On 1/8/19 12:20 PM, Kevin Lee via cctalk wrote: Yeah, I get the one occasionally that claims to have compromising video taken with my PC's webcam. Except, of course, my computer doesn't have and never has had a webcam. About the most persistent spam that I receive on my cctalk email are ads --Chuck

On 01/08/2019 02:11 PM, Peter Coghlan via cctalk wrote: True. Agreed. I wish more mailing lists were as diligent. I see a LOT of spam come through specific lists. More than I typically see in Usenet newsgroups. :-/ -- Grant. . . . unix || die

On 08/01/2019 21:37, alan--- via cctalk wrote: Oh, there's a worse hell -- I hope -- for the sort of Unix sysadmin (I won't mention Aaron's name ;-)) put in charge of a sizeable HPC cluster, decided to password protect it to ensure only a certain set of users would have access, somehow copied the passwords they used on the main system, and stored them in plain text on a related machine for his access control. He no longer works for the enterprise in question. -- Pete Pete Turnbull

On 01/08/2019 03:41 PM, Grant Taylor via cctalk wrote: I to have received that phishing attempt many times. Its actually funny.? The password given is three yahoo (groups) hacks ago (about 10 years) but the email address used was a public one way reflector (arrl.net).? So all and all its a crude phishing attempt.? I write down old passwords to keep from reuse and I use long mixed ones.? So I know it was from that and meaningless. The source is useless as the address is a bogus hack as well. Same claims of rude and crude caught off the camera save for the systems use never had one or are blocked/disconnected(laptops) and at best a stupid threat. I run linux on multiple flavors/platforms so typical M$ hacks don't fly either. I was tempted to buy the smallest bitcoin possible maybe 0.1 cent (1 milliDollar) for laughs and send that as they deserve the very least for a dumb hack. Ignore the phoolz and if the password matches current change it consider changing them periodically. A=

On Tue, Jan 08, 2019 at 02:29:47PM -0700, Grant Taylor via cctalk wrote: She's not the only one. ;) The one thing that does bother me about these scams is they do work despite our best efforts at informing people of the scam. FreeBSD on all my platforms. Same. The usual hacks don't bother me. ditto. Unless the cops are doing it to catch the .... {fill in swear word} I'd stay well away. Correct. What happens is people start rotating passwords 12345 23451 etc. that sort of thing. Bad. But not so bad if you are actually careful to use good passwords you never re-use. Certainly never re-use a password for more than one purpose. 73 Diane VA3DB -- - db at FreeBSD.org db at db.net http://artemis.db.net/~db

Posted on the wall, in clear line of sight of the webcam? They say that people haven't learned anything about computer security. But, the most common password is no longer "PASSWORD"! It is now "PASSWORD1". https://blog.codinghorror.com/content/images/2017/03/incorrect-password.jpg

On Tue, 8 Jan 2019, allison via cctalk wrote: Howzbout: a quarter second lockout after a fail; double that for each subsequent fail. Three tries to get it right will not be inconvenienced. But, by 32 tries, it's up to a biillion seconds.

On 01/08/2019 04:33 PM, Fred Cisin via cctalk wrote: Interesting observation I made a few years ago. I run a web store, and was being inundated with ssh login attempts. About 1000/day! I decided this was serious, they'd eventually get lucky. So, searching available software, I found denyhosts. It checks the logs for login failures, and after a set threshold, it puts the source IP into the hosts.deny list, and your machine effectively disappears from that source IP's view. I set the rules very strictly, so that after 3 login failures over a 2 month span, that IP was blocked for a year. Something very interesting happened. The number of attempts did not diminish immediately, as the botnets had a large number of compromised machines. But, suddenly, two weeks to the EXACT HOUR when I set up denyhosts, the attacks dropped from 1000/day to 3! Just like flipping a switch! So, these hackers have a dark net list somewhere where they trade IP addresses of machines they would like to hack, and what they can figure out about the security measures implemented on them. When they have demonstrated by coordinated attempts that your lockout horizon is over two weeks, they put out the word that your site is not going to bear any fruit. I currently have 9000-some blocked IPs in hosts.deny, I wonder how much that slows down my store. Ugh, the stuff we are forced to go through. Jon

On 1/8/19 8:39 PM, Fred Cisin via cctalk wrote: There's a high chance for false positives there. I wonder if it's three password attempts (likely in a single connection) or three failed connections. I could see how three failed connections would suffice, as that would be nine password attempts. I created a fancy IPTables rule set that used the recent match extension to dynamically (in kernel without any files on the drive) produce back out period. I don't remember the exact count of things, or the timings. But I do recall that it was something like 5 minutes, 30 minutes, 1 hour, 1 day, 1 week, 1 month, 1 year. I don't think I had permanent. (Maybe I did. It's been 15+ years.) -- Grant. . . . unix || die

At 08:56 PM 8/01/2019 -0600, you wrote: I've been receiving the same 'hacked your account, sending this from your account, send bitcoins' scam emails for a while. They are NOT from 'my account' (what does that even mean?) although the sender email address is same as one or more of mine. But that is spoofable. I ignore them. I can see all the headers, which include lines like: X-Mailer: Microsoft Outlook Express 6.00.2900.3022 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3022 Since I'd rather die than use MS Outlook Express, or even install it an any system of mine, I know they lie (and for other reasons.) Recently one quoted 'my password' as evidence. It's a password I used on a porn site long ago, and that site changed hands and became a junk site sometime since. Maybe the new owners branched into extortion scams? I also at times receive a lot of scamming phone calls to my landline. Sometimes several a day. These have such a consistent format that I'm sure they must come from some group, even though they use different names. The phone rings, I pick up, there's a variable duration interval of silence, then a pooiip! popping sound (their system connecting this call to one of their operators, now that I answered), then a usually very Indian sounding voice (M or F) says something like "Hello, this is Microsoft security service" or "Hello this is product testing group." I never bother to go along with it to see what their intent is. Just hang up usually. We all know the government has total surveilance of all electronic communications. Don't argue, this is not a 'conspiracy theory'. I've even had dinner with a guy who was my interpreter wife's boss at the time, as head of the Sydney branch of Australia's national crime commission's intercepts division. Discussed the Echelon system (as it was named then) system with him, which he acknowledged existed. I asked so, what percentage of ALL communications (voice and digital) does the system capture and analyze for keywords? (Echelon used a 'dictionary' of keywords and phrases of interest, put together each week by the NATO powers, and shared among them all. Intercepts in each country are done on coms backbones, with each site existing as a diplomatic enclave, manned by intelligence staff who are acting on behalf of 'foreign allies' hence getting around local surveilance legal limitations. Any intelligence of interest is passed to local intelligence services as a diplomatic communication, so the local gov was not 'spying on their own citizens.' Ha ha ha. It sucks, but that is how it worked nearly 20 years ago. Certainly much worse now. I don't know what the equivalent system is called these days.) His answer: around 98%. Now here's the thing. Another interesting observation one could make: You'd think these kind of scamming emails and phone calls should be illegal, and easily prosecutable. You'd think it would require almost no effort at all from law enforcement and coms carriers, to identify the sources. Given that they have total transparency of the telecoms infrastructure. Not to mention that if Indian call centers are involved there would be international carrier contracts and national entry points that would stand out like searchlights in traffic analysis. Same goes for Asian paid web click farms, etc. Even botnets with encrypted command channels - I can't believe it can be technically impossible to shut these down. So, how does this bullsh*t continue? One can only conclude that the large scale scamming operations are conducted with the knowledge of, and probably complicity of, government at some level. The real question is why. I can make guesses about that too. But doubt many here would find it comfortable. Or on topic. Guy

On 1/8/19 9:15 PM, Fred Cisin via cctalk wrote: I used to get one of those calls every few days, but I'm using a screening service, so I haven't gotten one in months. Too bad! I used to have a lot of fun playing dumb. "Vindows" key? Where is that (I'm using an IBM Model M)? Now, go to your start menu and select "Run program". Huh? What do you mean "start menu"? (I'm running Linux) I have several more computers, would you like me to try them? Sometimes I could tie the scammer up for 15-20 minutes before he'd hang up, very often after uttering an obscenity. --Chuck

I've heard quit a bit about that scam, but I haven't gotten that one. The really sad part is that I'm not doing anything that I could be blackmailed about. THAT is depressing. (Crypto-locker, etc. is EXTORTION, not blackmail)

On 01/08/2019 03:09 PM, allison via cctalk wrote: Sure, I could send you a bunch. Jon

On 01/08/2019 03:02 PM, Al Kossow via cctalk wrote: Laziness. What's easier to do: 1) Go find and repeatedly scrape mailing list archives for sending email addresses. 2) Subscribe one email address to the same mailing lists and have the messages delivered to you where you can have an automated process scrape the incoming messages. I know what I think has the better RoI and lower TCO. -- Grant. . . . unix || die