The Cost of Hacking.

I'm sick and tired of people saying 'there's nothing on my system worth hacking, security's just not worth it'.

I'm a computer technician and have heard this far too many times. AT LEAST twice a month someone comes in with a virus (acctually this happens very often) on their comp, or a computer that's been hacked.
The customer only found out when the attacker was done playing with the backdoors and remote control utilities and decided to start messing with stuff... Then the poor unsuspecting customer is left to deal with the likely $100+ bill for the repair of thier OS and restoration of their data, if that's even possible.
Statistically this may not be too bad, but when you add the inevitable weeks of random problems leading up to the discovery and the absolute loss of privacy that's occured, I'd say investing a little in security sound quite reasonable, if not neccessary.

I only service systems in one small city so I can imagine what the demographic of 'household' hacks must be internationally, and how mutch money is lost pointlessly.

Any opinions on this subject? or is this what we're all here about? :D
I'm just ranting from my frustration with ignorance. I'm sure you all understand...

Security is Security, whether it's a credit card account or a chicks name.....some level of security is a valid concern for everyone. For the people that are aware of this and don't think it's worth it, they deserve what they get, yes?

much .... much n much

Perhaps your right... ugh... :D

Love your sig by the way! :thumbsup:

the enigma of eXterNaLity has elluded me today :/

its mainly about the demographical stature of "hackers" thats the issue. Professional hackers will NEVER bother to do small time attacks. however we have the usual wanna bee hackers who are usually kids using scripts and trojans to do their so called "hacking", our so called "script kiddies" are the ones that does all those small-time security busts.

I agree with you UpperCell. People need to take their computer security more seriously. Even if all they have is internet access and nothing more, that internet access account is worth protecting, to not be held liable for any damages a malicious user could/would do.


PuRe

I totally agree with you uppercell. A lot of people claim that they have nothing worth protecting but what about their e-mail? Sure, some people may not send their credit card codes or something like that with mail but they may send a mail to a friend saying that they will be away for the weekend. If the wrong person reads this he knows that the house will be empty for a few days which will give him plenty of time to break in and steal what he want without risking that someone walks in on him.
Someone might keep some important files from work on his/hers home pc and maybe, just maybe, that information can be sold to another company in the same line of work rendering the first company a great loss of income.
And, let’s not forget those private pics of the little misses you took the night before... :D

You make a good point about the $'s. If you can explain that to the home users they would probably start defending themselves better. Nobody wants to waste money now do they.
However another point also comes to mind.
Lots of malicious internet user like to create botnets to perform DDoS on major hosts.
With more and more people having a high speed (adsl/cable) connection to the internet this is a primary concern. Also lots of virii keep spreading because of the inequities of home users.
The least home users can do is maintain a firewall and anti-virus software.

Quote:

---

Originally posted here by Wazz
Security is Security, whether it's a credit card account or a chicks name.....some level of security is a valid concern for everyone. For the people that are aware of this and don't think it's worth it, they deserve what they get, yes?

---

Wazz, I'd like to disagree with you on this. No one deserves to be attacked or "hacked". There is a real profit versus cost issue sometimes with security. If it costs $30,000 to protect $5,000 it makes no sense to put on security. That doesn't mean that someone should be attacked because they have a budget to deal with.

Now as to the home user, one of the issues doesn't lie just at the feet of the user but at the feet of OS manufacturers that produce OSes that "appear" secure. Users get complacent and do think it will never happen to them. In addition, users aren't educated on how or why they should protect what they have. The idea of "I don't have anything worth stealing" doesn't address the issue of using them for an attack. It is an unfortunate reality that people don't want to have to do anything for security.

In fact, users want to learn as little as possible about the OS they use and assume it will just work. This, IMHO, is an issue created by OS manufacturers who are attempting to make OSes as easy as possible for users to just setup and connect (RH is a recent example of this). So what does it mean for us as admins, techies, etc? Well, as I tell my students, as long as manufacturers keep making OSes like they do, people will be employed. :D

I dont mean to sound cold hearted UpperCell but look at it as job security. I would be willing to wager that you even have a few repeat customers that you see every few months because they didnt listen last time you fixed their system. I am in a similar situation to you. I dont fix systems profesionaly but i do help freinds and family with their computers. I know its frustrating when you try to explain things to people who wont listen but at the end of the day you can look in the mirror and know that at least you tried.

Yes, it's true. I consider it a rule to releive myself of any lingering thoughts of responsibility once a computer leaves the shop when the customer has been sufficiently warned. When it comes to stupid personal systems, a crackers a cracker, it's actually worse to have one of the script kiddies get in than some experienced person. I would think they'd be more proned to randomly deleting and messing up stuff, caus thats probably all they'd know how to do ;) anyone with any sense would clean up and leave since messing stuff up can't possibly be in thier best intrest.

When I was a Tech I always told my customers that it wasn't what the hacker took form your system, its what he put there. Once you have been compromised your system will be used for warz/kiddy porn/spamm/DDOS, and for the illegal things on the list you will probably be held responsible. Now most of the time the home users never listened to me and would turn off antivirus if they even had on because it would slow down boot time. I honestly didn't mind as I was getting 20% commission on each repair and a virus cleaning/data repair was at least $150

wow I thought I had it bad. I get 25% then the boss takes the rest an goes to indiana to race 150+mph go carts at daytona almost every month.

Not only do peaple make the mistake of thinking that just because something doesn't effect their PC it won't effect someone else. Even worse are peaple who watch alot of movies (hackers) and expect virii to display some kinda GUI.... most of the time you won't see anything unless the author is stupid or has some type of message to 'share with the world'. One of the bigest mistakes I've seen is when peaple think that PCs are specificly 'targeted' & they think "hey my PC doesn't have anything in it" blehhhh..... the truth of the matter is random scans = random targets.

Why become lambs out to slaughter when you could try and deffend your turf?

numbers:
Two years ago, the international information security market reached $16.8 billion and is expected to reach $77.6 billion by 2007.

woua, we've got job for a long time buddies!!!

Quote:

---

Originally posted here by UpperCell
wow I thought I had it bad. I get 25% then the boss takes the rest an goes to indiana to race 150+mph go carts at daytona almost every month.

---

It actualy wasnt bad, I was 18 in school and paid $10 an hr + 20% commishion on billed hours I useualy pulled in $700 a week before taxes

wow, oh man, I don't get anything guaranteed hourly, if I don't get stuff done (i.e. screw the customer out of money) I don't get paid. :(

I only meant people that know what they're doing MsMittens, certainly not the poor people that only use their PC's for checking email and browsing the web here and there. But anyone that knows about security and how to lock down a box and doesn't, should know what they're in for...sorry for any confusion on that.....

Quote:

---

Originally posted here by Wazz
Security is Security, whether it's a credit card account or a chicks name.....some level of security is a valid concern for everyone. For the people that are aware of this and don't think it's worth it, they deserve what they get, yes?

---

Hummmm..... your forgeting that alot of times a admin will take care of other peaples PCs not to mention all the home desktop PCs that entire families use. & also alot of worms/dDoS attacks effect possably hundreds of other peaple along with the end-user who owns the weak box. So for you to just sit back and say you got what you deserved is like walking up to someone who has ran though a building in a car wreak that has possably injured more peaple outside of the car than the peaple inside then someone like you says: you peaple should have seen the car comeing.

So tell me... If some guy has a weak box and it gets turned into a dDoS zombie or is used to launch a worm would you be willing to make comments like that knowing that it could have similair if not worse effect to other peaple?

Only if he has a total disregard for security Amanda, not if he's a victim.

I don't think I understand you amanda... your analogy is kinda wierd. First off, there was an intial preventalbe occurence, whether it was the drivers fault or some drunk guy at the intersection. We have also never mentioned outside damage, we're talking about the owner the 'people in the car'. Changing your current analogy to reflect this would end up more like this:

The people in the car have a massive leak in their brake system and know it, but they decide it's not worth getting it fixed as the cost of a new master cylinder, a few hoses, and a rear brake thing (I'm not an auto mechanic) costs mutch more than a bumper and maybe a side panel (i.e. their underestimating the possible damage). They proceed with life as usuall and their brakes happen to go out right in front of a local mall while their traveling at about 35. Luckily they hit a store with few people and only two people suffer minor injuries.
Suddenly Wazz ( :D ) appears out of nowhere and says "You guys really should have gotten your brakes fixed"

Now, does anybody disagree with him? I don't... You are correct in pointing out the flaw in Wazz's initial views, it's pretty twisted, but you're argument is also flawed.

ParaNoia (hehe) can be a good thing, but you have to know the balance between security and Encasing your computer in cement, it's been talked about before, security is a must these days, but don't go over board...find something that you like and that works, and stick with that, if you feel it isn't enough, get more.

- Noia

Hummmm..... Im sorry. I find car wrecks and burning buildings to be more exciteing sometimes. Errrr... anyways...

My point was if some admin becomes lazy and sees no need in AV/FW and lets the rest of the world suffer due to his lazyness then the real victum is those who take the most damage. I would set some of the blame on the admin for not haveing any AV/FW/brains/ however most of the blame should go to the kiddie for useing the box to launch attacks in the first place. But im not going to sit back and say things like you should have been prepared for just about anything out there but you weren't so you deserved what you get.

Quote:

---

Originally posted here by Amanda
....
I would set some of the blame on the admin for not haveing any AV/FW/brains/ however most of the blame should go to the kiddie for useing the box to launch attacks in the first place. But im not going to sit back and say things like you should have been prepared for just about anything out there but you weren't so you deserved what you get.

---

Unfortunately most of the systems we see DDOS and other zombie processes coming from are home users that don't know the first thing about security (and are usually too afraid of the computer to care). Personally I think the blame lands on these groups in order of magnitude.
1. The broadband ISP (a lot of times these idiots not only don't tell their customers about security programs, they actively discourage the use of firewalls on home machines.)
2. The hardware vendor for not bundling AV and personal firewall programs in the system
3. The script Kiddies
4. The user especially after they drop 100+ on a virus repair and still refuse to secure their system.

Everyone has made some very good points......Ignoring the issue or thinking you are not vulnerable, I still say you are asking for it. People that don't know squat about computers or security, I feel bad for......

There's alot to be said for changing your motor oil, locking the doors at night, etc., etc. (if it gets broke/deleted/dented/scratched/or just opened up, who is to blame?) not I. In reading the posts, there are alot of valid opinions out there, just as there are a lot of solid(ok, sort of), dependable firewalls, most of which are pre-loaded as Trial software with a new OS or Machine. The inability of the masses to stop ignoring the warning signs,like pop-ups or worse, when your files are nuked, do deserve what they get. Shareware to start, save some cash, learn it up, learn some more, then get what your OS will work and love with. Unfortunately, there will always be the 10%'s.
:cool:

"The customer only found out when the attacker was done playing with the backdoors and remote control utilities and decided to start messing with stuff... Then the poor unsuspecting customer is left to deal with the likely $100+ bill for the repair of thier OS and
restoration of their data, if that's even possible."

If the pc was attacking other people or launching serious denial of service
attacks more headaches besides a $100 bill the authorities might visit and
ask serious questions they may take the computer to examine the drive
& the customer has to prove he or she wasn't behind malicious attacks
to his/her ISP security team they could suspend the service while they
investigate & oh yes and what about other victims who were attacked?
if the source was very incompetent with his or her security what's to stop
them from launching a suit to recover at least some of the damages
they suffered if they were mauled? it's like if they can't have the crackers
head they'll be looking for someone to burn at the steak and they'll
get there vengence one way or the other theyre not going to care
if he did it or not.

I know this is a known fact and I know I've said this, but as stated by the Unix System Administrator's Handbook, "Security = 1 / Convenience". People buy computers for convenience. The ability to "surf the net", to "chat with their friends online" with their AOL accounts (not a trash on AOL but because a LOT of packaged machines are peddled with AOL), homework usage for their kids (even though their kid will learn more in five minutes than they ever will), keeping account information (Quicken and the like) which is now so much easier due to software automation (Turbo Tax, etc)...

...

That being said, the real problem lies with the fact that a majority of these people who either think they don't have anything worthwhile on their machine or just simply don't know is the lack of education. Nobody tells them what they should do, they don't want to take classes (my mom for example), they don't have the ability to sit down with it and just screw around with it because their mentality consists of "I'm afraid I'm going to break something". After their workday is over, they simply want to come home, veg, do whatever they want to do with their family, friends, etc....and more than likely, 90+% of the time, that means the computer they store their bank info, tax info, and whatnot on sits in the corner and is last on the list for "Things to do".

If people would sit down and educate themselves for 5 minutes (nobody is SO busy they can't spend 5 minutes educating themselves or others), it would make a world of difference. If people that DO know would spend 5 minutes answering someone's question, clarify an issue, or simply show someone the RIGHT way to do something...man, I can imagine the internet world as a whole new place!

Pass on anything you know, common sense things you would do for your own machine but someone else wouldn't think of, let people scour your brain for knowledge. Because, God knows, they're effectively helpless in the internet age and without proper knowledge of their machines and how to just do simple tasks and maintenance, they're unarmed for these things. I've never withheld any information from someone who asked me something relating to computers and I've seen it get passed around and built upon and betters things are done because of it.

I've seen 10 people walking in a group down a street that had trash on it (this was an exercise). Every person picked up one single item of trash and threw it away. Just by those 10 people doing that, the street looked better. Imagine the possibilities...

After all, it's like letting a car out in traffic. It takes you 10 seconds to do, and chances are, you'll see your good deed being passed along.

Quote:

---

If people would sit down and educate themselves for 5 minutes

---

So true. My entire immediate family knows nothing and doesn't want to know anything(about comp security). If it weren't for my paranoid nature, all their boxes would probably be DDoS zombies or something equally ungroovy. As it is I can name about ten or so people who are above average intelligence and yet, refuse to take the time to learn how to use their OS properly, much less secure their box.

Sorry that was a bit of a rant, in short, I agree with Vorlin.