The new computer scam

[Curt Harms]

I am sure they ARE illegal and effectively blocked in China. So how does letting extortionists use them here help anyone.

There are ways around "The Great Firewall". I suspect it's like a game of 'whack-a-mole'. Those finding those ways around would probably prefer that they were not easily found.

[Scott Shepherd]

Can somebody please give me an example of "dark parts of the Internet?" I'm serious.

An example would be TOR and the .onion domains. Google them. I use TOR but I haven't gone beyond using it as a browser, which I love. I've learned more about who's tracking my activities by using that browser than I ever knew about. There are a lot of sites these days using geotracking in their websites. That's pretty frightening to me, thinking that I'm browsing a site, just looking around, only to find out they are geotracking me and trying to figure out where I live. That's just creepy. I'm looking at funny dog videos and you're geo locating me? Why? For what purpose?

[Phil Thien]

I run no virus software, no malware software or anything like that. I haven't had a virus in 18 years. I spend hours lurking around the dark parts of the Internet (weird hobby of mine) and have been on some shady sites and I have NEVER had ransomware or anything pop up.

Now my question is, what types of sites are YOU going to? Haha

If you don't run any antivirus or malware software, how do you know you haven't been infected?

[Dan Hintz]

If you're purposely going to the dark parts of the internet and you think you don't have anything on your system, I'd guess you're wrong.

I'd tweak this a bit... you're either wrong (about the lack of virii on your system) or your wrong (about going to the dark areas of the internet). Personally, I'd go with choice "you're wrong".

If virii only stayed in the dark corners of the internet, only the dirty birdies would be infected. Even Google gets virii in its ads from time to time, so you could potentially pick one up surfing these very fora...

[Pat Barry]

An example would be TOR and the .onion domains. Google them. I use TOR but I haven't gone beyond using it as a browser, which I love. I've learned more about who's tracking my activities by using that browser than I ever knew about. There are a lot of sites these days using geotracking in their websites. That's pretty frightening to me, thinking that I'm browsing a site, just looking around, only to find out they are geotracking me and trying to figure out where I live. That's just creepy. I'm looking at funny dog videos and you're geo locating me? Why? For what purpose?

I think Sawmill Creek disappeared into a black hole in the internet just a little earlier today

[Mark Nottage]

How would you know that if you aren't running anything? I'd bet you a doughnut that if you installed something and scanned your system, it would find 100's of things. We've run our accounting computer for the last 4 years without protection and the person that uses it doesn't go to any dark or bad sites. It's strictly a work computer. We installed protection about 2 weeks ago, it found about 30 malware items on it.

If you're purposely going to the dark parts of the internet and you think you don't have anything on your system, I'd guess you're wrong.

If you don't run any antivirus or malware software, how do you know you haven't been infected?

I'd tweak this a bit... you're either wrong (about the lack of virii on your system) or your wrong (about going to the dark areas of the internet). Personally, I'd go with choice "you're wrong".

If virii only stayed in the dark corners of the internet, only the dirty birdies would be infected. Even Google gets virii in its ads from time to time, so you could potentially pick one up surfing these very fora...

I meant I'm not running an active scanner on a daily basis. I've definitely ran malwarebytes (and other virus/spyware programs) to show people that I don't have anything. The only thing I run is Adblock on Firefox.

[Curt Harms]

..................................
There are a lot of sites these days using geotracking in their websites. That's pretty frightening to me, thinking that I'm browsing a site, just looking around, only to find out they are geotracking me and trying to figure out where I live. That's just creepy. I'm looking at funny dog videos and you're geo locating me? Why? For what purpose?

How else are advertisers supposed to know where you're located so as as to display doggie related ads relevant to your local area? I have a simple way built into my O.S. to turn off tracking if I choose to. So far I haven't.

[Curt Harms]

I meant I'm not running an active scanner on a daily basis. I've definitely ran malwarebytes (and other virus/spyware programs) to show people that I don't have anything. The only thing I run is Adblock on Firefox.

Have you considered adding noscript to that? Noscript can be a bit of a pain when first installed telling it what to allow and what to block. After a bit it's pretty painless.

[Scott Shepherd]

How else are advertisers supposed to know where you're located so as as to display doggie related ads relevant to your local area? I have a simple way built into my O.S. to turn off tracking if I choose to. So far I haven't.

That would be a good reason to have the code in there, but the one's that caught my attention were sites with no ads on them and nothing to do with needing any location data from me.

It's new in HTML5, isn't it? I don't think this was the case before.

[Duane Meadows]

What software will do that?
How does it help with ransomware? Can't they encrypt it again?
Does it interfere with backups? Several times I have needed a deleted file and found it on a 2 month old backup. Will that still work?

May not keep them from encrypting your drive... but think about it a bit. They have enough access to your machine, to encrypt or decrypt at will. What makes anyone think they don't also have access to your, oh say, passwords, and any other personal data you may have on your machine.

At least it may help the many other issues you may end up with!

Modern encryption should be relatively transparent.

[Andrew Pitonyak]

May not keep them from encrypting your drive... but think about it a bit. They have enough access to your machine, to encrypt or decrypt at will. What makes anyone think they don't also have access to your, oh say, passwords, and any other personal data you may have on your machine.

I expect that they would simply provide you with a decryption key which you can use to decrypt, even if they no longer have access to your machine. In fact, they never needed access to your machine, they simply needed you to run the "bad program" even if you were not connected. It can then encrypt your machine automatically until you enter a key provided by them.

[Curt Harms]

May not keep them from encrypting your drive... but think about it a bit. They have enough access to your machine, to encrypt or decrypt at will. What makes anyone think they don't also have access to your, oh say, passwords, and any other personal data you may have on your machine.

At least it may help the many other issues you may end up with!

Modern encryption should be relatively transparent.

This makes me wonder about one of the potential downsides to encrypting a disk. If the login password is changed without the account owner's permission or were corrupted, wouldn't the effect would be about like cryptolocker - the contents of the disk are inaccessable? It's possible for an administrator to reset a forgotten or corrupted user password. Will that also decrypt the encrypted disk, or is the original password required? I don't know. If it were possible to reset the account password and unlock the disk, that seems like it'd reduces the benefit of protecting disk contents on a stolen machine for example. It's easy enough to crack or reset admin passwords.

[Andrew Pitonyak]

This makes me wonder about one of the potential downsides to encrypting a disk. If the login password is changed without the account owner's permission or were corrupted, wouldn't the effect would be about like cryptolocker - the contents of the disk are inaccessable? It's possible for an administrator to reset a forgotten or corrupted user password. Will that also decrypt the encrypted disk, or is the original password required? I don't know. If it were possible to reset the account password and unlock the disk, that seems like it'd reduces the benefit of protecting disk contents on a stolen machine for example. It's easy enough to crack or reset admin passwords.

I think that the primary reason for encrypting a drive is to protect the data at rest. For example, if my drive fails, I don't worry about sending it back for a warranty replacement. If the computer is running, AND if I am using the disk, then the drive is in a state that anyone using the machine can see the data (well at least mostly). I encrypt my USB key, so, if I drop the key, the data is not accessible to others. On the other hand, I must choose my encryption method such that if I visit you and want to pull something, then we can access the USB key.

On the other hand, if the drive fails, it makes it more difficult for me to recover data from the drive.

[Andrew Pitonyak]

Can somebody please give me an example of "dark parts of the Internet?" I'm serious.

I disagree with Mr. Shepherd on his definition of the dark net (well, I kind of do, and he has WAY more experience on this than I).

First, understand that the definition is a bit fuzzy and there is some variance as to what is understood by it. The people that I deal with loosely define it as "IP addresses that are not discoverable by normal means".

http://searchnetworking.techtarget.c...nition/darknet

For example, I stand up a web site with an accessible IP address, and I do not link to it. How do you find it? I am now part of the dark net. It is generally assumed that much that happens on the dark net is shady / illegal; for example, selling drugs, trading illegal pictures, or pirating software.

How do you find these places? Probably in chat rooms and similar, but I have neither the time nor inclination to attempt to figure that out. The place you would find the addresses would be related to what was at the address.

That brings us to what Mr. Shepherd posted. He mentions TOR. TOR provides a means of browsing the internet while hiding your identity. It works mostly, but is slower and there are a bunch of gotchas for which you must be careful.

I am not familiar with the .onion domains (http://en.wikipedia.org/wiki/.onion) but the fact that Mr. Shepherd mentions them is pretty clear proof that he has more familiarity with this than I.

I assume that they use .onion domain because it uses onion routing.... and I need to run...

[Scott Shepherd]

Andrew, I'm no expert on the "dark web" by any means. I do remember when the internet started and Alt sites were the only real internet. I remember logging into remote computers at Rutgers and the things I read, I wish I hadn't ever read.

I don't know about publishing sites using the IP addresses as you mentioned, I just barely know about the .onion sites, only because of my growing interest in what's being gathered when we surf. Apparently the .onion sites, promoted from the TOR project, you can publish anonymous sites, which I would assume is were some things not ready for prime time are posted. I don't know, I haven't ventured into that arena.

I do remember when the internet was free and private. No matter what you did, nothing was tracked. I remember remote logging into a lot of computers in the early days, some, maybe not to legally, but in those days, it was easy to use passwords like anonymous and you could get in. Never did one worry about getting a visit from the FBI. Do that now, and you might end up in prison

TOR, like you said, really isn't anything other than an browser that seeks to protect one's privacy. Where you go from there is the key. There's stuff like silk road, where a LOT of illegal activity goes on, as well as the government shutting it down when they can.

While I don't know a lot about it, I'd say the silk road area is part of the dark internet, along with sites using the techniques you mentioned, as well as the .onion sites. I'm sure there's a lot more, but it's not something I go to or use, so my knowledge is based solely on reading bits and pieces from tech sites over time.