5 ms·

I must admit to being suspicious about this. I would consider myself very very careful about password and other security issues because of various human rights

I must admit to being suspicious about this. I would consider myself very very careful about password and other security issues because of various human rights projects I work on, yet on 16th March at very unusual but clever time for attempting such a thing against me (at the time I would have tried this, if I was targeting me and collected relevant pre-attack information) someone from the UK used my exact and recently changed password to login to my email service - traced back to a very unusual location for attempting such a thing. Luckily the service I use for low-level mail security noticed this strange login and blocked it. It has puzzled me quite a bit as nothing like this has (knowingly occurred to me before) and I take a lot of precautions (which for obviously reasons I'm not going to go into) against keyloggers, malware, MITM, etc etc. With such target hardening I was very suspicious of how it occurred. Ofcourse maybe I was sleep talking my passwords again :)

yarou 13y ago
A similar thing happened to me. Someone was repeatedly trying to access a gmail account of mine, which is strange because that account had not been active for over 5 years. They supplied the correct credentials every time, and the IP originated from some small village in China. I had also recently changed my password, so I don't think it was merely a coincidence. It is possible that I have been keylogged for 10 years without knowing it, but the timing is uncanny. Edit: Keylogged for the past 10 years without knowing it, across 5 different machines, with different architectures and operating systems. :-)
- secfirstmd 13y ago
  Interesting... If you don't mind me asking the question I always ask people when helping with their security (both cyber and physical) and eliminating an element of potential paranoia: Would your work/life make you a worthwhile legitimate target? (don't mean to sound rude but I guess it differentiates between random attacks and targeted ones)
  - dobbsbob 13y ago
    How do you even know what a legit target is anymore after Snowden dropping docs they spied on charities and Jr sys admins.
    - secfirstmd 13y ago
      Valid point. I guess what I meant by legitimate target was "do something they want to specifically know about enough to relatively targeted attack" (ie: analyst wants to know something) as opposed to everyone else who they just want to scoop us as much data about but is currently of less interest.
      - dobbsbob 13y ago
        I would say after watching this almost everybody could be a target of state interest from VCs to a janitor with a cellphone who works at a network they want into http://youtu.be/3jQoAYRKqhg http://youtu.be/3jQoAYRKqhg (FosDem2014 presention) and especially if you have any kind of trust in an open source community and your patches are accepted blindly. Personally if I were an evil intel agency I'd be going after GPU developers and manufacturers at all costs to get at their firmware sources or even possibly find ways to sabotage it at the source. It's the final frontier of awesome evilware potential. - the execution of GPU code, and transfer of data between device and host do not require admin privs so it will always run regardless of what the host system privilege settings are. - Malware w/Nvidia GPUs can be statically linked with the CUDA library in a standalone hidden file that never touches the operating system. - GPU memory is not shared with the CPU so encrypted malware can reside there undetected. - Run-time polymorphism: malware GPU code can be re-encrypted with a new random key thus mutate in completely random ways that would be difficult to detect even if you dumped the GPU memory on a regular basis. - GPU NSA code can easily access the screen framebuffer, and broadcast a live link of whatever somebody is doing. - GPU NSA code present the user with a nothing is wrong desktop pretending the virus scanner is still running, hiding daemons, presenting false browser screens hiding the fact SSL certs have been rejected, all sorts of evil.
  - carrotleads 13y ago
- fivethirty 13y ago
  If you don't mind, when did this happen? Almost the exact same thing happened to me around the beginning of this year.
  - secfirstmd 13y ago
    16th March
    - deleted 13y ago
      [deleted]
- jessaustin 13y ago
  Does this mean they had your password, but didn't have access to your Authenticator? So gmail tells you when this happens?
  - secfirstmd 13y ago
    Yes I presume so.
- rjbwork 13y ago
  I Had a yahoo account I haven't touched in YEARS hacked a couple of months ago. Very suspicious.
atmosx 13y ago
<OT> Out of curiosity, since you consider yourself a possible target for security agencies, do that affect your choice of OS? Do you use commercial operating systems like Windows and Mac or just open source software? </OT>
- secfirstmd 13y ago
  Well this could end up being a whole essay... I would say that generally it depends on the threat model and risk versus potential adversary (some African states would be different to China in capabilities etc). I think also a big part is really internalising and enforcing the idea that you will be breached at some point and acting accordingly, to minimise the data lose and be able to recover. So for example, if your only doing low risk stuff then the convenience of something like Windows/Mac and normal email service outweighs any risks from a breach (as long as you know how to access risk correctly and take the sensible/basic precautions). However for higher risk stuff then generally open-source solutions can potentially offer more security (too many to mention but tons of good ones here - Tails, TOR etc: https://prism-break.org/‎ https://prism-break.org/‎). I would caveat though that I am not someone who always drink the open-source koolaid all of the time. I think the recent Heartbleed and suspicions about TrueCrypt goes to show that occasionally we are make assumptions about the security of these tools based on a false sense of security. Proper security is a longer process of peer review, code audits etc that everyone kind of just takes for granted are done with open-source projects. Sometimes I think it's a little bit like the "free rider" problem, were everyone (including so many in relation to OpenSSL) is happy to use the tool but don't want to spend time/money/brainpower looking, adding, reviewing the underlying code. Then we get a lot of myths emerging (TrueCrypt is very safe for example - that might be the case but has it really been audited yet? Also, who is doing the auditing? etc). Obviously the fact that open source stuff is free and the code can be looked at and eventually fixed is a very good thing. Also, usability is a security feature and I think some of the secure open-source alternatives have problems in this area - though the work of the Guardian Project, Whisper Systems etc is doing a great job of fixing this aspect of things. Apologies if I got a bit sidetracked on this answer. If there is more specific advice you want, drop me a mail to the email (low risk stuff only) in my profile.
deleted 13y ago
[deleted]

yarou 13y ago

A similar thing happened to me. Someone was repeatedly trying to access a gmail account of mine, which is strange because that account had not been active for over 5 years. They supplied the correct credentials every time, and the IP originated from some small village in China. I had also recently changed my password, so I don't think it was merely a coincidence. It is possible that I have been keylogged for 10 years without knowing it, but the timing is uncanny. Edit: Keylogged for the past 10 years without knowing it, across 5 different machines, with different architectures and operating systems. :-)

secfirstmd 13y ago
Interesting... If you don't mind me asking the question I always ask people when helping with their security (both cyber and physical) and eliminating an element of potential paranoia: Would your work/life make you a worthwhile legitimate target? (don't mean to sound rude but I guess it differentiates between random attacks and targeted ones)
- dobbsbob 13y ago
  How do you even know what a legit target is anymore after Snowden dropping docs they spied on charities and Jr sys admins.
  - secfirstmd 13y ago
    Valid point. I guess what I meant by legitimate target was "do something they want to specifically know about enough to relatively targeted attack" (ie: analyst wants to know something) as opposed to everyone else who they just want to scoop us as much data about but is currently of less interest.
    - dobbsbob 13y ago
      I would say after watching this almost everybody could be a target of state interest from VCs to a janitor with a cellphone who works at a network they want into http://youtu.be/3jQoAYRKqhg http://youtu.be/3jQoAYRKqhg (FosDem2014 presention) and especially if you have any kind of trust in an open source community and your patches are accepted blindly. Personally if I were an evil intel agency I'd be going after GPU developers and manufacturers at all costs to get at their firmware sources or even possibly find ways to sabotage it at the source. It's the final frontier of awesome evilware potential. - the execution of GPU code, and transfer of data between device and host do not require admin privs so it will always run regardless of what the host system privilege settings are. - Malware w/Nvidia GPUs can be statically linked with the CUDA library in a standalone hidden file that never touches the operating system. - GPU memory is not shared with the CPU so encrypted malware can reside there undetected. - Run-time polymorphism: malware GPU code can be re-encrypted with a new random key thus mutate in completely random ways that would be difficult to detect even if you dumped the GPU memory on a regular basis. - GPU NSA code can easily access the screen framebuffer, and broadcast a live link of whatever somebody is doing. - GPU NSA code present the user with a nothing is wrong desktop pretending the virus scanner is still running, hiding daemons, presenting false browser screens hiding the fact SSL certs have been rejected, all sorts of evil.
- carrotleads 13y ago
fivethirty 13y ago
If you don't mind, when did this happen? Almost the exact same thing happened to me around the beginning of this year.
- secfirstmd 13y ago
  16th March
  - deleted 13y ago
    [deleted]
jessaustin 13y ago
Does this mean they had your password, but didn't have access to your Authenticator? So gmail tells you when this happens?
- secfirstmd 13y ago
  Yes I presume so.
rjbwork 13y ago
I Had a yahoo account I haven't touched in YEARS hacked a couple of months ago. Very suspicious.

atmosx 13y ago

<OT> Out of curiosity, since you consider yourself a possible target for security agencies, do that affect your choice of OS? Do you use commercial operating systems like Windows and Mac or just open source software? </OT>

secfirstmd 13y ago
Well this could end up being a whole essay... I would say that generally it depends on the threat model and risk versus potential adversary (some African states would be different to China in capabilities etc). I think also a big part is really internalising and enforcing the idea that you will be breached at some point and acting accordingly, to minimise the data lose and be able to recover. So for example, if your only doing low risk stuff then the convenience of something like Windows/Mac and normal email service outweighs any risks from a breach (as long as you know how to access risk correctly and take the sensible/basic precautions). However for higher risk stuff then generally open-source solutions can potentially offer more security (too many to mention but tons of good ones here - Tails, TOR etc: https://prism-break.org/‎ https://prism-break.org/‎). I would caveat though that I am not someone who always drink the open-source koolaid all of the time. I think the recent Heartbleed and suspicions about TrueCrypt goes to show that occasionally we are make assumptions about the security of these tools based on a false sense of security. Proper security is a longer process of peer review, code audits etc that everyone kind of just takes for granted are done with open-source projects. Sometimes I think it's a little bit like the "free rider" problem, were everyone (including so many in relation to OpenSSL) is happy to use the tool but don't want to spend time/money/brainpower looking, adding, reviewing the underlying code. Then we get a lot of myths emerging (TrueCrypt is very safe for example - that might be the case but has it really been audited yet? Also, who is doing the auditing? etc). Obviously the fact that open source stuff is free and the code can be looked at and eventually fixed is a very good thing. Also, usability is a security feature and I think some of the secure open-source alternatives have problems in this area - though the work of the Guardian Project, Whisper Systems etc is doing a great job of fixing this aspect of things. Apologies if I got a bit sidetracked on this answer. If there is more specific advice you want, drop me a mail to the email (low risk stuff only) in my profile.

deleted 13y ago

[deleted]