Hack Attempt

[zebo-the-fat]

I just received a phone call from someone trying to hack my computer, I had great fun with him!

The conversation went something like this (shortened, lasted about 10 minutes):-

Him "Hello you need to do some checks on your computer"
Me "Which one?"
Him "The one you connect to the internet with"
Me "I have 5 computers connected to the internet, which one has a problem and how do you know, have you been hacking my system?"
Him "Your main windows computer"
Me "I don't have a windows computer"
Him "What do you mean, you can't use the internet without windows!"
Me "I use linux not windoze"!
... long pause, then
Him "what?"
I don't use windoze, I use linux"
he then hung up!

[Autumnlicious]

Why don't I get these scams?

I have a Windows VM already set up and nmap/metasploit waiting for a would be scammer's PC!

Barf. I never get to torture the bad guys.

[Kayenneh]

I have only been attacked by phishers, who have gotten angry with me for reporting them. Fortunately I have always had decent passwords (and a mobile verificator for WoW), so they haven't ever gotten far

[Autumnlicious]

Heh.

Since you play Blizzard games, let me inform you of a little security "secret" (open secret) that Blizzard wants to pretend isn't there.

Battle.net is in a bind.

Their old system from Warcraft II: Battle.net Edition uppercased all letters in the password entry.

That means that:

mYSeCrEtPassWoRD and MYSECRETPASSWORD and all variants in between validate for an account that uses any form of "mysecretpassword"

Due to this, the Blizzard does not know the original password that the user "knows".

If they were to fix this but not force a mass password reset (bad), the best they could do is split the authentication services to direct all older services to a legacy framework and all new "improved" services to the new framework.

But they didn't.

Battle.net 2.0, if I recall, suffers the same flaw.

Meaning that it is relatively simple still to break a users password if it is mostly alphabetical symbols, since the casing is irrelevant.

Herp derp Blizzard.

---

This is what I recall from my days participating the in Broodwar hacking community.

[Kayenneh]

Meaning that it is relatively simple still to break a users password if it is mostly alphabetical symbols, since the casing is irrelevant.

Herp derp Blizzard.

Derp indeed! But no, I use other symbols too. And without the authenticator code, it wouldn't matter if my password was abc123(?)

[Autumnlicious]

Yep.

My sister, to whom I gave custody of my bnet accounts, has noted that the sheer amount of account locks due to accessing from different locations is probably to force people to buy an authenticator.

I've unlocked my account no less than ten times in the first month of getting her on board.

But I ain't paying for an authenticator nor am I installing their stupid software onto my iPhone -- only asked her to use more numbers and non-alphabetical symbols in the password.

[Phish]

Which linux distro are you using?I'm using Kubuntu 12.10 with KDE 4.10 its the bauss
also are you using wine on your computer,because viruses can run under linux if you run them under virtual simulator.
also you should install clamav and ufw

[zebo-the-fat]

Which linux distro are you using?I'm using Kubuntu 12.10 with KDE 4.10 its the bauss
also are you using wine on your computer,because viruses can run under linux if you run them under virtual simulator.
also you should install clamav and ufw

Running Mint 14, Mate desktop clamav installed, not using wine

[Phish]

Which linux distro are you using?I'm using Kubuntu 12.10 with KDE 4.10 its the bauss
also are you using wine on your computer,because viruses can run under linux if you run them under virtual simulator.
also you should install clamav and ufw

Running Mint 14, Mate desktop clamav installed, not using wine

maybe he was using backtrack,also you should try to install ufw

[jstrodel]

social engineering it is called