A question about Windows Vista.

whattochoose

esuhl wrote: »

One sensible precaution would be to run your web browser in a sandbox.

Yes esuhl, I am aware of Sandboxie. It is very good, and I do use it from time to time.

whattochoose

[Deleted User] wrote:

Hi,
I'm still getting updates for Vista Home Premium, try a manual check for updates

By this do you mean the "check for updates" option in the Windows Updates window frugal?
I do keep doing this, sometimes all day and have downloaded this to stop my computer from going to sleep....

https://mousejiggler.codeplex.com

But, alas, no updates are forthcoming.

AndyPix

No security software can protect you against a buffer overrun vulnerabiity exploited by a specially crafted web page that basically means that if you have an unpatched OS with known vulns then i can basically force your computer to execute my malicious code.


All i have to do is set the trap and wait for a suitably unpatched system to come along and visit my web page and BANG my code has done what it wanted to your computer and i get a little email alert saying "We got one !!!".


No virus killer can detect the attack because no virus has been downloaded, and malwarebytes etc cant see it because it is not a file that sits on your computer.


I could use this to redirect you to fake banking sites etc to skim your details, turn on your webcam or any number of other nasty stuff

AndyPix

whattochoose wrote: »

By this do you mean the "check for updates" option in the Windows Updates window frugal?
I do keep doing this, sometimes all day and have downloaded this to stop my computer from going to sleep....

https://mousejiggler.codeplex.com

But, alas, no updates are forthcoming.

http://answers.microsoft.com/en-us/windows/forum/windows_other-update/how-can-i-fix-windows-vista-to-update/1f0ce12a-11c9-4c2f-b5e2-8e2ab371ac59

whattochoose

AndyPix wrote: »

No security software can protect you against a buffer overrun vulnerabiity exploited by a specially crafted web page that basically means that if you have an unpatched OS with known vulns then i can basically force your computer to execute my malicious code.


All i have to do is set the trap and wait for a suitably unpatched system to come along and visit my web page and BANG my code has done what it wanted to your computer and i get a little email alert saying "We got one !!!".


No virus killer can detect the attack because no virus has been downloaded, and malwarebytes etc cant see it because it is not a file that sits on your computer.


I could use this to redirect you to fake banking sites etc to skim your details, turn on your webcam or any number of other nasty stuff

Could I avoid something like this by ensuring I only open something bank or finance related in the safe money option Kaspersky provides or even using something like this ......
https://www.virustotal.com .......to check?
Also Andy, I only look at the bank sites I bank with. Would a fake one be able to fully replicate those sites, and I'm sorry if that's a stupid question.
Thank you.

AndyPix

More simple than that, you can just ensure that the url you are visiting begins with HTTPS:// .. and is the correct url for your actual bank.


Note the S


But that was only a simple explanation of how an attacker could own you. And not many people would fall for that glaringly obvious technique. A genuine attacker would use more subtle and multi-pronged approach, and possibly couple this with a bit of social engineering too depending on what his desired end is.


Best to just keep the door shut if possible.


Of course, it is pretty unliklely this will happen to you. Its all about managing your own risks

whattochoose

AndyPix wrote: »

More simple than that, you can just ensure that the url you are visiting begins with HTTPS:// .. and is the correct url for your actual bank.


Note the S


But that was only a simple explanation of how an attacker could own you. And not many people would fall for that glaringly obvious technique. A genuine attacker would use more subtle and multi-pronged approach, and possibly couple this with a bit of social engineering too depending on what his desired end is.


Best to just keep the door shut if possible.


Of course, it is pretty unliklely this will happen to you. Its all about managing your own risks

Thanks Andy, but please, could you elaborate on this?

AndyPix

Well an attacker might start by skiming your credential for other, none critical sites. Perhaps your email account, look at documents to glean your phone number, and perhaps some info that would give him answers to common bank security questions .. Eg your dogs name, mother maiden name etc.
He could then use some of these to impersonate you with the bank ..
He could build up a full picture of you, and perhaps use this to extort you in some way (eg threaten to release personal pictures/info about you).
Use your identity to commit other fraud
Maybe use your email address to send out tons of loaded spam to infect other people, use your machine as part of a DDOS attack, or a relay to do some big corperate hacking and mask his trail.
A "good" hack doesnt all happen in 1 go, it takes a bit of time peeling back the layers like an onion.
Using one system to gain access to the next etc,.


An example that has just happened to a friend of mine :-


Basically, £3000 dissapeared from his bank account.
It had been moved to one of his friends accounts (because paying anyone other than a previous payee will generate a OTP sent to the mobile phone)
The next stage in the attack was his freind got a text message, spoofed to look like it had come from my friend) saying something along the lines of "5h1t, iv just put 3k in your account by mistake, please do us a favour and transfer it back to my other account, sort code, acct number etc"


Now this would have worked had my friend not actually been in the room with the other guy at the time!!
Lucky him.


Now inthe days leading up to this, a fake facebook profile had been set up in my friends name, his current friends had been invited to join him, his friends had got various texts saying "hi this is my new number", even his mum !!


A lot of ground work had been done using info grabbed from his compromised computer






It totally depends on the attacker and what his desired end is.


Like I said, i dont want to scare you as this will likely never happen to you. But its best to be aware of the risks.

whattochoose

AndyPix wrote: »

Well an attacker might start by skiming your credential for other, none critical sites. Perhaps your email account, look at documents to glean your phone number, and perhaps some info that would give him answers to common bank security questions .. Eg your dogs name, mother maiden name etc.
He could then use some of these to impersonate you with the bank ..
He could build up a full picture of you, and perhaps use this to extort you in some way (eg threaten to release personal pictures/info about you).
Use your identity to commit other fraud
Maybe use your email address to send out tons of loaded spam to infect other people, use your machine as part of a DDOS attack, or a relay to do some big corperate hacking and mask his trail.
A "good" hack doesnt all happen in 1 go, it takes a bit of time peeling back the layers like an onion.
Using one system to gain access to the next etc,.


An example that has just happened to a friend of mine :-


Basically, £3000 dissapeared from his bank account.
It had been moved to one of his friends accounts (because paying anyone other than a previous payee will generate a OTP sent to the mobile phone)
The next stage in the attack was his freind got a text message, spoofed to look like it had come from my friend) saying something along the lines of "5h1t, iv just put 3k in your account by mistake, please do us a favour and transfer it back to my other account, sort code, acct number etc"


Now this would have worked had my friend not actually been in the room with the other guy at the time!!
Lucky him.


Now inthe days leading up to this, a fake facebook profile had been set up in my friends name, his current friends had been invited to join him, his friends had got various texts saying "hi this is my new number", even his mum !!


A lot of ground work had been done using info grabbed from his compromised computer






It totally depends on the attacker and what his desired end is.


Like I said, i dont want to scare you as this will likely never happen to you. But its best to be aware of the risks.

Phew! Thank you, from now on caution is my watchword.

AndyPix

whattochoose wrote: »

Would a fake one be able to fully replicate those sites, and I'm sorry if that's a stupid question.

Its a very valid question, and the answer is most definately yes.
A 10 year old child with a bit of nouse can use the tools within kali linux to clone any site they like.
Its about 4 clicks of the mouse to do so.


Make sure you see https:// at the beginning of the site URL, because stripping SSL is a little more complex (but not impossible), and the script kiddies tend to only go for the low hanging fruit