Email Virus

Disconnect the computer from everything. Turn it off.

Run the antivirus again.

Beyond that, I'd take it to the IT guy you use.

You might try restoring to an earlier backup, but....................................

I was working at the shipyard...... And the IT came around our shop, which was one of the last ones and he said there was a virus in the main office, and he had to load the antivirus software to all the computers. He was using a memory stick, I asked him why, he said to ensure he didn't spread the virus. I looked at him and told him, as long as the virus isn't on the stick, he looked and me, and said as if I was an idiot, and responded "no way".... Quite sarcastically.

After I said ok......... And stared at him........ Reality sunk in, and he used the anti virus software on his stick...... And a short time later he swore...... The virus showed up And had to redo all the computers again.

Poor lil fella.

Thank you I did that, Avast found no issues.

I got an email from my bother this morning with his email addresses and some strange ones. This had a link to a diet advert.

Is there any chance your smart phone may have done this? Last year a friends smart phone was sending out emails to his address book entries.

So it may not be your computer, but some other place you keep email addresses.

Those are my symptoms. How would I go about finding it and correcting it in an Iphone?

Try restoring it from a backup. You'll lose all changes you've made since your backup, of course. Or, just take it to an Apple store, worship the Geniuses and let them do it.

I am thinking that this is an old Virus from a few years back, but it might be a new version ..but here is a suggestion, you might have some luck with Superantispyware.com ............ Free Version ........download and run..........Good luck ....Rescue

Yep, it was that way with me. When I tried to close the window, it asked for a confirm closing click. I refused to do this and forced a shut-down of the computer. Cleared my browser cookie files and history, then reconnected to the internet. Just finished installing Linux tonight, so I don't think that one will hit me again.

--JMM

Commiserations brother.

Do you remember the name of the attached file? What was the extension on the file name?

So your friend's email address got hijacked first....

I hope you can sort out the problem.

Quarantining your PC from the internet until you do sort it will remove you from the host pool.

I hope you have another PC or a smartphone so you can research a solution and cure your infected machine.

There are sick folk out there who get their rocks off creating and seeding the internet with these malignant codes. Why? What's the reward mechanism?

I hope I don't catch what you have.

Get well soon.

No, I don't. I haven't deleted them, only moved them to the "trash" pile. Is there some group or entity that I could fwd it to for tracking purposes?

I don't know of any group or entity that will track it.

My question was selfish really. I just want to hopefully recognise one in case it turns up in my email.

I'm sick enough without a sick computer to contend with.

Getting back to your question....there SHOULD be somewhere that deals with this...or maybe not. I've never heard of any place but I figure the tracking must be doable.

Something new. I belong to a manual exchange site. The site connects people with service manuals to others who might need them. It is administered by yahoo. I seldom open any of them, even if I'm interested, I just place the items of interest in a special folder, the rest I delete.

At any rate, I have a couple of vintage radios that I look for advice on. I see this email in my in box "(manual exchange) How are You". The sender is someone I don't recognize with an aol address.

If it makes any difference, I'm using Mozilla Thunderbird

Really great blog, very interesting, we all need to know this stuff!! Thanks. It helps a lot....

A month or so ago I started getting notices of emails that I am supposed to have sent, but didn't, to non existent email addresses. It was a notice that it couldn't be delivered......very strange for me at least.

I could be fairly certain that they were not sent from my PC as it keeps a record of all mails sent, but appeared to be from my mail account......therefore it could be from a different computer, but using my account and password. Two accounts were compromised......

Then I read about that millions of email addresses have been password "cracked" because the "SSL" safety software had an error in it, so I changed and improved the password for all of my mail accounts, since then nothing more......but it has only been 3 or 4 weeks.....

If anyone here has NOT changed their passwords, all of them, to a new and safer one, that could also be part of the problem.......its a good idea to do anyway from time to time.......

Best of luck to all.

Oh boy. I remember reading about the password problem. True, nothing indicates that it has been sent from my computer or cell phone for that matter. The problem is that I can't change that password. I switched to a "free" AOLl account. In order to change the PW, they want to know the last 4 digits of the credit card used when I last had a paid service. I have a pretty good idea which bank, but I don't remember the year. I'll give the bank a calk and see what they can/will dig out. At least "they" can't change the PW either.

I have received those emails too, from the Grandchildren, etc. Therefore the temptation to open was strong. My email inbox screen shows part of the first line of the email, and it was generic, not at all what I would have expected. Therefore it was deleted without opening. My preview pane is turned off. I use AVG paid version.

Lyn was correct that you isolate your computer ASAP. A good deal of modern malware can replicate by attacking all the computers it can on the local network.

The problem is this type of thing is routine anyone tasked with tracking this stuff down would be overwhelmed.

Hackers are technically ahead of the good guys these days. You will not be able to recover your computer like you could in the good old days by using AV software. The technology that allows malware to be invisible to AV scanners is over 5 years old. The only cure is to purchase factory restore disk which formats then restores the computer back to 'new'. You need to back up your data before you clean it.

http://www.restoredisks.com/

To keep our readers informed here is a fresh batch of disturbing articles. Apparently, most smart devices connected to the internet contain malware. It is possible they were shipped with the malware already installed. The devices that were shipped clean are probably quickly infected once they are attached to the internet. Although consumers can't find these, engineers can. Hiding malware on such a tiny device is like trying to hide an elephant in a closet. Trying to find stealthy malware on a computer is like finding a needle in a haystack. The most disturbing part of this other than John Q public that can't conceive his computer is under the control of criminals, is some smart devices made in China have hardware that allows the smart device to take over the home network. If this is true there are those in China that don't worry about getting caught. I suspect more than 50 million home computers are actually zombies with an equal amount of business computers. It is likely all cell phones are also compromised. That many zombies can certainly bring down the internet and the phone system. They probably can knock out our electrical grid.

Beware of the Thingbots

https://blog.kaspersky.com/beware-the-thingbot/

Very disturbing…

'Chinese appliances were found to contain a chip specifically crafted to spread malware to nearby computers.' (I suspect the appliance was preinfected with a bot net that could use the chip.

https://community.thawte.com/articles/new-infection-threat-malware-spreading-chips-attacks-connected-appliances

attack of the zombie refrigerators

http://www.rawstory.com/rs/2014/01/17/hackers-use-smart-refrigerator-to-send-750000-virus-laced-emails/

http://www.theblaze.com/stories/2014/01/21/youll-never-guess-what-hackers-used-in-a-complex-cyber-attack/

Detecting Polymorphic Malware

http://www.lavasoft.com/mylavasoft/securitycenter/whitepapers/detecting-polymorphic-malware

After the "update", the backdoor becomes invisible to AV signature-based scanners. Moreover, such backdoors often block access to AV websites stopping the user's security application from downloading new detection database updates.

WOW!.... I just purchased a smart fridge a month ago, not knowing anything about this issue. This is really scary to my wife & I because while we've been getting used to the new fridge and enjoying all the new bells & whistles we could be being hacked. NOT COOL.

A little more bad news.

The figures show that around 27 million new strains of malware were created in 2012, averaging at around 74,000 per day. This brings the total number of malware samples to a whopping 125 million.

http://news.softpedia.com/news/Panda-Security-27-Million-New-Malware-Strains-Discovered-in-2012-327251.shtml

A newer post - McAfee reported that 100,000 new strains of malware were unleashed each day. Not enough manpower exists to manually address the sheer volume of new malware samples that arrive daily in analysts' queues. In our work here at CERT, we felt that analysts needed an approach that would allow them to them to identify and focus first on the most destructive binary files. This means they are ignoring the stealthy botnets that only steal your private information such as login credentials and attack other computers, turning them into zombies or create spam.

http://blog.sei.cmu.edu/post.cfm/new-approach-prioritizing-malware-analysis-111

This might be an article on the botnet you have. It is a primitive botnet that would rely on someone opening an attachment or link. This is good new because you might not need to format your hard drive.

http://www.fortiguard.com/legacy/analysis/zeusanalysis.html

There were only 15 addresses in this account. However the CC line listed 2 or 3 dozen, some of which I didn't recognize and others that were never contacted on this account. The botnet has access to a database filled with email addresses. All the email addresses of all the accounts this botnet has taken over are all on a server halfway around the world. Unless the botnet is fairly new it probably has millions of email addresses.

What you can do I alert the persons who you sent email to and state on the subject line that this account has been hacked. If you can call any of the contacts have them report you. This probably happens a thousand times a day for a large email prvider. They will have an automated routine that might help some. These happen so often 24/365 the security might be overloaded and overhelmed.

The current state of the internet and computer security is a vague equivalent of medicine in the early 1900's: see the 1918 flu pandemic that "only" killed 20-40 million worldwide, polio still running rampant, etc. I'd say we're at about 1909 on a comparable timeline...

Heartbleed isn't the Big One. Neither was Target.

We are not yet good enough with computer security to protect ourselves from a more sophisticated, catastrophic, widespread attack. By "we," I mean the whole civilized world, though Europe is a little bit ahead of the US. We understand the level of exposure and the scope of the threat, but we haven't figured out how to protect ourselves from it.

"We've" been unforgivably lazy about protecting our money in the US. Chip-and-PIN credit card tech has been around for about a decade, but it's been considered "too expensive" to put in place here... by people who can afford to lose hundreds of thousands of dollars and not be bankrupt.

I am afraid you are the only one that really "gets it". I feel like Charles de Gaule claiming that the Maginot Line is worthless.

I am almost surprised that so few in this savvy group take this to heart until I Googled then read articles on "is antivirus software useless". Most, but not all, the tech writers didn't get it either. Almost everyone is fixated on the plague of unsophisticated botnets that is crushing the AV scanning companies. I suspect these are 'cover' for the more sophisticated botnets. The most popular botnet is given away. I bet these bot nets are designed to be discovered. This provides cover for the paid for apps that are a bit more stealthy. The AV companies can't handle what they do find 100,000 per day. I would liken that to you being required to drink 5 gallons of water every hour 24/7. They have to ignore most of them and focus on ones that do damage to the computer. Your AV scanner only looks for a minute portion of the known malware and there is probably more unknown than known.

No one worries about the military grade malware. It is classified this way because it is actually more sophisticated than state developed malware used in successful cyber-attacks. Kits to create these sell for a whopping $2,500 USDs.

No one goes to this much trouble not to have an end game.

Well, I work for DOD. I'm not the only one with a sober view, though rest assured that the vast majority of us view security as just as much of an inconvenience as anyone does.

We have pretty strict measures and rigorous, repeated training on protecting our systems and networks. Still, very few feel they're really protected.

I'd feel pretty safe if I treated my personal resources as well as I treat my work resources.

No one goes to this much trouble not to have an end game.

Yep.

I got a list of credit card numbers from the bank. So we shall see. I'll keep you posted. Thanks for all the helpful tips. This thread has uncovered a number of scenarios I never considered. (Much to my chagrin). Some are feasible, others, well just buy another one.

My experience was with the service, change passwords every 90 days. You couldn't reuse a password, even after 20 changes. I always wondered where those passwords were stored, and the difficulty of cracking that location.

You may want to look into locking your credit score. In the US this is cheap $5-15 depending on the state. You need to pay to unlock and can be a pain if you yearly open new loans. I have opened accounts twice in over 5 years.

The locking of credit accounts has really hurt the identity theft business. It is now risky to steal an identity so consumers of PI are in short supply. If you try to steal an identity of locked account you will probably get caught. This and systems like lifelock have made a huge dent in the once rapidly expanding ID theft business. You may as well set your trap.

Finally, I got contact with AOL, the bank (Bank of America) was able to dig out the correct CC info. The PW and security questions have been updated.

This is AOL's response "Unfortunately, it looks like your email account is being spoofed. This means a spammer is sending out messages and entering your email address in the From: field. This makes it seem like the spam email is coming from you, even though it isn't coming from your account or from AOL servers" and "Sorry about it, we have no information yet as to where it came from but AOL has updated their system to tell email providers like Gmail, Yahoo Mail , Outlook.com and other AOL Mail itself to block or reject email addresses that is sent from non-AOL severs."

My final question is, I use Mozilla and the PW is stored "somewhere" so when I open the account my emails are automatically downloaded. Same with the IPhone and Pad. Should I change this and enter a PW each time?

The principle is, give your data an amount of security that matches its value - to you and to anyone else.

Can someone else sit down at your computer and access your email without entering a password of some kind? If so, consider erasing that embedded password.

I would (did recently) change all my passwords o a really "strong" version using different special characters, numbers and upper and lowercase. At least 8 characters....

My suggestion is to sit down and plan your new password, write it down on a piece of paper, then read off that as you do the changes.....I also keep a text copy on my Mobile....just in case.....

Since I did this, all spoof mails have ceased, including some purporting to come from PayPal, asking me to check up my account details......sometimes two of those a day.....all stopped with a strong new password for each account.....

8 characters is sooo 10 years ago. 12+ is the minimal standard, with 16 being the minimum for anyone with data they really care about.

I left that up to the yahoo software (or was it my email program? One or the other...) that said my password was as good as it gets for normal things, that is "very strong".....

Please do remember that I am not a NSA or Homeland consultant......not yet anyway......

It has fixed the problems for me completely which says a lot and if it ever becomes compromised again, then its easy to make a longer one.....

BUT if you sincerely believe one or all of these modern conspiracy theories that fly around from time to time, then BIGGER is BETTER!!! Be my guest!

Everyone must decide what is best for him personally......but actually a well thought out 8 character password is enough for normal people....I have no problem if the NSA wants to read my email, they are most welcome.........the FBI and Homeland too if they wish.....

I will let you know IMMEDIATELY if my 64 bit PW gets compromised, but don't hold your breath!!!

I also use a strong 8-character password for stuff I don't care much about. But I am under no delusions about the potential of a privilege escalation attack finding something I DO care much about. Someone could break into one account, find pointers there to another, find something there that's a little more valuable, and repeat until they actually penetrate a valuable place.

Big difference.

I have NOTHING of value to another person in any way "online". Actually most people on this planet would not even understand what I take interest in, but if they do understand it, they are most welcome to have it as well.....nothing in anyway secret, or needing security in any way shape or form....

My only worries, now 100% fixed with the new "strong" 64 bit password, are when people start sending stuff from "me". That could be something illegal like child pornography or similar, which I personally find appalling.....anyway, even if not porn, they are not allowed by me to use my mail system in any manner......

As already mentioned, it is quickly obvious when someone starts doing that......so very easy to change the PW again....

What did someone say, it should be changed every 3 months (90 days) or so, my old PWs lasted far longer than that, several years at least......actually, I remember, I was using a similar/same passwords when I still worked which is over 8 years ago.......thats how effective a good 8 character PW can be when properly planned and not a run of characters from the keyboard, or a name.

The NSA and similar have such huge effective computers that if they want your password for any reason, they probably only need minutes for even a 256 bit version......they of course are not going to tell anyone just how quickly they can crack any or all passwords........are they?

With modern equipment a true spy can sit outside your house, several 100 meters away and see everything you key in and everything you display on your screen(s), recording it for future perusal......that can be done for at least the last 20 years, if not longer (I am not a spy, it may have been kept secret far longer!).....you need a Faraday screen around the house to stop that....

If they could not get it easily, they would go inside the firewall of your mail provider and take as many as they want, whenever they want......the recent SSL loophole may be a product of the NSA or similar in the first place!!! I trust them to do just that, the Chinese too.....to name but a few....

Or do this after putting a secret "Keylogger" on your PC:-

http://www.youtube.com/watch?v=TWUSeGry7bE

If you stay on YouTube and search for hacking a PC, you will see exactly how to do it.....preventing it 100% is to my mind completely impossible......

By the way, people who say that such a password is unbreakable haven't a clue about the NSA and similar.....

If you want a higher level of security, but simple to install PW for your private stuff go here:-

https://www.grc.com/passwords.htm

or here:-

http://stackoverflow.com/questions/5215413/what-length-password-equals-256bits-of-entropy

I hope this assists anyone with "secrets" that they need to hide....the second link will help anyone interested in such things to understand how to make even short but good passwords safer than bad longer ones.....many here simply do not understand that.....

For your information, "entropy" is the secret even with 8 character PWs. The more entropy the better!!!

Another way to help keep your data safe is not to make yourself "attractive" or "interesting" to security or other organisations....or similar. Keep your head down and vet your friends carefully, if you can that is!!.....

Probably best not to have any family or friends at all....safer!

What did someone say, it should be changed every 3 months (90 days) or so, my old PWs lasted far longer than that, several years at least......actually, I remember, I was using a similar/same passwords when I still worked which is over 8 years ago.......thats how effective a good 8 character PW can be when properly planned and not a run of characters from the keyboard, or a name.

I don't do this. The theory is if someone is persistently trying to break your password for lets say a year, the password will change as they try to break your password ruining the effort. I doubt any botnet does this. That is what commits 99% of the cybercrime. A big botnet probably has more computing power than NSA and their resources are more flexible.

There is no reason to believe Chinese funded bot nets are much less capable than NSA for breaking into things. To underestimate China is foolish. It is possible some of the technology to build military grade botnets came from state run programs. It would provide cover for state run programs if there were hoards of highly sophisticated botnets attacking everything. You never share your best technology just stuff you can do better. Hackers have had forums like CR4 since before the internet became graphical. I knew the security team for Amtrack back then. They were also 'registered' hackers belonging to several hacker forums. They shared tips and information.

With modern equipment a true spy can sit outside your house, several 100 meters away and see everything you key in and everything you display on your screen(s), recording it for future perusal......that can be done for at least the last 20 years, if not longer (I am not a spy, it may have been kept secret far longer!).....you need a Faraday screen around the house to stop that....

The prime target of a botnet is to infect your browser. Your browser 'sees' everything unencrypted you send to the web. That information might be analyzed by a specialized routine on your own computer that parses out urls, ID, passwords, credit card info and anything else the bot-master wants. That information is sent over a dark net to a database where that information is stored. The bot-master could be halfway around the world doing something totally un related. Once setup these botnets run themselves. They aquire new zombies and follow the commands of the bot-master.

If they could not get it easily, they would go inside the firewall of your mail provider and take as many as they want, whenever they want......the recent SSL loophole may be a product of the NSA or similar in the first place!!! I trust them to do just that, the Chinese too.....to name but a few....

I think you greatly underestimate the bad guys and overestimate the good guys. I was almost hired by NSA 1.5 years ago. They were looking for stable reliable types with no security risks. Those people rarely make leaps of incite. Those leaps are done by young, unstable crazy persons. I suspect it is the hackers that fit that profile. While they are rapidly growing in sophistication, the good guys are making their job easier not harder. Web java has moved to a form that can be decompiled. No one wants to allow the user to decide to update their software. The undate utilities have maximum privileges so the user does not need to be bothered by OKing changes that they make. They also have a free passage through all firewalls. Adobe and Apple use updaters that are easily replaced with malware and that botnet has free reign to rule your computer. You can't install most security software without being connected to the internet. They want to make sure you get the latest version. Doing so leaves you wide open to infection before your security is in place. I was getting attacked instantly when I connected a clean computer to my network. Just this month I discovered the culprit. It was my router. I learned routers are often infected so I took countermeasures before adding a clean machine. Sure enough no attack. Had I not had a firewall up and fully configured before I connected to my local network I would never have known I was under attack. I will state the attack was weak and was easily deflected by a good fire wall not one supplied by the OS. A study performed by a university a few years back left clean computers attached to the web installed with sniffers. They wanted to calculate the average time it took an unprotected computer to get infected after being turned on and connected to the internet. The computers were not manned. The average infection rate years ago was 30 minutes. I would bet the time is down to single minutes or even seconds.

I wouldn't use browser to store passwords but I suspect a good utility MIGHT be OK. I just use a text file. It has loads of none password info and the passwords are not well linked to even the User ID and not at all to the url. I have written many data mining routines and they should be super easy to defeat. Without urls, a routine will see the text as uninteresting. I suspect my only weakness is there will be too many words not in the dictionary. Even then, it would take a human to try to figure out what I am doing which is way too much effort. Humans and computers associate information differently. Any important password has no ID as well as no url. I think this is safer storage than even a high priced password safe. Hackers will find the password files and have routines try to crack it. Do you think NSA could crack your file in a month or even a year? I assure you cracking those files will be of high priority since the information is highly valued. Once one is cracked, breaking more will be easier.

I don't care if the Chinese or NSA or what read my emails or look at my pictures.....I know there is little I can do to stop them....but there is nothing on my PC of any interest to anyone but myself.....

I only want to stop my email being used. Nothing more, nothing less......I've done that. I will now see how long it takes them to crack that.......if anyone has the interest......which I doubt!

That is a wise position to take. I intend to not connect my office computer to the web anymore. I do not know when this will happen. I have a few spare computers. I still shop the internet but I try to buy using a phone. I would be surprised if NSA doesn't scan all email. That is way different than reading them. They are looking for key words. They only read emails that most interest them. Unlike recording all phone logs this process locate suspicious stuff. I am all for that as long as they are only targeting terrorists.

I suspect that (and hope!):- a) they scan all email b) Pay particular attention to particular religions and clubs (NRA?)for example....

But not scanning everyone would probably let too many possible criminals through.....I am happy if they scan all, no skin off my nose....

Would Ted Bundy have been caught quicker in 2014? Hopefully, but if he was totally off the internet, I doubt it.....but it might have improved the chances of finding him earlier.....just guessing of course.

My 8 char password for hotmail was hacked a few years ago it is now very long and pure gibberish. The problem is they know your user name if they have your email address so cracking short passwords is quick. 12 seconds for a 6 character password if you are allowed to enter an unlimited number of passwords ASAP. Otherwise, botnets will have 10 million zombies each with a different assigned password will try that against a million email address targets. The trick is to have a password that will take more tries than the botnet has zombies. They could try it a second time with different passwords but they probably do not know if the uncracked addresses are active and the botnet will crack thousands of accounts so why bother? They go after the low hanging fruit.

These are the reasons why no one should use short passwords for a critical account. My password for this account is probably 6-8 characters (whoops).

Mine was 6 2 letters 4 numbers. And they were random. I wish accounts would have a lock. 3 tries within 2 minutes locks it for 25 minutes or so. 6 tries locks it for 2 hrs and sends a text to the phone number of record.

I asked the bank to put a temp hold on my accounts for 36 hrs. They said it couldn't be done, but if any unauthorized charges appeared I wouldn't have to pay for them. Sort of the like the scooter chairs for mobility challenged folks. They're "free" .

The bank will get a letter advising them of my concerns.

If the entropy level of your 6-8 character PW is high, it will take a botnet years to crack.....they will simply give up and/or steal it from your IP supplier.....

http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/

That's a fascinating and chilling read.

8 (or less) character passwords are minimal protection, period. It doesn't matter how clever they are. They will not stop anyone who tries.

For actual security, we need to implement 2- or 3-factor: something you know, something you have, something you are. That's what chip-and-pin is, a card with a chip on it plus your personal identification number. If we added biometrics (fingerprint or retina), then we'd have practical security. NOT unbreakable, but difficult enough that it would only be used for high-value targets.

I don't know what you have or use to store your user names and passwords.....

I did get a app to do it about 2 years ago....... and none too soon, otherwise, I would have a hard time of it, if I didn't.

I would verify that the emails were not sent by your account by checking if they are in your sent folder. If they are not there that is super good news for you. You have no hard evidence that your computer or your AOL account have been hacked.

I would not take a chance. Change all the passwords for any account that you saved your passwords. You were supposed to do this for Heartbleed anyway. I haven't changed mine either. DO NOT keep yourself logged in anymore. If your computer is compromised, these files are the top priority for any attack. The information contains the url for the web site, your user ID and password. I bet most if not all of the recent data breaches started with copying these files that only take a few mili seconds to copy back to the 'mother ship'.

Never save passwords!

This incident finally made the news! You were not hacked at all. AOL was hacked 2% of their users had your problems.

http://www.upi.com/Business_News/2014/04/28/AOL-looks-into-data-breach-says-user-data-compromised/6471398712294/?utm_source=govdelivery

According to German Police, its not just AOL that is/was affected. They recommend that EVERYONE changes their PW.

There is a German website that allows you to check if you have a compromised account or not, but most of you don't speak German....... Plus I cannot even say if it works for non German accounts either.....so just change your PW....

I think the Germans are worried about Heatbleed which allowed Hackers to listen in to the 'secure' log in sessions. The AOL was a data breach that AOL has no clue about other than massive amounts of spam were produced and the 'senders' were spoofed AOL addresses.

The disturbing part of this is Heartbleed was out for years before anyone caught on only because the hackers finally started using the passwords. AOL and even the investigators are clueless as to what happened. The Hackers are too proficient while the defenders look like Keystone Cops. Only 9% of ALL data breaches are discovered internally. Most are found after the stolen goods are being used and the source is traced.

Another vulnerability disclosed this week mentioned an exploit I suspected years ago. IE had a vulnerability going back many years and versions. Years ago something disabled all the browsers on my computer except IE and that was a vulnerable version. I formatted my C: and started over. The deal is the bad guys are far more competent than the good guys and can use vulnerabilities for years before they are fixed.

Sad but true...

The deal is the bad guys are far more competent than the good guys and can use vulnerabilities for years before they are fixed.

Partially true. Most of the bad guys couldn't write what they're attacking. They don't have the skill set. Some of them are very very clever, no doubt.

The essential problem is the lack of software quality. "We" have been so eager to get everything on line and to make or save a buck that "we" haven't taken the time - paid the programmers, extended the schedule, set the priority - to make sure the software is perfect.

Put perfect in quotes. Any software worth running is quite complex, usually literally incomprehensibly so. One of the first lessons I was taught was that there's no such thing as a perfect program, at least mathematically/logically.

(They never looked at MY code, of course. )

I don't know if, when or how we'll learn that lesson.

I have been a computer programmer for over 25 years. I do not expect perfect code. Even though imperfect code is the real problem, it isn't a realistic solution. I understand, the good guys are trying to build a fortress no one can breach while a hacker just needs to find one way in.

The deal is the bad guys are far more competent than the good guys and can use vulnerabilities for years before they are fixed.

Well, it only takes one smart guy to find a vulnerability. This is only a tiny part of the problem I see.

I am not sure what you meant by Most of the bad guys couldn't write what they're attacking. Do you mean they couldn't write the whole module or couldn't fix a bug in the module. Large modules are written by a team not usually by one person. I have 'known' a few hackers from a variety of places. I can assure you they were all superior programmers and likely team leads in their day job. Mind you these were old school, when hackers wrote their own code. I figure there are way too many smart technical hackers out there. I think they share information at least as readily as the good guys. I believe the good guys are greatly hampered by the 'suits'. I believe the hackers are a younger, more creative and less careful than the good guys. Taking risks allows some of them to go far while getting others caught.

What angers me is the attitude and stupidity of the good guys. I leave programmers out of this. I see them as part of the solution not part of the problem. I haven't talked to a stupid programmer since before 2000. They are all long gone.

I expect security 'experts' to keep moderately current with security events. A few year back, hackers were brute force hacking into Wordpress sites. I was aware of this and went to upgrade the security for my site since it was vulnerable. It was taken over. I talked with the web host security. They claimed didn't know anything about these hacks and didn't have a clue as to my concerns. A week later they still didn't. The Wordpress attacks were newsworthy enough to make Forbs on line. They either were ignorant fools or took me for one so I canceled my service with them.

My bigger peeve is the good guys prefer to keep the public in the dark so we will not panic. 5+ years ago I had a local hacker break into my wireless network. We had a tug of war with my wireless network for over a year. I would boot him out and upgrade my security. Some upgrades kept him out for months. The hacker had to be young and had something to prove. Had he been sneeky, I probably would have never noticed. When he 'came back' he changed the router login credentials and used up enough bandwidth that we couldn't browse the internet. Since I cut and pasted the credentials from note pad then print them out and taped them to the router, I can be sure I didn't forget the password. At the end, he broke the highest security and longest and most complex ID and password the router would allow in a few hrs. 32 char ID and 64 char password. Upper and lowercase alphas some numbers and special characters. I went wired and put an end to that. I wonder how long the hacker continued to try to find my signal? I had been experimenting with making the antenna directional just before I went wired.

Knowing the security wasn't brute force hacked I searched the web to discover what he did to get in. I discovered a discussion about a new wireless security 'hole 87' or something close to 87 was brought up at a conference a few years before. I googled the security hole and got only a very few hits. One was a very tech article. As I understood and remembered the article, if a device can fake a dropped connection, the router will reestablish the connection without requiring any security validation. To gather all the required information you may have had to be connected to the network before and you spoof a MAC address of a device on the network. The hole was not considered urgent and was considered very difficult to prevent. I tried to find the information a second time to send a link to someone a few years later. I couldn't find it. That information was removed from the web. If you don't want to fix a problem just keep the public in the dark. This year Cisco updated router firmware with several security patches. One was to make the routers harder to infect with the Moon malware the other sounded like a fix for that hole. It took them close to 10 years to fix that terrible hole!!!!

McAfee let leak this year that they do not act on all the malware discovered because they are overloaded dealing with the destructive malware. The others pretend they are handling all of the new malware with no problem. I don't believe it.

I think the white hats as a whole, are not very motivated and appear to be too weary to meet new threats head on.

We have software companies not trusting you with updating your own software so the user is forced to use a software updater. These fall prey to hackers who compromise and probably replace the updated with malware that has security level 0 privileges and a firewall pass.

Security companies will not allow you to install their software without being connected to the web. How can security companies be so short sighted?

Java has gone to a version that can be decompiled. How can they be so short sighted?

Only 9% of the data breaches are discovered by the data owners. Most shouldn't have kept the personal information that was breached. Lets take Target, they really only needed to keep the transaction IDs for any transactions. That info is worthless to a hacker but represents the transaction. The CC company only needs that transaction ID They didn't need to maintain a file on the CC info. If they chose to keep this unnecessary information why wasn't it encrypted? I would have been good with a self purgied 30 day storage of encrypted CC info. Unfortunately, those highly paid decision makers were clueless and probably weren't fired as I think they should have been. I have no patience for highly paid stupid pigs!

Hackers don't need to be so smart when they are up against fools like these!

Maybe you can see why I am frustrated.

The recent Target hack was done by a sophisticated actor who used every trick in the book to steal the data. They found a side door using phishing, elevated their privileges and loaded a trojan on the point-of-sale system that read the credit card data. You have to start with unencrypted data before you can encrypt it. Target was not negligent, at least compared to current practices.

Target's main mistake was not segregating their various networks. This security practice will greatly inhibited some enterprise activities. They were also running POS equipment using Windows XP.

Heartbleed... based on what I've learned of it (I've looked at a small part of the code in question), I'm not totally convinced it's a bug. It does represent a vulnerability however.

Apple's GOTO FAIL bug? Gross negligence. They deserve to spend a lot of money upgrading iOS versions they wanted to leave unsupported for that one.

We have different reads on Target. I thought it the data did not come from POS as originally thought. The CC info taken was not just current sales information it was the CC info of anyone that ever bought something from Target with a card. I got this information from a CC processing professional that thought the team should have been fired. If what you say is true I can't fault them. I don't want to invest my time researching that now. I know they ignored the security warning when the trojan was installed but supposedly they get about 100 such warnings every day. They are likely over worked and underpaid like most of us. If they only received 25 warnings a day I would find an issue with that over site.

I have removed all Apple and Adobe software off my computers. I completely concur with your Apple software assessment.

I don't know if my take about Target is the true one. I only read it in the news, though tech news is still more credible than political/military/world affairs. At least that's my impression. Reporting with that kind of specificity feels pretty thorough.

OTOH, you would expect a marketing/branding department to work with IT to fake exactly this kind of look-not-so-bad story in order to help preserve the brand. And then slow-walk and bury the real story.

please install MICROSOFT SECURITY ESSENTIAL in your computer and run it at custom scan.

I have heard that MSE is not as good as it once was. Also of problems with Mcafee and Norton, which are often recommended (free advertising?). I am using a paid version of AVG.

Here's a really good article (about a 20-minute read) that summarizes the current state of computer and network security. You think encryption will protect you? Are smart cards and PINs the solution? There are strengths and weaknesses all around.

Security-vendor Snake Oil: 7 Promises That Don't Deliver

http://www.infoworld.com/print/242138

For once, I read something by an author more pessimistic than I. I don't think firewalls are worthless. I find a good personal firewall with proper settings to stop a great deal of attacks. High end expensive routers for corporations are even better. There is a large sector of malware that propagates by attacking random IP addresses. My guess is the attacks are within a range and not random. I heard last week from a fairly reliable source that an average IP address will get pinged once every 2 seconds.

On my own security front, I moved to FIOS because of the deal they offered. I was reluctant because I really didn't like the router/modem I am forced to use. It is not secure. It has not provided security updates to protect against thing bot malware as most router companies have released. I have only used routers that either have a physical switch to turn off the WIFI or don't have WIFI. My wireless network has been hacked before. Anyway I turned off the WIHI and remote access at the router console then backed up the configuration and down loaded the BIOS and stored them off the network. 2 weeks later the wireless is up and running. I will look into it this weekend. I fully expect the router has been hacked and there will be no way to keep them out.

I think the proper analogy is pest extermination. The pests are all around, including on the other side of the world. The Internet allows those remote pests to assault your house.

Good hygiene will help. Bug killer will help. Well-sealed doors and windows will help. There are environmental defenses that will help. Not being stupid will help. But the pests might still get in your house.

That's why telephony takes precedence over email for collaborative business use.

An experiment on a personal email account recorded 562 incoming emails during January 2020. The useful ones could be counted on the fingers of one hand, not including the thumb.

"Did you get my e-mail?" - "The biggest problem in communication is the illusion that it has taken place" - George Bernard Shaw, 1856

PWS: Another aspect of your first line is that email gets the discussion in black and white--no memory necessary. Granted that the telephone will permit easier give & take, but B&W is best for me due partly to my poor memory.