6 ms·

A similar thing happened to me. Someone was repeatedly trying to access a gmail account of mine, which is strange because that account had not been active for o

by yarou 13y ago

A similar thing happened to me. Someone was repeatedly trying to access a gmail account of mine, which is strange because that account had not been active for over 5 years. They supplied the correct credentials every time, and the IP originated from some small village in China. I had also recently changed my password, so I don't think it was merely a coincidence. It is possible that I have been keylogged for 10 years without knowing it, but the timing is uncanny. Edit: Keylogged for the past 10 years without knowing it, across 5 different machines, with different architectures and operating systems. :-)

secfirstmd 13y ago
Interesting... If you don't mind me asking the question I always ask people when helping with their security (both cyber and physical) and eliminating an element of potential paranoia: Would your work/life make you a worthwhile legitimate target? (don't mean to sound rude but I guess it differentiates between random attacks and targeted ones)
- dobbsbob 13y ago
  How do you even know what a legit target is anymore after Snowden dropping docs they spied on charities and Jr sys admins.
  - secfirstmd 13y ago
    Valid point. I guess what I meant by legitimate target was "do something they want to specifically know about enough to relatively targeted attack" (ie: analyst wants to know something) as opposed to everyone else who they just want to scoop us as much data about but is currently of less interest.
    - dobbsbob 13y ago
      I would say after watching this almost everybody could be a target of state interest from VCs to a janitor with a cellphone who works at a network they want into http://youtu.be/3jQoAYRKqhg http://youtu.be/3jQoAYRKqhg (FosDem2014 presention) and especially if you have any kind of trust in an open source community and your patches are accepted blindly. Personally if I were an evil intel agency I'd be going after GPU developers and manufacturers at all costs to get at their firmware sources or even possibly find ways to sabotage it at the source. It's the final frontier of awesome evilware potential. - the execution of GPU code, and transfer of data between device and host do not require admin privs so it will always run regardless of what the host system privilege settings are. - Malware w/Nvidia GPUs can be statically linked with the CUDA library in a standalone hidden file that never touches the operating system. - GPU memory is not shared with the CPU so encrypted malware can reside there undetected. - Run-time polymorphism: malware GPU code can be re-encrypted with a new random key thus mutate in completely random ways that would be difficult to detect even if you dumped the GPU memory on a regular basis. - GPU NSA code can easily access the screen framebuffer, and broadcast a live link of whatever somebody is doing. - GPU NSA code present the user with a nothing is wrong desktop pretending the virus scanner is still running, hiding daemons, presenting false browser screens hiding the fact SSL certs have been rejected, all sorts of evil.
- carrotleads 13y ago
  Are there new forms of "legitimate" target. Like are there algorithms that predict if XYZ could be a legitimate target in 15 yrs and if so, targeting starts now. If you run the agency and you have this technology & its cheap and easy to execute, would you use this or would you wait for a target to become valuable before putting them on a list. I say the above cause there is dearth of imagination which leads people to be very complacent on this topic.
fivethirty 13y ago
If you don't mind, when did this happen? Almost the exact same thing happened to me around the beginning of this year.
- secfirstmd 13y ago
  16th March
  - deleted 13y ago
    [deleted]
jessaustin 13y ago
Does this mean they had your password, but didn't have access to your Authenticator? So gmail tells you when this happens?
- secfirstmd 13y ago
  Yes I presume so.
rjbwork 13y ago
I Had a yahoo account I haven't touched in YEARS hacked a couple of months ago. Very suspicious.

by yarou 13y ago

secfirstmd 13y ago

Interesting... If you don't mind me asking the question I always ask people when helping with their security (both cyber and physical) and eliminating an element of potential paranoia: Would your work/life make you a worthwhile legitimate target? (don't mean to sound rude but I guess it differentiates between random attacks and targeted ones)

dobbsbob 13y ago
How do you even know what a legit target is anymore after Snowden dropping docs they spied on charities and Jr sys admins.
- secfirstmd 13y ago
  Valid point. I guess what I meant by legitimate target was "do something they want to specifically know about enough to relatively targeted attack" (ie: analyst wants to know something) as opposed to everyone else who they just want to scoop us as much data about but is currently of less interest.
  - dobbsbob 13y ago
    I would say after watching this almost everybody could be a target of state interest from VCs to a janitor with a cellphone who works at a network they want into http://youtu.be/3jQoAYRKqhg http://youtu.be/3jQoAYRKqhg (FosDem2014 presention) and especially if you have any kind of trust in an open source community and your patches are accepted blindly. Personally if I were an evil intel agency I'd be going after GPU developers and manufacturers at all costs to get at their firmware sources or even possibly find ways to sabotage it at the source. It's the final frontier of awesome evilware potential. - the execution of GPU code, and transfer of data between device and host do not require admin privs so it will always run regardless of what the host system privilege settings are. - Malware w/Nvidia GPUs can be statically linked with the CUDA library in a standalone hidden file that never touches the operating system. - GPU memory is not shared with the CPU so encrypted malware can reside there undetected. - Run-time polymorphism: malware GPU code can be re-encrypted with a new random key thus mutate in completely random ways that would be difficult to detect even if you dumped the GPU memory on a regular basis. - GPU NSA code can easily access the screen framebuffer, and broadcast a live link of whatever somebody is doing. - GPU NSA code present the user with a nothing is wrong desktop pretending the virus scanner is still running, hiding daemons, presenting false browser screens hiding the fact SSL certs have been rejected, all sorts of evil.
carrotleads 13y ago
Are there new forms of "legitimate" target. Like are there algorithms that predict if XYZ could be a legitimate target in 15 yrs and if so, targeting starts now. If you run the agency and you have this technology & its cheap and easy to execute, would you use this or would you wait for a target to become valuable before putting them on a list. I say the above cause there is dearth of imagination which leads people to be very complacent on this topic.

fivethirty 13y ago

If you don't mind, when did this happen? Almost the exact same thing happened to me around the beginning of this year.

secfirstmd 13y ago
16th March
- deleted 13y ago
  [deleted]

jessaustin 13y ago

Does this mean they had your password, but didn't have access to your Authenticator? So gmail tells you when this happens?

secfirstmd 13y ago
Yes I presume so.

rjbwork 13y ago

I Had a yahoo account I haven't touched in YEARS hacked a couple of months ago. Very suspicious.