How can you tell if someone hacked into your computer from the net?

[Phil Thien]

So, I still can't come up with anything other than some sort of password stealing malware (browser based?) on my system or Discover themselves being hacked. I use Chrome as my browser, if that gives anyone any ideas. After this came up yesterday, I cleared all the browser data, (although I never have it save important passwords)

Other thoughts? Other anti-malware to run?

Thanks -

Ken

Those would be my guesses, too. One more to add is that you used someone else's computer to access your E-Mail and THAT computer was already compromised.

Any malware worth its weight will attempt to enumerate any saved passwords and transmit that to a server somewhere, before you even realize you're infected.

That is why I tell people to never save passwords. When an E-Mail app or browser asks if you want to save a password, answer "nope."

[Dan Hintz]

Typically when you go to buy something online they want you to set up an account. You need to give them your email, a password and then you use your credit card to buy something. If that site gets hacked or isn't fully legit, and you used the same password as your CC account then you just gave a hacker all the information they needed to access your CC account.

This is where I was headed. People don't realize they hand out all of the info needed... there's a reason it's suggested you use multiple accounts for different things.

[Phil Thien]

This is where I was headed. People don't realize they hand out all of the info needed... there's a reason it's suggested you use multiple accounts for different things.

But websites aren't typically saving the password, they've saving a hashed representation of the password. You can't get the password from what they're keeping in their database.

[Ken Platt]

Thanks for the ideas folks.

So far as I am aware, this site's password was not saved in my browser. I do not let the browser save passwords for important sites, for this exact reason.

And, this password wasn't used anywhere else. It wasn't a terribly strong one, though, just a name and 3 digits. You can be sure all my new passwords are much stronger.

How is bot able to figure out a password? Are they somehow able to get the number of digits and just keep trying combinations? I'd think most login software would lock you out after a few attempts.

Ken

[Dan Hintz]

But websites aren't typically saving the password, they've saving a hashed representation of the password. You can't get the password from what they're keeping in their database.

If the website is following proper procedure... but how many high-profile sites have we seen that don't? Of course, just when I need them, names of sites escape me at the moment... but wasn't Tumblr one, or Instagram, etc. There was a pay site in the last year or so, but that one escapes me, too... something about passwords being stored in unencrypted form.

Nutshell, plenty of sites don't follow the rules when it comes to your ID safety.

[Phil Thien]

If the website is following proper procedure... but how many high-profile sites have we seen that don't? Of course, just when I need them, names of sites escape me at the moment... but wasn't Tumblr one, or Instagram, etc. There was a pay site in the last year or so, but that one escapes me, too... something about passwords being stored in unencrypted form.

Nutshell, plenty of sites don't follow the rules when it comes to your ID safety.

Right, that is why I said "typically." I just did some googling and I can't find any major sites, or even sites I recognize on any lists of offenders for storing passwords in clear text.

[Dick Strauss]

I'm sorry to hear about your problem. I have been hit by 2 breaches at the CC companies (Target and HD) in the last few years though no bogus charges ever showed on my statement.

Phil T. is the one to listen to about this because he has quite a bit more expertise and knowledge about the subject than I ever will.

There are quite a few options but here are a few that come to my mind:

1)You could have logged into a bogus CC web site providing all of your info
2) Same CC and password used at multiple places as well as with CC website
3) CC breach
4) Data skimmed off your computer via "Autocompete forms" stored "for your convenience" or the convenience of criminals (to remove in IE go to to the following tabs Tools-->Delete Browsing History-->Forms Data or something similar depending on your version of IE. I check to remove all sources of data (cookies, history,etc) regularly and delete all history after every online transaction. This one might be likely since it seems they intercepted email notifications as well (unless your CC company has the wrong email address on file or it didn't reach your email in a timely fashion).

...

Make sure you have a unique password for each site. A friend also used to give a different middle initial for each online transaction that was the first letter of the company (So he was Joe W Smith for Woodcraft purchases and Joe R Smith for Rockler purchases). That way he could figure out where the data originated if there was a breach.

[Scott Shepherd]

Watch this for about 2 minutes. Then you'll understand the magnitude of it all.

http://map.ipviking.com

[Rich Riddle]

If you visit a hotel, restaurant, or business with free wifi and you log into their service and then go to e-mail or purchase something, the server they use has your log-in information. Another business sent a notification that my credit information was compromised yesterday. It's all to common these days with the military, VA, Home Depot, the list seems endless.

[Dan Hintz]

Watch this for about 2 minutes. Then you'll understand the magnitude of it all.

http://map.ipviking.com

For clarification, Norse is a manufacturer of net-safety products. From that site:

Every second, Norse collects and analyzes live threat intelligence from darknets in hundreds of locations in over 40 countries. The attacks shown are based on a small subset of live flows against the Norse honeypot infrastructure, representing actual worldwide cyber attacks by bad actors.

Note the mention of honeypots. There is no indication of what those honeypots consist of, and they could be as simple as a stock SQL server with no security patches or a website that says "hack me". As such, it should be noted the "attacks" they show on that page are illustrative only and unlikely indicative of what's happening on the "real net" (<nudge> It's much, much worse!). Think of it as a tiny simulation of what's really happening, but don't view it as actual threats.

[Phil Thien]

If you visit a hotel, restaurant, or business with free wifi and you log into their service and then go to e-mail or purchase something, the server they use has your log-in information.

Not really, most of the sensitive stuff is transmitted securely.

[Scott Shepherd]

Note the mention of honeypots. There is no indication of what those honeypots consist of,

That's what got Winnie the Poo in trouble....

[Phil Thien]

Clearly we aren't doing enough to attack China.

[Greg R Bradley]

Norse is trying to find out WHO is attacking so they can add that info to their database. I agree with Dan that is just a sample of the "real net" and the reality is much worse.

My own business Watchguard "firewall" gets a hit from a new attacker every minute or so on each of the three internet connections. The types of hits looks very much like those shown in Norse's representation.

I'm about ready to kill the T-1 and only keep the 2 FIOS connections so I set up a honeypot on the T-1 around the first of the year to see if that made it more of a target. I setup Server 2003 running IIS and SQL 2005. I let the traffic go through the Watchguard so I could see it but without any restrictions. It didn't seem to attract any more hits but it was destroyed pretty quickly. After the third time deleting and reinstalling the VMware VM, I came to the conclusion that it wasn't attracting any more hits than the protected connections.

[Scott Shepherd]

I'm aware that Norse is their own little corner of the internet, but it's pretty amazing statistics they show, as far as the number of blocked attacks, etc.

Like Dan and Greg have said, this is just one company, imagine what the entire system is dealing with. It's mind blowing.