Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
I think the most inconvenient part is that these days I'm terrified of using any computer besides my own except for menial stuff. It used to be that you could just open the TaskManager and make a judgement call on how clean the computer was. Now, given how well all this poo poo hides, and how easy it is to pick up, the safer bet is to just wait till you get home or use your mobile device if you can.

Adbot
ADBOT LOVES YOU

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
My mother's computer got infected with Windows Tool. She did run the "Diagnostic" tool that scans your hard-drive. Fortunately she asked me before doing anything else and didn't actually put in her Credit Card info to purchase the "advanced" option it offers.

I've already taken the computer off the network.

Two questions:

1. What are the possibilities that this spread to other computers on the network? There's two: a Mac, and a PC running Windows 7 with its antivirus up-to-date, both behind a router running DD-WRT with its in-built firewall on. Neither have shown any symptoms).

How difficult will it be to completely clean up the system from this? I know that flatten and reinstall is usually the go-to option in these cases, but I'd rather avoid that if at all possible.

I appreciate any help.

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
I just did something so dumb that I'm honestly worried that I had a mini-stroke or something because goddamn.

My sister is visiting and asks me if I can copy a file from my machine to her USB stick. Knowing her I was 100% sure that that stick was going to be infected with something, so I double check that autorun is off, stick it in, enable the "Show System Files" option and, sure enough, find a hidden folder with "MyFile.exe" in it.

Then, instead of outright deleting it I decide that I'm gonna scan it instead (I honestly don't even know why). I right click the file and my UAC reflexes must've kicked in or something because I proceeded to select "Run as Administrator" and then I clicked "Yes" on the prompt.

Luckily my Antivirus caught it so nothing happened, but I swear to God I just stared at my screen for two minutes after it just completely dumbstruck at what I had just done.

It was like I suddenly became the epitome of a bad computer user.

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
I'm the ad-hoc IT guy for my small law office (5 users, including the receptionist). All of them are Windows machines (XP through 8, but I'll be replacing the one XP machine as soon as Windows 8.1 hits)

It's not absolutely indispensable, but some users (the lawyers) usually need access to each other's files (for drafting and revisioning purposes). Right now that's solved by having the lawyer's computers share their Documents folder (just that folder) through the network.

This is obviously Very Dumbtm and I will be correcting this ASAP tomorrow morning, especially after reading this whole CryptoLocker discussion.

Still, I'm wondering if there is any safe way and convenient way (ie: not having to send everything through e-mail) for users to share their files without actually exposing every machine to the network.

One option I thought of was that right now every user has their folders synced in real-time to a Google account, so I could simply have each Google user share the folders to each other, which will be automatically downloaded to the other user's machine via Google's Windows app. The bonus of this is that everything will also go through Google's file scanning process.

Any thoughts?

Edit: I understand the legal contingencies of having confidential legal documents leave the local environment and get hosted on a third-party's website. I am OK with this.

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer

Do Not Resuscitate posted:

Do you? I can't believe the attorneys in your office are okay with opening themselves up to attorney/client privilege issues this way. I work for a large law firm and our partners' hearts would explode from their chests if someone was storing attorney work product on Google Docs.

The complicated answer: this isn't in the US, and our legal framework for offsite storage is a lot simpler. Basically, as long as certain criteria are met re: protection from outside access to our files, we are legally in the clear.

The simple answer: there is literally no one that cares where our files are because we are a 5-man operation that doesn't handle big clients. Data protection (and cost-effectiveness) is a lot more important than some ethereal contingency that has zero real world application for our use-case.

This isn't really the place to discuss this, however. It's my bad for even bringing up the legal issue in the first place. As a small aside, you'd be very surprised how many large lawfirms and hotshot lawyers will actually communicate, and even send files, through free webmail addresses. Like someone posted before, enterprise security is sometimes so lax that it might as well not exist, and in the end you're a lot more worried that someone is reading your e-mails than some hypothetical malpractice suit over proper data protection.

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer

Khablam posted:

Avast!, ESET, Trend and a couple of others had day-0 definitions for this thing, and scan and intercept web traffic. In my opinion any AV that doesn't intercept and scan network/web traffic before the browser sees it is 100% useless in the real world; it's ability to detect viruses sitting on your file-system is irrelevant.

Does the free version of Avast have this?

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer

Paul MaudDib posted:

Apparently GCHQ is using MITM attacks at GRX mobile exchanges and internet exchanges.

Here, they used MITM attacks on LinkedIn and Slashdot to drop malware onto the computers of engineers for the GRX router system. It seems to be a new piece of malware called "Quantum". From there, they can perform other attacks, like monitoring users or using a MITM to drop malware onto smartphones. This apparently includes the capability of remote microphone activation. And their end goal is to be able to deploy malware ("implants") when they only know the MSISDN.

http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html

Pretty impressive stuff, people swore up and down that most of that stuff was impossible earlier this year.

This is some Batman-esque poo poo.

Would using encrypted voice-communications apps help, or are they literally picking up everything your microphone records (ie: before the app itself can even get a chance to encrypt it)?

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
Is there any way to safely scan a USB device before it has a chance to install all sorts poo poo into a computer? I have autoplay disabled on Windows 7, if that helps.

I know that it came out that USB has unblockable firmware vulnerabilities, but I'm assuming those aren't in the wild yet (hopefully) and there's really not a lot I can do about it, so for now I'm just worried about regular malware.

Adbot
ADBOT LOVES YOU

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer
OpenDNS has/had a feature where if you used their service they would scan your traffic to detect any markers of typical malicious activity (botnets, spam, etc.).

I felt this was extremely useful to get an early warning that something had gotten into our small-office network.

My problem is that we are not in the US, so using OpenDNS meant a significant latency increase in day-to-day browsing, since most of our requests first had to OpenDNS's US servers, then back to us, then finally to the target website.

Is there any equivalent service that I can use at a local network level or that doesn't involve using a third-party DNS?

Our network structure is basically Modem -> Router -> 5 PCs, all running Windows 7-8.

  • Locked thread