Posted by Gordon W on 30/05/2016 13:51:48:
SOD-Dave & Vic-I fully agree with you, but why worry? -Most of the info. can be found at my local pub, bank details etc. could be got from all sorts of other sites, none of which we have any control over. Buying petrol is a security risk. Quite happy for any info. ( except bank details etc. ) to be given, every time we buy something it is recorded somewhere. I am dead against all this information gathering, whoever does it, but we can do nothing so why worry.
Hi Gordon,
Yes you make a good point. I could pay a private detective to get most of someone's data. Most of us aren't worth the cost of doing that though.
The difference with computers on the internet is that privacy sensitive data can be collected globally, recorded permanently, merged and amalgamated with data from other sources, and then sorted, filtered and analysed at leisure. It's cheap, automatic and impersonal. Much of the activity is no doubt benign, but not everyone in the world can be trusted.
I have a friend who adamantly took the line that no-one would notice that he was online with an un-patched XP system with no virus protection, or firewall. He compounded his problems by giving himself admin privileges and not bothering with a password. He thought a hacker was a spotty youth trying to break into business systems from his back bedroom who wouldn't bother with him. Yes such people exist.
What he actually encountered was a criminal organisation based in Russia that was using a sophisticated distributed worm to internationally scan IP addresses by the million. They were looking for insecure machines. One way of doing this is to send malformed messages over the network to see how the target machine handles the errors. It is usually possible to identify the operating system and version state of the target machine by the way it responds to corrupt messages. You don't know if this is happening or not unless you check. My firewall log shows that my IP address is occasionally been probed unsuccessfully.
Having identified a machine and operating system, the next stage is to run a series of scripts that try known weaknesses. A fairly obvious one is attempt to log in as admin with no password, and if that fails to repeat using each entry in a long list of common passwords. People aren't very imaginative. There's a lot more that can be tried to find an entry point.
My friend logged in one day to find that the baddies had logged in and encrypted his hard drive. They wanted money to unlock it. As he wasn't prepared to give them his account details he lost all the data on the machine and also had to reinstall all his software from scratch. It was a painful lesson.
He wasn't targeted because he was rich, interesting or important. He was identified because he was vulnerable, much as the weaklings in a herd get hunted by lions.
What you do to secure your system, or not, gives it a kind of electronic signature that allows weaklings to be identified. If you have also been unwise enough to store password lists on your machine, or allowed your browser to remember sensitive passwords, you can expect fireworks once they gain access.
This type of attack uses nothing more than computer time. A human is only involved when a break-in is reported. Once they are in, it becomes even more dangerous if the bad guys have access to other information about you. For example, people often use their car registrations as a password because it's easty to remember, and then they use that same password for all their online accounts. More seriously a good understanding of who and what you are and how much wealth you have makes it much easier to con you.
Anyway, I'm simply suggesting that it's prudent to take precautions. Burglars looking for work tend to avoid houses with alarms, good locks, strong right arms, and dogs. It's much the same with well protected computers.
I don't want to panic anyone. Banks, ISPs and other security sensitive services do try quite hard to protect us. The internet is fairly safe as long as we take suitable precautions.
What all this data collection means in terms of civil liberties is another dimension. In the West, despite some obvious exceptions, we are lucky to have better than averagely trustworthy governments. Let's hope they stay that way!
Cheers,
Dave