Harmony Central Hacked ....

[capnjuan]

Read Full Message Here. Apparently creeps hacked in accessing email addies ... whatever else the little jerks could find ... if any other BBers are members, reasonable chance of a fresh wave of spam because of buying/selling my/your email address ... and robo-calls ... and phone spam if your phone # was in there:

Caller: "Hi capnjuan, we are a new bank offering credit cards as a reward for new deposits. If you'd like a new credit card, please forward you check ... "


:evil: :evil:

 

[fronobulax]

If you ever receive any message supposedly from Harmony Central asking for that or any personal information, note the sender, delete the email immediately, restart your computer, and alert us to the situation.

Hmmm.

The "sender" is likely to be hacked or falsified. Deleting it immediately protects the user but pretty much eliminates the chance to use the email in any kind of investigation. Restarting the computer seems silly. At least I cannot think of any threat that can be eliminated solely by restarting.

If I were serious about trying to investigate this I would at least get a copy of the email header before performing the other steps. On the other hand if the stolen information was sold to a Spammer then there is very little that can be gleaned from the email that can be traced back to the perp.

 

[capnjuan]

... The "sender" is likely to be hacked or falsified.

If the hacker was clever enough to hack H/C then they're clever enough to know how to hijack open ports on PCs and borrow somebody else's email ID/ISP connection.

"Why do we do it? Because we can" Sun Tzu, The Art of Spam

 

[fronobulax]

... The "sender" is likely to be hacked or falsified.

If the hacker was clever enough to hack H/C then they're clever enough to know how to hijack open ports on PCs and borrow somebody else's email ID/ISP connection.

"Why do we do it? Because we can" Sun Tzu, The Art of Spam

True enough.

What triggered my comment is that what most email programs report as "Sender" is information that is easily editable by a user. Thus it is one of the least trustworthy things in email, regardless of source or intention.

When you consider Spam, as sent by botnets, what the Sender field contains is almost always random, arbitrary or stolen from the machine that has already been hijacked to be part of the botnet. Furthermore since the machine has been hijacked, the verifiable portions of the mail header will trace back to the ISP of the hijacked computer's owner.

Thus Sender is of little use and the email header will lead back to the botnet. One would have to discover the controller/owner of the botnet before it would even be feasible to trace back to the Harmony Central Hackers.

One can almost imagine the PR Flacks and Spin Doctors saying "Well, we need to ask people to do something. If we don't then we will be seen as being unresponsive. How about "Sender"? It is easy for an idiot user to figure out and we can't use the information anyway."

 

[capnjuan]

You're right; the piece of information that is most readily accessible by a recipient is the information that is least useful in tracking down the running dogs.

 

[Default]

Thus Sender is of little use and the email header will lead back to the botnet. One would have to discover the controller/owner of the botnet before it would even be feasible to trace back to the Harmony Central Hackers.

Considering the C&C server is sitting up on an IRC channel somewhere, being remotely accessed from lord knows where...

 

[Dr Izza Plumber]

We were hacked over at the motorcycle site too, back a few weeks ago.

A troll used someone's account to perform his dirty work, then he deleted the member's account. I had to call the gentleman in Rhode Island, and explain the details to him.
We opened a new account for Him, and allowed him to post his butt off to make senior member again.

Meanwhile, I combed the membership data base and found not only him, but another bunch of trolls embedded into the site, (prolly back when the previous owner used auto sign up). I removed them (found them via the ICQ number category), and shortly afterward, My p/c contracted a virus as a result.
One dirt bag posing as a member, had a virus code attached, which sped up the hard drive to failure. However, I had dual hard drives, plus I was able to retrieve all My data from the first drive.
I repaired the old girl, but realizing that she needed some rest time, I bought a new pc on black friday, complete with windows 7, which is nothing but a warmed up version of vista.

My advice to forum admins is to watch the signature boxes on new registrant's profiles for tiny, (almost invisible) code. We currently screen all registrants with net tools, even before We send a request for contact info. Also, if You are not already checking emails addy's and IP's, here's a valuable FREE tool resource for that purpose: http://network-tools.com/

~ Izza

 

[Default]

pm sent

 

[the super8]

If these hackers are going to try to steal my identity, I hope they can do a better job with it...
"When you've got nothing, you've got nothing to lose."

 

[fronobulax]

Considering the C&C server is sitting up on an IRC channel somewhere, being remotely accessed from lord knows where...

Yep. The good news is that there are white hats who are figuring that out. See this for an example. The bad news is that it is difficult and the arms race between the black and white hats continues. Almost makes you long for the days when computers were not networked and you just scanned every floppy disk and CD :wink:

 

[fronobulax]

One dirt bag posing as a member, had a virus code attached, which sped up the hard drive to failure. However, I had dual hard drives, plus I was able to retrieve all My data from the first drive.
I repaired the old girl, but realizing that she needed some rest time, I bought a new pc on black friday, complete with windows 7, which is nothing but a warmed up version of vista.

My advice to forum admins is to watch the signature boxes on new registrant's profiles for tiny, (almost invisible) code. We currently screen all registrants with net tools, even before We send a request for contact info. Also, if You are not already checking emails addy's and IP's, here's a valuable FREE tool resource for that purpose: http://network-tools.com/
~ Izza

1) Do you happen to know the name of the virus as characterized by any of the AV vendors? I know several viruses that generate extreme disk activity as a side effect but one that does it out of spite in at attempt to induce hardware failure is new to me.

2) I like Windows 7 better than Vista to the point that I would recommend using Windows 7 on a new machine rather than downgrading to Windows XP but there is still a big "so what?" and "why bother?" factor. Gee, since we need to stop political threads about global warming and climate change, maybe we should introduce the Operating System Holy Wars? At least we could tie those to the Topics at Hand because of recording and sound editing software.

3) Thanks for the link to tools. It's nice to have them all in one place and somewhat idiot proofed.

 

[Default]

Considering the C&C server is sitting up on an IRC channel somewhere, being remotely accessed from lord knows where...

Yep. The good news is that there are white hats who are figuring that out. See this for an example. The bad news is that it is difficult and the arms race between the black and white hats continues. Almost makes you long for the days when computers were not networked and you just scanned every floppy disk and CD :wink:

When I was still doing the college thing last year, I did a paper on botnets. What I found unnerving was the denial of service attacks that were auto-launched against the researchers studying it. For a while, you could block the internet relay chat ports, and the botnet would go dormant, but now the herders are getting around that. I get very annoyed at people who are operating obviously infected machines, that don't care that they are aiding organized crime. :evil:

 

[capnjuan]

... When I was still doing the college thing last year, I did a paper on botnets.

For those of us who never really understood Edlin, could you explain what a botnet is and how it works? Thankee ... J

 

[Default]

I'll have to dig up the files. I have them backed up somewhere around here.

 

[capnjuan]

I'll have to dig up the files. I have them backed up somewhere around here.

Gee ... I hope they weren't hacked ... :wink:

 

[marcellis]

Must be pretty serious. HC has been down 5 or 6 days. There are no updates after day 3.

 

[Default]

I'll have to dig up the files. I have them backed up somewhere around here.

Gee ... I hope they weren't hacked ... :wink:

Worse, I think they're on the old laptop drive. My wife was using it 14 hours a day during the summer looking up her fricking ancestry online and I was going to back it up, but she always had it in her hands. :evil: :evil: :evil:

Then she handed it to me and said, "this doesn't work anymore".

:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:
:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:
:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:
:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:
:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:
:evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil: :evil:

 

[capnjuan]

Ouch!

 

[Default]

Well, I'm supposed to know better by now.

 

[capnjuan]

Well, I'm supposed to know better by now.

" ... if this is love ya gotta give me more ... "