Suggestion Anyone?

Someone accessed my computer, used it for e-mails, changed files around, general mess. Lost AOL privileges due to heavy e-mail useage. Been told that someone can get in to my full time DSL line use my IP address, password, screen name, etc. to go around pretending their me.

Is this true?

Where can I get some solid reading material or web sites about how someone can do this. I suspect a former employee/relative who was in charge of my office computers did this somehow, but how can I prove this?
I need solid info to bring to my lawyer who knows nothing about computers and believes that no one can hack in and use someone's machine, e-mail accounts, and files.

Any help or direction would be greatly appreciated.

Thanks in advance.

Well, if you are planning on getting this person arrested or sued, then it sounds like installing Antivirus, firewall, HiJack this and a password change isn't a good idea. Obviously, you want to find out what has been done to your computer w/o deleting it all.

You probably want to disconnect the infected box. What operating system are you running?

Whatever logs you still have need to be brought together, maybe another member can help out with that. But if this is going to be usable in court, you might have to hire an expert.

edit: didn't really answer your question...

How someone can do this eh? Well if this person previoulsy had access to your computers, they would install a virus, a type called a backdoor, trojan, or something that would give them access to your box remotely. Popular ones include sub7 and netbus. There was just a segment on techTV on how to do this, so it doesn't take a genius to get this done. From there, the cracker connects to the virus acting like a server with the virus's corresponding client. That client can use the server to take screenshots, control your mouse, log your keystokes(passwords) take your files, place files, cookies(your saved passwords on IE for instance)

http://www.sans.org/rr/papers/index.php?id=103
http://securityresponse.symantec.com...itepapers.html
http://marketwatch-cnet.com.com/2100...3-5087366.html

some extra info

Quote:

---

Been told that someone can get in to my full time DSL line use my IP address, password, screen name, etc. to go around pretending their me.

---

Very true. I like to call it identification theft. Ever heard of John Walters? The host of 'America's Most Wanted' they are always running identification stoppers.

Quote:

---

Where can I get some solid reading material or web sites about how someone can do this.

---

I would just like to say this is a serious crime in the United States of America. Please dont get any idea's out there.

Quote:

---

I suspect a former employee/relative who was in charge of my office computers did this somehow, but how can I prove this?

---

Disgruntled employer I believe it.

Quote:

---

I need solid info to bring to my lawyer who knows nothing about computers and believes that no one can hack in and use someone's machine, e-mail accounts, and files.

---

I highly doubt it. Lawyers know there state statues and there boundaries. There are lawyers who know there stuff when it comes to computers. They are defending the accused party who is accused of commiting computer crimes, stealing personal identification information, trade secrets, porn, Intellectual property (data, programs) etc...
If you can prove this person did this he could face up to 5 different charges from what I see. Everything ranging from computer crimes to Harrassment. Computer Nerd22

Quote:

---

my lawyer who knows nothing about computers and believes that no one can hack in and use someone's machine, e-mail accounts, and files.

---

Suggestion, change lawyer's because this one is obviously not connected.

Edit**** How much money are you going to drop in lawyer fees anyway? You would be better off spending that money on protection for your network and whatnot, I suggest you let your ISP take care of this one.

Quote:

---

Very true. I like to call it identification theft. Ever heard of John Walters? 'America's Most Wanted'

---

John Walsh

Quote:

---

I would just like to say this is a serious crime in the United States of America. Please dont get any idea's out there.

---

And I would like to say, phishy....but thats just me. Great story line and climax, though!

Quote:

---

I suspect a former employee/relative who was in charge of my office computers did this somehow, but how can I prove this?

---

Quote: Trump, employes are stealing from you, you just have to catch them.

As unbelievable as it may seem, my company lawyer is computer clueless. Not online, doesn't e-mail, and her staff uses floppies to save data. She has spoken to an alleged "expert" in this area. His line is 180 degrees opposite of what my available IT people say. The problems caused by whoever did this has gotten so bad, that all efforts to install McAffee (gave up) or Norton (equally frustrating) caused such damage, that three affected machines got to the point that they couldn't even function. An attempted reinstall of OS and our other software did nothing. The machines were so slow that a simple math calculation could be done faster with paper and pen than on the system.

Right now, we're finishing replacing all units affected.

Now, to add insult to injury, the bank contacted me and 1 credit card and my debit card "...have been compromised."

Every where that I turn for info, I get crumbs of "Yes it can be done." I need a loaf of bread. I need to A) make sure this doesn't happen again, and B) be able to show that it could happen and how it happened so that A is avoided.

So, help is appreciated.

Thanks

Read other posts. My teen daughter downloaded Kazaa into my home, and on a visit, office computers. Found literally dozens of songs w/viruses. Could this have been the gateway into our systems? Or did my fired, former computer whiz - the guy with all the screen names, passwords, IP addresses, etc., etc., etc., get in? I found out that the system log on password has been the same for over 10 years. 10 years!!! The people that I bought the company FROM could have even gotten in! Sheesh!

Hi,

If your system password has not been changed for over 10 years, can I have your old equipment?...........I don't have a computer that runs on steam :D

OK serious and I mean serious.............

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

Report to BOTH the FBI and Secret Service.............you have obviously suffered losses in excess of $5000...................that's a Federal one!

Ground your kid.............preferably in a pit of tar.............get a geek to wipe its machine, or you will have the RIAA sniffing up your a$$ and I MEAN $$$$$$$$$$$

Have a happy Easter

And get a specialist lawyer, but try the Feds first? :)

Quote:

---

Read other posts. My teen daughter downloaded Kazaa into my home, and on a visit, office computers. Found literally dozens of songs w/viruses. Could this have been the gateway into our systems?

---

I'd bet dollars to donuts if you found as many viruses on there as you say you did, one of them was a trojan and gave complete access, and could of been visible on a portscan.

Heres your "loaf"
http://www.antionline.com/showthread...=netbus+techtv
http://www.techtv.com/unscrewed/ihat...644472,00.html

Go to the feds

you've been not only using but altering the file system by installing differant AV softwares looking threw files etc. forget about pressing charges on anyone you dont have a leg to stand on. if you wanted to press charges you should have shut the computer down and called a forensics expert right away.

kazaa...you GOT to be kidding me!

if you want to know how this can happen, better details of your network setup are required. like how your network connects to the internet (aol?) do you use a gateway, firewall? were all the service packs and patches applied? how do you get your email? does each machine have its own dial-up connection capability? how is your av configured. there are so many ways something like this can happen that without knowing what were dealing with...where do i start? What your asking is like asking how can someone break into my house…well what kind of a house is it? How is it laid out? What security devices are in place? Etc., Etc. And their are far more ways to break into a computer than into a house.

Mastercard must have had a major compromise. A lot of people at the local bank had to replace their cards. I was told that a third of the account hoders had to change and the compromise wasn't at the bank.

Quote:

---

Originally posted here by masterchief
Lost AOL privileges due to heavy e-mail useage.
I need solid info to bring to my lawyer who knows nothing about computers and believes that no one can hack in and use someone's machine, e-mail accounts, and files.

---

Well if you lost your AOL privies. because of a malicious act. you should start by appealing to AOL. (they suck by the way) They (should) have logs of all actions with regards to your acct.


http://www.emailabuse.com/report.asp

Your Lawyer does not use E-Mail? Where are his offices Mayberry?

Kazaa and a lawyer who still wears a wig in court? Sounds like an ugly situation.


I agree with above posts regarding the amount of info you need to provide, regarding your HW, and systems. You will get much better answers by specifying your Technical situation.

:D

Computers aren't networked. The 3 affected computers all connect thru their own dial-up. The computer that did the most damage, i.e., all the e-mails, file changes, etc., was the computer guy's desktop. All machines had a dual option: AOL or a local ISP and could connect at the user's discretion. All operated Win98, no firewalls, and Norton 2000 with no updates since 2000. The problems began in earnest 7 to 10 days after what looked like an e-mail test takeover of my AOL account (logged on and sent hundreds of e-mails without my knowledge). AOL shut us down, then, restarted us. The day it started, the computer was online for several hours downloading a patch for a business program. It logged off, rebooted, installed the software, and BAM!, off went the e-mails.

Your best bet is to contact the FBI as nihil suggested. They can even point you to a knowledgeable lawyer.

Correct me if I'm wrong on this: 1) With the right info in hand, someone can access your computer; 2) Then, use your computer at will; 3) Change files as desired and wreak havoc; 4) Send e-mails using your accounts; 5) Access any crucial info on your units like financial info; 6) essentially steal your identity and just destroy your life. And in the end, it all looks like you did it, and its up to you to fix it and prove it wasn't you. So, I'm replacing all the Win98 machines with XP Pros w/Norton + firewalls, and from everything I've read, XP has the same if not more flaws.

A simple "Yes" or "No" will suffice: Am I correct about all this?

Thanks loads for all responses and help.

For the most part, yes. Except Win98 != WinXP. WinXP is still actively patched when new flaws are discovered (albeit slowly).

A few tips.

#1 - EDUCATE YOUR USERS - most important factor by far
#2 - Deny All, then allow only the required users/services
#3 - Update, Update, Update. Your Virus/Malware/Adware/etc protection is only as good as your last threat database. New threats are discovered daily.

1. Yes
2. Yes
3. Yes
4. Yes
5. Yes
6. Yes and No (depends, but you didn't want an answer?)

I see from your profile that you are the president of a medical billing company.
I wonder if your lax security procedures constitute HIPAA violations ?
Not what you wanted to hear, but........
:eek4:

If I were you, I would start putting some security measures in place to prevent this type of abuse in the future. I would lock down user accounts and implement complex passwords. Avoid the use of the administrator account. Ensure the AV software is implemented and the signature files are up to date. Learn about the audit logs and the events that are being tracked and above all implement a hardware firewall between your network and the DSL modem.

masterchief, my reply would be NO.

The answer to questions 1-6 is still yes, but question 1 is the key question.
WinXP pro is vastly more secure than Win98 if set up correctly.
In technical terms, it is a completely different operating system.

It has far less flaws than Win98, and more to the point new flaws are fixed, and an updated AV scanner together with a correctly configured firewall will pick up on most other things as well.

For a start with WinXP you can set up 'user accounts' as CT2600 mentioned which have limited privileges, which means you can restrict what the users can do.

If you are using this in a business environment, then maybe you should get a reputable computer consultant to give you the low down on what to do?
Try friends, familly, or other small businesses to get a decent recommendation.
Basic advice shouldn't take more than one or two days :)

Tedob1 is right. If you need help from this thread then we need lots more detail on the topology of the network and how it connects to other systems, such as the Internet. But for you, the first place to start with is the logs. You should have logs on your servers, workstations and, if you have them, network devices such as routers. Start from the outside and work in loooking for suspicious or otherwise out-ot-pattern activity. Starting from the outside and working in should start to give you an idea of where the attacker broke in. From there you can start to narrow the search the first compromised servers/workstations to see what the hacker did. I'm sure many of us on the forum could provide some help in looking at the logs if you provide network topology details and post the logs.

Regards,

Alan Mott

Agree with all other members responses....but I think the horse has already bolted....I really think you need to introduce sweeping changes and examine how your network/computers are used. Also introduce an AUP (Acceptable Use Policy) and make ALL staff sign it....gives you some control and is better than nothing...

Other than that listen to all the senior members...they really know their stuff....

Well, with regards to the legal end of things...

Quote:

---

Originally posted here by nihil
Report to BOTH the FBI and Secret Service.............you have obviously suffered losses in excess of $5000...................that's a Federal one!

---

It might not be fruitful to report to the FBI at this time.

First, try calling the local PD. They can point you in the right direction; I think the Berkshire County District Attorney has a computer forensics unit.

If not, the local PD can put you in contact with the State Police Computer Crime Unit, or the Attorney General's Computer Crime Unit.

Basically, this is not a case that the feds would get involved in.

Thanks to everyone who responded. From reading the posts and material on computer forensics and hacking, not only was this possible, BUT, by moving the computers around and continuing to use them, trying to track down the culprit is a waste of time because it's the equivalent of contaminating a crime scene. The evidence is now considered tainted. Any thoughts?

masterchief,

Yes I would agree with you, as you almost certainly have little real evidence left.
AOL should have something, but that is probably not enough, as it is your responsibility to take adequate measures to protect the PCs that your company owns.

I mean, come off it, allowing Kazaa to be installed on a business PC????
This would be grounds for immediate dismissal at most companies that I provide my services to.

And no firewall or up to date AV scanner running under Win98????
Gross negligence in my view!!

You can prevent this sort of thing happening in the future if you get some outside advice as to how to adequately secure your upgrade to WinXP.

The important thing here is that even if someone has access to a users account, the amount of damage they can do will be limited as long as you keep the details of the administrator account (you should rename it anyway) secret, and only available to those you trust.

I should clarify: the e-mailing was done on both my personal and office computers. It was the personal one that my daughter installed Kazaa on. I ORDERED her not to. However, she did it unknown to me, used it, then made sure that there was no desktop icon, etc. Like most people who aren't computer savvy, I click a desktop icon to go where I want to go. I only found Kazaa when the first virus struck because I looked at the installed programs list and found it.

The first e-mailing occurred from our personal computer when my wife logged on to check e-mails. BANG! Hundreds went out. A week later, this happened again with my office computers which were on, downloading info, and unattended. The reliable staff that follows company policy utilizes a local ISP using a secure data line. The rogue staff uses AOL accounts. It was my daughter logging on through a company computer thru the AOL account looking for an e-mail from her sister that triggered the e-mail/file changing debacle.

It's tough looking for answers as to who did this and why.

As we speak, new Dells are going in with accurate protection. At home, we've replaced the Dell with an iMac.

I've done this because once someone steals who you are using computers, it's tough to recover. And I don't mean financially or hardware or software. My wife and I feel used and violated. Psychologically, the impact of what's happened is immeasureable. It's destroyed our trust in our kids, our employees, and the net.

Thanks.

Well, I'm guessing a bit as to what happened here, but it would seem to me that the most likely sequence of events was as follows.

Firstly, your home PC was seriously compromised, and infected with umpteen viruses because of using Kazaa to download infected files, which, incidentally, is probably illegal anyway!
Better not mention that to the RIAA ......

I would then assume that your daughter managed to infect her sisters PC by sending her something. When she used the same account in your work environment, the virus(es) got transferred back into your business environment, and all hell broke loose.

This should not happen if you have up to date AV protection and a proper firewall.
Even a home PC running WinXP with a software firewall and a professional AV scanner would pick up on unusual email activity, and alert you to the fact that something might be amiss i.e. before AOL picked up on it at their end.
AOL will have been running something similar, which is why your account was suspended, as they detected you were transmitting viruses.

The most important thing to bear in mind is that this is almost certainly not a personal attack on you or your business.
Unfortunately, this sort of thing is becoming very profitable for criminal elements, as a compromised PC can be very valuable.
Compromised or 'hijacked' PCs are used either to send spam (unsolicited emails) or used en mass to try and make a particular web site unusable. There have been several reported cases here of companies being threatend if they don't pay the protection money to stop this happening.

All they do is look for weak points by scanning PCs at random, and in your case it looks like they hit the jackpot.
Really very similar to the way a burglar might wander down a street trying front doors at random to see if they were unlocked.

I would only add that if you do suffer a similar problem in the future, then as you put it 'don't tamper with the evidence' - turn off the offending PC and get the experts in to look at it.

I wouldn't be too hard on your daughter, as I'm sure she didn't know what the consequences might be.
Don't assume that iMacs are immune to viruses - they do exist!!
Much less likely than on a Windows PC though, as their market share is so small.

masterchief,

To clarify, the main point I was trying to make earlier today is that I think you are jumping to conclusions in assuming that any of your employees (past or present) are guilty of doing anything wrong.
Without having physical access to the PCs involved, I obviously can't tell one way or other.

The scenario I outlined is perfectly plausible, and seems to be the best fit with the information that you have provided. At least if your new PCs are adequately protected, then this shouldn't happen again, regardless of the source of the problem. To put it bluntly, it is completely pointless running an AV scanner which is years out of date.

I'd be very wary about looking into any legal action, as it is quite possible that it is you (or rather your daughter) who broke the law in the first place. In the US and most of Europe it is not legal to copy copyright material (i.e. music) which you don't own, by downloading via Kazaa for example.

In the US, the RIAA has successfully issued law suits against those who have done this on a large scale ....

Well, guess what? A new Dell running up to date Norton anti-virus and firewall was compromised and had a bunch of e-mails go thru it that we didn't create.

My feelings for the new iMac are getting better by the day.

Thanks for the input everyone.

Quote:

---

Originally posted here by masterchief
Well, guess what? A new Dell running up to date Norton anti-virus and firewall was compromised and had a bunch of e-mails go thru it that we didn't create.

My feelings for the new iMac are getting better by the day.

Thanks for the input everyone.

---

Oh well, my final comment on this is that what you are saying does not add up at all.
Maybe you were just joking all along?

I'm assuming of course, that you have an up to date version of WinXP pro which has been correctly set up, and that is extremely unlikely.
I would not expect this to happen to any PC that I set up, and would correct it in the unlikely event that it ever took place, as I do some work for small businesses.

Who set up this PC?
Do you have a hardware firewall?
How is WinXP configured?
If you just buy a PC from Dell, that is wide open, unless you invest some effort in securing WinXP.

I could go on for ever, but if you think you are more secure using Macs then carry on down that road.

Ummmmmmmm., if you don't have the time to invest in locking down XP,nor care about all the tweaks then mac is the way for him to go.IMHO

Quote:

---

Originally posted here by !mitationRust
Ummmmmmmm., if you don't have the time to invest in locking down XP,nor care about all the tweaks then mac is the way for him to go.IMHO

---

Another final comment :)

I'd obviously agree with your remarks, but the problem here is that this seems to be a case of virus(es) jumping from a home PC to a small business environment, due to extremely lax procedures in place at the work environment.
Hmm, letting your daughter have unrestricted access to your work environment, when she has already downloaded infected music files ????

And, I'm not even remotely convinced that masterchief has taken any measures to prevent this happening again in his work environment.

To masterchief (assuming your posts are genuine):

Get some expert advice as to what to do ASAP, and yes this will cost you $$$ :D
In the real world, you cannot do this for free in a business situation, if you don't have the appropriate technical background, which I'm sure you don't have!

If you are are really with it, which a lot of people here are, then you can take steps to secure your PCs, but this takes time and experience.

By all means run a Mac at home, but that is missing the point rather ...

For the cost of any machine with Win XP - Pro or Home - there should be some modicum of security especially when you buy additional anti virus and firewall software. My understanding about Mac's security level is not due to the lower number in operation, though that's a given. It has to do with the complicated programming that goes into the system and its programs.

I can't figure this out with the new Dell. The only advantage to the firewall is that I now have the IP address of the user who sent the e-mail.

As for fooling about this, I only wish that I was. Sadly, I am not.

masterchief, OK, yes I believe you are genuine - a lot of other posts are not!

But the problem you have is that you need someone who knows what he/she is doing who you pay $$$s to, to come in and inspect your setup in your work environment.
I'm not touting for business, as I think you would find the travel costs rather prohibitive :D
What you have been saying cannot be correct if you have some competent IT advice, which must include physical access to the PCs involved.

Buying a new PC (either an iMac or a WinXP PC), does not mean they are secure.
Nope, a default WinXP PC as purchased is not even remotely secure.
An iMac is somewhat more so, but that will only last until the hacking/virus community decides that Macs are a worthwhile target.

You will see umpteen threads on this here, like the rest of the net, but I adopt a pragmatic view over this - given that MS has installed its OS software in about 90% of PCs in the entire world, which one would you try to attack ??
Macs, *nix, no not worth it at the moment, but as to the future who can say if MS sorts itself out ??

IMHO I do not believe in the theory that these other OS are more secure - its just that nobody is probing them in depth at the moment.

Hmm, another thought is that when you reinstalled software/backups (other than WinXP) on this PC ru sure the originals were not infected ??

I 've read the problem and not the replys, ant these are my suggestions:
by default, all operating systems give no access premission to any one, the ways someone could have the access to you system are:
(*)Physically-> well-known method, just ensure that when you are away from your PC, that you have locked it.

(*)By software-> in this case there is a software grant the access to one who want to access your system for some purpose, the idea with software access is to put it in your machine, so the points you have to take care about ->
1-dont downlaod SW that you dont trust the origin.
2-if some one told you that he give you a picture to downlaod, check the extnsion of the file because it may end with .exe or .scr so it is an executable file which may harm your system, (.scr extension reffer to screen savers).
3-some softwares could make backdoor in your system, so be careful.

Well known solution for such problem is to install FireWall software:
-in windows may you like to use Sygate Personal Firewall (http://www.sygate.com/)
-in Linux you may use iptables scripts for firewall.
( firewall will log all the access made accross your machine from inside or to outside, and prevent access as you specify).
-There are also Hardware firewalls like CISCO PIX firewall.

for more info read about firewalls in this powerful website...

Wesam,

err I'll think you will find that a new WinXP PC, as purchased from any reputable dealer like Dell will run the normal WinXP setup process.

Click on the default options and enter no passwords and what do you have?

A WinXP sytem that has no password whatsoever for its administrator account - or more accurately any account with admin authority.

Absolutely begging to be shagged again ....