Cyberthieves Silently Copy Your Passwords as You Type

NY Times ^ | February 27, 2006 | TOM ZELLER Jr.

[Riley]

Okay, TTY then. I'm going to go 'ambush myself' with another cup of coffee. :-)

[GOP_Proud]

Bump

[Turbopilot]

Sigh...and I just had said I'm going to bed.

If my machine's been hacked, then my firewalls and other antivirus and antispyware programs haven't noticed. None of my files have been opened, changed or deleted, and no new ones have been created. No new services or processes are running, and no existing services or processes have been stopped. Nothing's been added to or deleted from the list of programs, processes, or services that start when my system starts up. No packets are entering or leaving unauthorized ports, and no programs are sending or receiving packets from the few ports that are open. Nothing is being redirected by my browser hosts file. No system resources are being used by anything unauthorized. So whatever those Russian haxxors did, it had no effect on either me or anyone else. What is it, exactly, that they did, anyway?

[D-fendr]

I don't think MS wrote it - I believe they bought the (very) good product Giant had.

Then it should be good - for another year or so.

:)

[goldstategop]

If my computer's hacked, I haven't noticed. I stay away from dangerous websites.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[HiTech RedNeck]

I stay away from dangerous websites

And how are you to know exactly what that is, if you Google or Dogpile for things very often. Something that looks innocuous could be a real gotcha.

[HiTech RedNeck]

Shouldn't it tell you something, that you need to run your Windows computer like a police state to even begin to make headway against the cyber pestilences?

[backhoe]

"I recommend Ewido and Microsoft Anti-Spyware - they're both free."

---

They *are* very good-- one thing I suggest is running one of the online scans once in a while. While looking for programming information on my old bag phone, I stumbled across sites claiming to be "real hacker sites," and darned if they didn't boast of writing malware that could "get by any antivirus, and remain undetected one time out of five."

Since I use AVG ( it, and Avast!, are highly thought of by several antimalware forums ) I tried a couple of online scans, and danged if they didn't find a few tracking cookies, and a Trojan, that slipped by AVG and Ad-Aware.

Worth a try, from time to time:

http://www.bitdefender.com/scan8/#

http://housecall-beta.trendmicro.com/en/start_corp.asp

http://www.kaspersky.com/virusscanner

http://www.pandasoftware.com/products/activescan.htm

[tangerine]

I just copy and paste passwords and IDs.

[Riley]

I'm not convinced that it's good now. There are several pieces of known malware that default to 'ignore' as the recommended countermeasure. Claria (Gain) in particular.

(ahem) coincidentally, there was some talk of Microsoft buying Claria. I think they're denying it now, or have scrapped the idea.

To get the most out of what is now 'Windows Defender', one really must closely watch it's recommendations for what constitues a threat and adjust those actions, accordingly.

[Riley]

Thanks for reminding me of something. (No quarrel with your list of resources- it just made me think of something)

The Internet is FULL of bogus 'antispyware' applications. If you run one that has claimed to have found something and wants thirty bucks to clean it off for you- you have almost certainly got a bogus app.

http://www.spywarewarrior.com/ is a resource that tests and maintains lists of the good and bad ones, and has a very active forum that is staffed with volunteers who have helped innumerable victims of this stuff get it off of their machines. It is also a good place for IT people to look up a specific procedure without wasting ages dissecting some particular piece of malware.

[backhoe]

"The Internet is FULL of bogus 'antispyware' applications. If you run one that has claimed to have found something and wants thirty bucks to clean it off for you- you have almost certainly got a bogus app.
http://www.spywarewarrior.com/ is a resource that tests and maintains lists of the good and bad ones..."

---

So true-- the forums I frequent are full of tales from people who got suckered by "antispyware" that was malware in disguise.

Here are a couple of other good forums:

http://forums.spywareinfo.com/index.php?b=1

http://www.geekstogo.com/forum/index.php?s=4b224f07b3e0d797d7cdac5dfe673b2b&showforum=37

[Riley]

I haven't been to 'Geekstogo', but I agree with the Spywareinfo forum as being a premier resource.

I also read:
http://www.benedelman.org/
And the forums at:
http://www.aumha.org/
http://www.sysinternals.com/

[backhoe]

Thanks- Hadn't seen those!

[Riley]

Just a note to all- don't EVER buy antispyware software from an ad that appears IN A POP-UP WINDOW! It's like finding a brick in your living room that's been thrown through your window, with a glass company ad on it, as far as I'm concerned.

[goldstategop]

Microsoft has replaced its Anti-Spyware product with a new beta - Windows Defender. It installs a new Software Explorers applet in the Control Panel. This can be used to view processes that are running on your computer and enable and disable them as you see fit.

(Denny Crane: "I Don't Want To Socialize With A Pinko Liberal Democrat Commie. Say What You Like About Republicans. We Stick To Our Convictions. Even When We Know We're Dead Wrong.")

[sneakers]

bump!

[Publius6961]

And you have no way of knowing if a keylogger program is installed on your Windows computer.

This is the part that I find difficult to believe.
There must be a link in the exploitation chain that the user can have control of on a "live" basis, as it happens.
For instance. No email goes out, ever, without an active confirmation...
Surely, the forces of good is as innovative as the forces of darkness...

[Publius6961]

Keyloggers can't detect mouse position?

[Minn]

SSN: 123456789 type 5 mouse in front of the 5 type 2 mouse after the 5 type 9 etc.

Better still, use copy/paste, especially on a public machine.