Hacking from a forum

[cbk]

I have a friend (yes, a friend and not myself) who wrote me saying that they were on an Israeli 'christian' forum and that somehow another person sent her an email (from this forum). The letter was basically a "Ha. Ha" type letter and now she can no longer get into much of her email and some have been deleted!

Is this a virus??

What should she do now???

 

[Unimatrix]

Edit

 

[Stryper]

or if he installed a keylogger in her system remotely and is recording every single keystroke she types

 

[jayswife29]

Ok, how would someone know if thats what was going on, or is that highly unlikely?

 

[cbk]

I think it was a web site that WAS NOT CF. Somewhere else. Do you suggest they change passwords??

 

[SirKenin]

This is why some forums don't allow scripting.

You can actually put a script in your post to accomplish exactly this feat.

 

[Unimatrix]

Edit

 

[SirKenin]

Actually, get a software firewall that traps any outgoing communication and evaluates it. That will tell you in a really quick hurry.

 

[Alenci]

My guess is that the person just guessed her password. Although if they did install a keylogger or anything, a firewall will alert you about the outgoing traffic. This isn't too likely though...

 

[Stryper]

keyloggers send files back to the main computer through email or ftp. im not too sure that firewalls catch that because they are programs always being used.

 

[KristiXP]

or if he installed a keylogger in her system remotely and is recording every single keystroke she types

This would be true if he had direct access to her computer, but you can't install keylogger onto someone's computer with out direct access unless you are on a network and have admin access.

 

[Unimatrix]

Edit

 

[SirKenin]

If the programmer has done their job properly, it'll just waltz right over a firewall/router and on the way back take a leak on it, just to take the the miff...It takes them 20 days to counteract what a good rogue programmer can do in 20 minutes.

Hmmm. Any run of the mill firewall can detect unauthorized communication on a port. You can also lock down programs to prevent them from access to the net. Norton Internet Security will notify you of a problem, even if it doesn't know what it is.

 

[Unimatrix]

Edit

 

[SirKenin]

Check this out:

There are six ways Trojans generally capture passwords (numbers are hexadecimal):

1) INTERRUPT 9. This is a hardware interrupt which occurs every time you hit a key. The Trojan waits for an INT 9, then interrogates the keyboard to discover which key was pressed, saves the key, then returns normal control.

2) INTERRUPT 16. This is an operating system call which deals with the keyboard. Every time an application program needs a key, it calls this software interrupt. A Trojan piggybacks onto the INT 16 and saves the keys every time the program asks for them.

3) INTERRUPT 21. Similar to INT 16, much more widely known, but less elegant. Once again, a Trojan will piggyback INT 21.

4) INTERRUPT 15. Similar to INT 16, but called from INT 9. A Trojan will again piggyback to this BIOS function in order to capture passwords.

5) Hardware polling. A quirky and unreliable method, one which NetSafe authors have not encountered in any available Trojan yet, but one which the NetSafe product nonetheless counters. This method simply polls the keyboard many times a second, and records any new keys you press as it notices you pressing them. If you type too fast, it will miss some.

6) RAM-buffer snooping. A Trojan can copy the DOS keyboard type-ahead buffer from the system area (also called segment 40 or from the executable-programs memory regularly to disk.

Once the password is captured, the Trojan will usually either save it in RAM, or on a local or network disk (in a hidden file in a hidden directory), or even in CMOS. A purpose-written Trojan can be programmed to download passwords via modem or onto the internet, or broadcast them to some other place for remote retrieval.

I wonder how old that information is? lol

 

[SirKenin]

Companies like Mcaffee claim to be able to stop the piggybacker in it's tracks. I guess an unbiased source would help.

 

[Unimatrix]

Edit

 

[SirKenin]

hrm...well, it is possible, but I can't help but think that it would restrict the system in a big way...?

True. A valid consideration, I think

 

[jayswife29]

Yes, I can get into my account, but some weird things show up in my mail now, alot of Anti-christian and Anti-Israeli trash. I lost all the mail that I had at the time I opened this "mail" from a palestinian claiming he hacked into my site. No it wasnt on this forum, another one in Israel. Thanks for all your help,
Jen

 

[Unimatrix]

Edit