Computer hacking

skyraider

Veteran Expediter
US Navy
Where would or how do u find out if someone is hacking into your computer and looking around if u are not aware of it.


Are passwords really hack proof for a professional hacker?

If they can hack into the government weapons sites, a home computer must be very easy.

Anyone got any input on this?
 

Turtle

Administrator
Staff member
Retired Expediter
One way it so check all active connections. Easiest way is to drop to a command line window and run netstat.

netstat -a
netstat -n

are the 2 to try first. It's best to have the browser closed and as few connections as possible going when you do that, otherwise it can be time consuming to go through them all.

netstat -b will display the connections, and each .exe file that created it. That's often the only way to track down which program is creating the connection, if it's a trojan or something.

netstat -? will give you all the parameters:

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]

-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-f Displays Fully Qualified Domain Names (FQDN) for foreign
addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
-t Displays the current connection offload state.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.


A bandwidth monitor can come in handy so you can monitor sudden, unexplained bandwidth usage.


Zone Alarm is a good firewall that secures your system and will actually notify you of any attempts to try and access your computer. It will provide IP address of the attacker, and the nature of their actions. It is the best product for the "average" home user to be protected with. There are more robust firewalls, but they generally require some good knowledge of TCP/IP and NAT.
 

21cExp

Veteran Expediter
That's way too big of a multi-subject topic to be completely addressed here, but I'll throw a few things out there.

Do a simple google search for "how do I find out if my computer has been hacked?" and check the results. You can refine the search by noting what type of computer; PC laptop or MacBook, etc. You'll get a lot of results with responses on message boards more dedicated to computers and related subjects than you're likely to get here on EO. You'll also likely see links to free sites that can scan your computer to see if you have a trojan, a virus, or other bug. If someone other than you has had access to the computer itself, as in using it personally, and you suspect them, they could have done any number of things to mess with you. Things like installing a key logger that will record everything you type and what pages you've gone to, etc. All recorded to a secret file they can access later or that can be surreptitiously emailed to them from your system.

There is also what's called a DOS (Denial of Service) bug that can be installed on your system by visiting certain sites or opening exe files in email. The idea with DOS is that it creates a network of infected computers that can be called upon at will to all simultaneously access a site like Paypal or amazon or a biz site or whoever. When a huge network of computers all try to access the same site at the same time it can overload their servers and shut it down; hence the name Denial of Service. That's my understanding of it, at least. There are sites that can detect if you are infected.

Hacking could be any number of things, from any of the above to someone just figuring out your password and gaining access to an email account.

Why is it you're wondering if you've been hacked in some way? What is your computer doing or what have you noticed is different?

Passwords: Best current wisdom says to have the most hack proof password that resists brute force password hacking software (that can run hundreds of thousands of letter and word combinations in minutes) is to have a minimum of 8 characters in your password and to mix it up between upper and lower case and numbers and symbols.

One article I read recently suggests using a base phrase of two unrelated words that you can then add to depending on where you're going to use it. Something easy for you to remember, like peach gasoline, or pinetree rhubarb, or whatever combo will be something you will remember.
Then change it up enough by always capitalizing certain letters like A, or changing an o to a zero, for example, or an i to an exclamation point. Then between the two words enter the initials of the site you're using, or the name of the email account, etc. with one in caps and one lower case. Then you use the same base phrase wherever you want by changing the site initials.

So your password to the forums here might look something like this:

peAchEogAsol!ne

Then for PayPal, for example it would be: peAchPpgAsol!ne

One other way is to memorize a random combo of letters and numbers as your base phrase, again of at least eight characters, like qsc5lr2md or 3nt247vjS. Then do the same interjecting of site related initials to change your password for each site.

I have a couple base phrases I use; one for personal pages and accounts, one for biz related stuff.

I keep track of passwords in a simple txt file, though like this, if using the examples above:

EO: 3**2Eo**vjS, where the asterisks always hide the same characters. That way if anyone ever sees my password file they cannot figure the password without a huge amount of hassle.

Just never tell anyone your base phrase or phrases. Might seem like a lot of rigmarole to go through, but it is actually easy once you decide on a base phrase combo.

To protect your computer itself from being hacked via the web, it's more difficult for PCs generally than it is for Mac products, as the script kiddies have always liked to target Microsoft products and pc based software more.

Be sure you have good virus protection software and keep it updated with the latest virus definitions. Norton, McAfee are paid subscriptions based on whatever package you get, AVG used to have a quite good free software and may still have. Check the software forums for what the current best is.

To protect your computer from someone getting on it in person, set up users and a password just to turn it on. I don't let anyone use my laptop for anything unless I am sitting right there and they are simply entering a URL or search word, for example. If they need to check their Facebook or email account, etc I make sure they have completely logged out before they quit. I also have Firefox set to delete all history and cookies upon close so if someone should steal my computer they would not be able to gain automatic access to sites I've logged into or even know what pages I've been to, like for banking etc.

Most of it is just good common sense.

Hope that helps. Good luck.
 
Last edited:

skyraider

Veteran Expediter
US Navy
One way it so check all active connections. Easiest way is to drop to a command line window and run netstat.

netstat -a
netstat -n

are the 2 to try first. It's best to have the browser closed and as few connections as possible going when you do that, otherwise it can be time consuming to go through them all.

netstat -b will display the connections, and each .exe file that created it. That's often the only way to track down which program is creating the connection, if it's a trojan or something.

netstat -? will give you all the parameters:

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]

-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-f Displays Fully Qualified Domain Names (FQDN) for foreign
addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
-t Displays the current connection offload state.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.


A bandwidth monitor can come in handy so you can monitor sudden, unexplained bandwidth usage.


Zone Alarm is a good firewall that secures your system and will actually notify you of any attempts to try and access your computer. It will provide IP address of the attacker, and the nature of their actions. It is the best product for the "average" home user to be protected with. There are more robust firewalls, but they generally require some good knowledge of TCP/IP and NAT.

Ok then, you are way above my brain knowledge at the moment, give me a few years.

But it must be good data.
 

Turtle

Administrator
Staff member
Retired Expediter
FWIW, I use Lastpass for passwords. Very secure, generates secure passwords, and it keeps track of them instead of you having to memorize them or use a text file or a notebook for them. Even my technotard step-dad uses it.
 
Top