I'd like to think I know a reasonable amount about security. I delved into the realm of ethical hacking several years ago (a very practical skill if you write web software, how can you protect your users and your site if you don't know vulnerabilities to cover for?) and what I've learned is that we're all a lot more vulnerable than we'd like to think we are. There's certainly the stuff you can Google. You can Google your known usernames and e-mail addresses and more often than not you'll be able to create some kind of profile for yourself... where you live, what you're interested in, who you know, etc. Then things like Twitter give more insight into your private life. If you find a Youtube account you can see what they comment on, what they're interested in and stuff about their life you can glean from videos they've posted. Find out someone's real name and then you've got Facebook, things like LinkedIN profiles (tell you where they work), Google Plus and etc. This is all the easy stuff you can find out about a person just from Google and making connections between known pieces of information. The longer you've been on the internet, the more that stuff starts to accumulate. Particularly if you started young, you may have posted information you shouldn't have about yourself. And the internet pretty much remembers everything. We've left footprints all over the place.
That's information anyone has access to. But what's real scary is the next level, which is how often that known information has been hacked. I think a lot of people have this idea of "getting hacked" like they would be targeted specifically and it's some guy typing away at a keyboard like in the movies but most of the time it's not anything like this. A lot of the time it's completely automated. You register for a forum in 2004, it's running an old version of some forum software with known vulnerabilities. You haven't used that account in 10 years maybe. Multiple times a day an automated 'crawler' script is downloading the user database through some SQL injection, including password hashes. Maybe it's a known MD5 hash or something and they're able to look up the pre-hash value (all automated). That gives them an e-mail address, possibly a name and more importantly a password. Maybe the password works for that e-mail address, maybe the password doesn't work. Maybe they find that same username on a more modern site and the password still works. Maybe it's the username and password of your World of Warcraft account, which they've now sold or used for nefarious activities. All kinds of stuff happens. Probably and I say this honestly, over 90% of the time these sites have no idea they've been hacked because who really is monitoring server logs 24/7, especially if you have a lot of traffic? It takes a large company with the money to actively monitor intrusions and most smaller sites don't or can't do this. Thusly, most action is taken retroactively after a problem has been discovered.
That makes sites running known software a double-edged sword because they have known vulnerabilities... if vulnerability X is in this version or earlier, then you know all sites running that software have that same access point. On the flip side, that also means these things get fixed and usually if you're running the latest version, you're safe (at least for the meantime, barring new vulnerabilities). Conversely, hackers can hack other sites that were developed from the ground up and these sites are the worst for vulnerabilities because most developers don't know what to look for. I have on several occasions sat down to a random website and toyed with it "just for kicks" and found myself will full admin access. Found myself dumping SQL tables or getting up to all kinds of nefariousness. I have web developer friends and have done this to their sites while they watched me type and they are literally blown away. It is scary, in how easy it can really happen and how most of the people making any website software know pretty much nothing about how to prevent it (I think the general user perception is that if you can make a website, you must be some kind of computer genius... if they can do all this stuff with databases and programming, surely my information is secure which couldn't be farther from the truth.). Hacking in itself is kind of like puzzle solving. Finding ways to make existing features do things they're not supposed to do. Finding the chink in the armour. It's a lot easier on software that has not yet been tested in the fire, so to speak.
And this is stuff that an amateur like myself is capable of. When you get into professional hackers, you're into a whole new level of scary. They'll bring a whole world of knowledge to bear on anything they can get access to (software level, server level, your home network or maybe even creeping over your shoulder at an internet cafe). If you want to go to an even higher level, state and corporate funded hacking is the kind of stuff movies are made about. The stuff Chinese state-funded hackers can and will do scares the shit out of me.
How do you protect yourself and your information? What do you use or do and what do you think about this whole topic?
A lot of different usernames and a lot of different passwords. Most importantly my passwords are long and very complicated, so I feel reasonably confident that when they are hashed a hacker will not be able to look up the pre-hash value in some existing database. They're different because even in this day and age, some places don't hash passwords when they put them in the database and I don't want them re-used on another site. You occasionally see it in the news how passwords get stolen but they weren't hashed (so basically they're stored exactly as they were submitted). But I wouldn't say I feel particularly safe. I know I've slipped up somewhere. I know I haven't been as private with my information as I should have been and now it's stored forever on the internet. I don't feel safe at all, I mostly feel "untargeted" for more aggressive hacking. But I've already seen my usernames, e-mails and hashed password show up in several dumps of these headline hacker stories (Bethesda forums, for instance).
. I kind of thought that this kind of thing is going on, but you cleared the mist from my eyes. I think i will create a real notebook for passwords from now on - and all them will be different.
