, but I decided to change the passwords anyway, just to be sure. I don't believe the malware story since PC has been scanned to within an inch of it's life and found nothing, but the fact is they still had my password. The most likely source has come from a data breach elsewhere that is not in our control.

The moral of the story is, use a strong password and also use 2 factor authentication for everything that supports it. And if you do own a webcam and get caught like they claimed I was, get on to pornhub, find your video and bump up the views... you may get some advertising revenue :wack:

---

Passwords are leaked via website exploits which manage to dump their SQL / Backend which holds user details. If websites have bad practices they store your passwords plan text or very weak encryption.

If you get spam via email it is normally the websites have been breached but your password was Salted (stored hased password) that cannot be decrypted.

You can check if your website or/and password has been leaked via here: https://haveibeenpwned.com/

Just wait till we have to start disabling hyperthreading on intels older chips due to vulns there, plus the extra mitigations they need to stop stuff leaking.
Hence why i am going to jump over to Zen2 on the 3000 series from AMD next month for my upgrade from my old 5820k.. It looks like intels got there performance improvements over the years from shoddy security.

Quote:

---

Originally Posted by Murt

Passwords are leaked via website exploits which manage to dump their SQL / Backend which holds user details. If websites have bad practices they store your passwords plan text or very weak encryption.

If you get spam via email it is normally the websites have been breached but your password was Salted (stored hased password) that cannot be decrypted.

You can check if your website or/and password has been leaked via here: https://haveibeenpwned.com/

---

Ta for the heads up. I appear on 3 sites... Plex being one of them :(

1 - The data contained almost 2.7 billion records including 773 million unique email addresses:eek:

Of the several accounts i use day to day my work email address has the worst pwnage, in fact its the only.

The worst was Adobe a few years back, of course i sorted out licensing for our campus for Adobes crap and yep got hit with the biggie back in '13
I also got hit with Drop box (not that i used it, i was checking it out) but now i see another couple popped up.
Apollo who i have never heard from ... 126million and an onliner spambot list of 711 million addresses picked up from god knows where.

In total my work email address pops up in 4 places according to that site.. although its mostly useless.

So many data breaches, check yourself out on haveibeenpwned.com change your passwords, don't use the same ones for everything.

Don't see the point of super strong passwords when they just get hacked :rolleyes: 2 factor is the best.

https://en.wikipedia.org/wiki/Have_I_Been_Pwned%3F

Legit site :)

Yeah 2 factor for anything important.

Amazes me how bad some companies security is, i have a couple of CC's that i struggle to log into there web sites to manage as there security is so bad - they ask for everything bar a DNA test (and i bet thats coming) - my bank does it well so why cant these twats?

2019 and most of the world still has not woken up to the web.

thanks for the heads up, all changed to Password2 now :D

Company secretaries are the worst. Access to the Boss email and password on a postit note stuck to monitor


Sent from my iPhone using Tapatalk

Quote:

---

Originally Posted by Actual_Ben_Taylor

Don't see the point of super strong passwords when they just get hacked :rolleyes: 2 factor is the best.

---

This it's a ****ing nightmare, come up with a decent password that you can actually remember and then some useless tossers manage to leak everyones details online.