How vulnerable are individuals to cyber attacks?

[jim584672]

Some risk mitigation, have your email client block all remote content by default. So no images will be shown in your emails. You have to allow if you want to see it.

Another thing you can do is have a hosts file that blocks suspect web sites. Append this text to your hosts file and it blocks 97,643 sites from your machine.

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

I don't get any phishing emails, but I am very careful on who gets my email address.

 

[braumeister]

For Mac users (I'm one), here is a very good discussion of the risks and what you can do about them:

Effective defenses against malware and other threats

There will always be threats to your information security associated with using any Internet - connected communications tool:

1. You can mitigate those threats by following commonsense practices
2. Delegating that responsibility to software is an ineffective defense
3. Assuming that any product will protect you from those threats is a hazardous attitude that is likely to result in neglecting point #1 above.

Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

 

[brett]

Cyber attacks on my PC or Ipad??

Not a concern whatsoever.

I give them far more credit and having much more intelligence than to spend even five minutes of their time cyber attacking our systems when there are so many other worthwhile commercial, industrial, and Government sites out there.

Really, our travel pics are not that worthy nor are any of our stored docs or mail worth much of a look.

Like others we use normal precautions. Bottom line...if someone wants to get in they can get in. The issue becomes cost/benefit.

Watching too much TV.

 

[ExFlyBoy5]

My concern is not my computer but the computers of brokerages that have billions of dollars of our life savings and all our records, and records of the stocks they hold. Add our electrical grid. Nuff said.

This. Those that want to do significant damage aren't going to waste their time on lowly users. They might very well look to an intern's password of 123password to hack into a petroleum pipeline to take that down (and it worked), but trying to crack the computer on 123 Pine Street? Yeah, not the goal. The electric grid is probably one of the most exposed/probable targets...especially since the news has been very forthcoming about the vulnerability. You take down the grid (all *3* of them) and life gets very, VERY difficult for EVERYBODY.

 

[eytonxav]

This. Those that want to do significant damage aren't going to waste their time on lowly users. They might very well look to an intern's password of 123password to hack into a petroleum pipeline to take that down (and it worked), but trying to crack the computer on 123 Pine Street? Yeah, not the goal. The electric grid is probably one of the most exposed/probable targets...especially since the news has been very forthcoming about the vulnerability. You take down the grid (all *3* of them) and life gets very, VERY difficult for EVERYBODY.

But often times it is lowly users that become the key to getting major networks infested with malware.

 

[Qs Laptop]

Earlier in the thread I asked "What interest does a Russian hacker have in (our) computers?" I got one answer of "look up botnets".

In a typical botnet attack, hackers get the contents of your email address book and control of your computer and use this information to send spam emails to people in your address book. Or they use legions of computers they've gained control of to create denial of service attacks where they use computers they control to flood some entities website, making the website unresponsive. But most entities have plans in place to deal with denial of service attacks.

I was a victim of a botnet that gained control of my email address book back in the Windows XP days. It sent out spam emails to my contacts using my name as the sender. That was perhaps 20 years ago. You rarely hear about botnet attacks these days, or at least I haven't heard of them. Probably because there are common defenses for this sort of hack.

So, I ask again--why would Russian hackers be interested in a retired person's computer?

 

[ExFlyBoy5]

Earlier in the thread I asked "What interest does a Russian hacker have in (our) computers?" I got one answer of "look up botnets".

In a typical botnet attack, hackers get the contents of your email address book and control of your computer and use this information to send spam emails to people in your address book. Or they use legions of computers they've gained control of to create denial of service attacks where they use computers they control to flood some entities website, making the website unresponsive. But most entities have plans in place to deal with denial of service attacks.

I was a victim of a botnet that gained control of my email address book back in the Windows XP days. It sent out spam emails to my contacts using my name as the sender. That was perhaps 20 years ago. You rarely hear about botnet attacks these days, or at least I haven't heard of them. Probably because there are common defenses for this sort of hack.

So, I ask again--why would Russian hackers be interested in a retired person's computer?

I think the scams/bots/other are developed so fast, it's difficult to keep up with. I recently got a spam email that appeared to be from my MIL. However, it was her username used in conjunction with an ISP in Aruba. As in the email appeared as "username at some aruba isp dot net". It had a link in it that appeared to be a Google doc of sorts. I tried to find out ANY information on the Aruba ISP being used for hacking, but found NOTHING on it.

I also recently saw a video showing how EASY it is for a hacker to bypass second factor authorization of Google accounts. I watched it 3 times and while the presenter had two laptops (one the "hacker" and one the "hacked") and showed EXACTLY what he did, I still couldn't understand...it was very smooth and this method could fool A LOT of people.

Bottom line, I am very glad I am not in the cybersecurity business.

 

[grasshopper]

I think the scams/bots/other are developed so fast, it's difficult to keep up with. I recently got a spam email that appeared to be from my MIL. However, it was her username used in conjunction with an ISP in Aruba. As in the email appeared as "username at some aruba isp dot net". It had a link in it that appeared to be a Google doc of sorts. I tried to find out ANY information on the Aruba ISP being used for hacking, but found NOTHING on it.

I also recently saw a video showing how EASY it is for a hacker to bypass second factor authorization of Google accounts. I watched it 3 times and while the presenter had two laptops (one the "hacker" and one the "hacked") and showed EXACTLY what he did, I still couldn't understand...it was very smooth and this method could fool A LOT of people.

Bottom line, I am very glad I am not in the cybersecurity business.

Yikes, why I use a Yubikey as 2fa on google.

 

[kgtest]

To me by definition "cyber attack" means any attempt or successful attempt to manipulate systems, controls, software, hardware and computer data in my possession without my consent.

I've had a flagrant attack once. I use RDP and had inadvertantly left a port fowarded in my router open and without any access password... I was using my garage PC (a linux box) and all of a sudden I saw the computer operating on it's own. It opened a chrome browser, went to a California Craigslist page *(I was auto logged in with a saved password of mine), and began creating an ad for a Toyota Camry for sale as if the listing was going to be posted by me. When I was in the garage, I noticed the movement on the PC, quickly understood what was happening...and as I noticed it they were at the stage in the ad posting where they were putting in a contact phone number. I took a picture of the phone number with my cell phone and as soon as the 9th digit was input, i unplugged my PC, ran down to my router, and pulled the plug on the line from the outside box to my cable modem.

I thought for a minute about what had happened and realized earlier that day I left the port open and fwd as I went to my dad's to TEST if I could access my home PC from outside my network. And I could. The Problem was I never closed the port fwd by way of limiting the IP address ranges that could access it, so it allowed anyone with any IP access...and I'll be damned within 2 hours it was being accessed. That surprised the heck out of me!

I've suffered DDoS attacks before on my router and had to unplug and obtain new internet IP address before it stopped. That was somewhat annoying as it bogged down my connection and made it hard for DW and I to work remote for an hour or two before I decided to check the router logs.

The first one happened maybe 5 years ago and the second DDoS Attack happened last winter during COVID WFH.

I've had separate data breaches with my personal info being compromised from systems I did not have control of. One time my Wal-Mart saved CC numbers were used to buy goods from a Best Buy on the East Coast (i live in the midwest).

I've had personal info stored with the DoD compromised as well, being ex military they somehow breached the gubmint security to obtain identity info. That was followed up with a free lifetime membership to identity management services.

I can't actually count the number of times my personal info has been "accessed/obtained" without my consent. Probably happens almost every year now.

 

[Kwirk]

Yikes. I average about one a day.

I have several email accounts in use so that multiplies the number of phishing and advertising emails.

One of my accounts is an OG Gmail account based on my name. A surprising number of people seem to not know their own email address and use mine to create accounts, and not always at reputable websites. This seems to have greatly increased the number of spam and phishing emails.

Fortunately, most of the phishing email actually does go to my junk folder. I can scan the sources of the junk mail in less than 10 seconds and delete it all with 2 mouse clicks.

 

[ExFlyBoy5]

Yikes, why I use a Yubikey as 2fa on google.

Same. I really wish more companies used physical keys for access. Even the USG was using chip enabled access cards (with PIN) for a few years before I retired.

 

[OldShooter]

Same. I really wish more companies used physical keys for access. Even the USG was using chip enabled access cards (with PIN) for a few years before I retired.

Schwab provides access via physical token. I have never investigated it but here's a link: https://www.schwab.com/help/two-factor-authentication

 

[cag61]

So, any computer system is a target including Linux ones. Just ask yourself what is Linux used for mostly? Servers running applications and databases...

If you think you are not a target check your router's logs and see how many DOS (Denial of Services) attacks you get.

For Windows, the defender software is very good. You don't need anything else. and no I don't work for Microsoft or Amazon or Google or Apple. Let's just say I work at a place that gets hits thousands of times a day.

I would worry more about the Chinese than the Russians, they are already have my data.

Backups are great, have them. Password Keepers are also good, get at least an AES128 or better encryption and pick a password that you can remember without writing it down and I can't guess by your Facebook posts.

 

[target2019]

Earlier in the thread I asked "What interest does a Russian hacker have in (our) computers?" I got one answer of "look up botnets".

In a typical botnet attack, hackers get the contents of your email address book and control of your computer and use this information to send spam emails to people in your address book. Or they use legions of computers they've gained control of to create denial of service attacks where they use computers they control to flood some entities website, making the website unresponsive. But most entities have plans in place to deal with denial of service attacks.

I was a victim of a botnet that gained control of my email address book back in the Windows XP days. It sent out spam emails to my contacts using my name as the sender. That was perhaps 20 years ago. You rarely hear about botnet attacks these days, or at least I haven't heard of them. Probably because there are common defenses for this sort of hack.

So, I ask again--why would Russian hackers be interested in a retired person's computer?

Foreign adversaries and criminals do not care whose computer this is. They do know how to quickly penetrate weaknesses (sloppy security) and leverage the compromised machine against primary targets.
https://www.cisa.gov/uscert/ncas/cu...ored-actors-target-cleared-defense-contractor

Just because I have a powerful computer and use it does not make one invulnerable to compromise.

The general public has no idea about the depth and breadth of this threat.

 

[jim584672]

So, any computer system is a target including Linux ones. Just ask yourself what is Linux used for mostly? Servers running applications and databases...

That doesn't follow at all. Linux users are not running Web servers. Linux is much more secure than Windows.

I would worry more about the Chinese than the Russians, they are already have my data.

Why would the Chinese have your data, you give it to them? You hold State secrets?

 

[cag61]

That doesn't follow at all. Linux users are not running Web servers. Linux is much more secure than Windows.

strange we run our web server on Linux, most are Apache running on Linux


Why would the Chinese have your data, you give it to them? You hold State secrets?

Maybe

 

[Turbo29]

But often times it is lowly users that become the key to getting major networks infested with malware.

 

[jim584672]

Maybe

The whole Internet runs on Linux servers, 96.3%, of the top 1 million web servers and you don't hear of security problems, other than an occasional issue that gets discovered, and that gets quickly fixed.

The average Linux USER is not running a web server anyway.

 

[Tuirc]

Look up CISA and US Cyber Command then see National Security Agency to begin your quest of exploring what cyber capabilities the US has.

 

[Amethyst]

Exactly. Lowly users who click on carefully targeted phishing emails.

Especially scary, with so many people's home networks connected to work.

But often times it is lowly users that become the key to getting major networks infested with malware.

 

[Tuirc]

For Mac users (I'm one), here is a very good discussion of the risks and what you can do about them:

Effective defenses against malware and other threats

LOL….this was a joke post, right? Funny! But, it should probably be disclaimed lest someone believe it.

 

[Tuirc]

Cyber attacks on my PC or Ipad??

Not a concern whatsoever.

I give them far more credit and having much more intelligence than to spend even five minutes of their time cyber attacking our systems when there are so many other worthwhile commercial, industrial, and Government sites out there.

Really, our travel pics are not that worthy nor are any of our stored docs or mail worth much of a look.

Like others we use normal precautions. Bottom line...if someone wants to get in they can get in. The issue becomes cost/benefit.

Watching too much TV.

Check your premises. They are wrong. It doesn’t require anybody any time at all infecting your computer. They simply write a script that infects all computers that has the same vulnerability you have. Then they set a trap. You fall into the trap, poof, you’re infected. Part of their bot army. Simple and infecting you personally took them no time at all.

Bots are cattle not pets. You collect them by the thousands not individually. You can’t get millions of computers into you bot army by manually infecting or hacking them. And, believe me, the major players that you hear about in the news everyday all have huge botnets full of people with more hubris than computer security sense who know they are not infected.

 

[Tuirc]

Earlier in the thread I asked "What interest does a Russian hacker have in (our) computers?" I got one answer of "look up botnets".

In a typical botnet attack, hackers get the contents of your email address book and control of your computer and use this information to send spam emails to people in your address book. Or they use legions of computers they've gained control of to create denial of service attacks where they use computers they control to flood some entities website, making the website unresponsive. But most entities have plans in place to deal with denial of service attacks.

I was a victim of a botnet that gained control of my email address book back in the Windows XP days. It sent out spam emails to my contacts using my name as the sender. That was perhaps 20 years ago. You rarely hear about botnet attacks these days, or at least I haven't heard of them. Probably because there are common defenses for this sort of hack.

So, I ask again--why would Russian hackers be interested in a retired person's computer?

Now look up ransomware.

In the newest rendition of ransomware cyber criminals use scripts to identify stuff of value on your PC, exfiltrate that to their command and control server for further monetization. Then they encrypt your machine and charge you a fee for the key to get it back. The key usually works and they have amazing customer service.

You need to understand, this is no longer the province of kids in their basement, these are sophisticated corporate enterprises buying Malware as a Service from other corporations. They are professionals in how to harvest and monetize the take they can get from your computer. They don’t do it by looking at you as an individual anymore than a farmer does his work by looking at corn as an individual plant.

You simply grab the data, dump it into a data lake. See what’s selling in the info marketplace and run queries across the data lake to get responsive items and sell them for $10 a row or whatever the going rate is.

If you pay the ransomware too, Great! Even more money.

Seriously, I get the impression reading everyone’s responses on this thread that they have no concept of what they are up against.

 

[Tuirc]

The whole Internet runs on Linux servers, 96.3%, of the top 1 million web servers and you don't hear of security problems, other than an occasional issue that gets discovered, and that gets quickly fixed.

The average Linux USER is not running a web server anyway.

Ever hear of the Apache Struts vulnerability? Let me jog your memory— Equifax. That was running in Linux. Thinking certain flavors of OS’s are invulnerable or less vulnerable is a fool’s game. Professionals don’t have a religion when it comes to operating systems and we realize that the days when bad guys targeted OS’s primarily are mostly behind us. The application layer is the attack surface de jour.

Doing cyber hygiene is a must:
- Patch everything ASAP
- Multi-factor everything
- Password Manager using 20+ character passwords different for every site and multi-factor to get into it
- Use Yubikeys
- Use antivirus software (don’t use Kaspersky)
- Despite all of this, you can easily be pwn’d. If you don’t have a strong corp SOC doing cyber response to clean up after you, you better have super solid skills at not going anywhere suspicious, not clicking the wrong e-mail or link, ever. It only takes one click, one time.

But I just run cybersecurity for a $30 Billion multinational, so maybe I don’t know.

 

[target2019]

That doesn't follow at all. Linux users are not running Web servers. Linux is much more secure than Windows.

Why would the Chinese have your data, you give it to them? You hold State secrets?

There was a large hack against the gov't, and many QIP forms (like mine) are now in the hands of the Chinese. Since it was a form used to launch a clearance investigation, it literally had everything about me and family, including my fingerprints.

In 2015, the U.S Office of Personnel Management (OPM) announced that it had been the target of a data breach targeting the records of as many as 21.5 million people.[31] The Washington Post reported that the attack came from China, citing unnamed government officials.[32] FBI director James Comey explained "it is a very big deal from a national security perspective and a counterintelligence perspective. It's a treasure trove of information about everybody who has worked for, tried to work for, or works for the United States government."[33]

https://en.wikipedia.org/wiki/Cyberwarfare_by_China

This is just one in a series of many break-ins. They continue to this day.