With privacy being such a hot topic, what is your stance with different devices?

[jamezr]

She begat is your definition of hacked? If you give your neighbor your alarm code and keys and he goes in and steals your stuff was your house hacked? giving away your credentials is far and away different than taking advantage of a security loophole; you seem to be lumping them together...but okay your definition is your definition.

agreed.....Not if you gave them that info and had a verbal contract to watch your house. There is no hack involved with that scenario.
But what if they tricked you into giving them all of the info they needed to steal your stuff. That is a hack. You still gave it to them but unknowingly. It is no different than using an security exploit in the code to gain unauthorized access to something. It is till the same thing. Do you think software developers leave exploits or loopholes in place on purpose. Of course not. But using them to gain unauthorized access is still hacking......
It is not just my definition. This is the generally used definition for hacking.

 

[C DM]

agreed.....Not if you gave them that info and had a verbal contract to watch your house. There is no hack involved with that scenario.
But what if they tricked you into giving them all of the info they needed to steal your stuff. That is a hack. You still gave it to them but unknowingly. It is no different than using an security exploit in the code to gain unauthorized access to something. It is till the same thing. Do you think software developers leave exploits or loopholes in place on purpose. Of course not. But using them to gain unauthorized access is still hacking......
It is not just my definition. This is the generally used definition for hacking.

Well, to be fair, that would seem to be more of a "hack" or "exploit" of you essentially, not of the system.

 

[I7guy]

agreed.....Not if you gave them that info and had a verbal contract to watch your house. There is no hack involved with that scenario.
But what if they tricked you into giving them all of the info they needed to steal your stuff. That is a hack. You still gave it to them but unknowingly. It is no different than using an security exploit in the code to gain unauthorized access to something. It is till the same thing. Do you think software developers leave exploits or loopholes in place on purpose. Of course not. But using them to gain unauthorized access is still hacking......
It is not just my definition. This is the generally used definition for hacking.

agreed it's a fine line, but social engineering alone is not hacking in my mind, it's tricking someone. Hacking is such a general term that obfuscates the real intent, which is some exploitation of a security bug to gain unauthorized access.
[doublepost=1467398970][/doublepost]

Well, to be fair, that would seem to be more of a "hack" or "exploit" of you essentially, not of the system.

Good point.

 

[jamezr]

Well, to be fair, that would seem to be more of a "hack" or "exploit" of you essentially, not of the system.

yep agreed...if you read my posts leading up to this I have said that explicitly.
Most hacks are done this way...they don't necessarily need to compromise the technology. They can use multiple pronged attacks to gain access to the data they want. Social engineering is one way along with lesser known exploits combined together.

 

[C DM]

yep agreed...if you read my posts leading up to this I have said that explicitly.
Most hacks are done this way...they don't necessarily need to compromise the technology. They can use multiple pronged attacks to gain access to the data they want. Social engineering is one way along with lesser known exploits combined together.

Right. I guess what I'm saying is that in those kinds of circumstances--where it's basically just the social engineering aspect that is in play--saying that the system/service/product was hacked or exploited wouldn't really be correct. There would certainly be something along the lines of unauthorized access involved, but the integrity/security of the system itself wouldn't technically be compromised (as an actual hack or exploit of the system would imply).

 

[jamezr]

agreed it's a fine line, but social engineering alone is not hacking in my mind, it's tricking someone. Hacking is such a general term that obfuscates the real intent, which is some exploitation of a security bug to gain unauthorized access.
[doublepost=1467398970][/doublepost]
Good point.

to be fair....your definition is not the general one used by the rest of the world. Hacking is not just using an security exploit to gain unauthorized access to something. But that is part of the process. Social engineering is part of the process.
[doublepost=1467399652][/doublepost]

Right. I guess what I'm saying is that in those kinds of circumstances--where it's basically just the social engineering aspect that is in play--saying that the system/service/product was hacked or exploited wouldn't really be correct. There would certainly be unauthorized access in play, but the system itself wouldn't be compromised (as an actual hack or exploit of the system would imply).

why? Why would it not be considered hacked? If the system security is so good then it shouldn't be hacked. Part of security is also informing people on what not to do.
If you open an email from your cousin Ned with an attachment that allows control of your computer....that is a hack.
It doesn't matter that you don't HAVE a cousin Ned to begin with.....

 

[C DM]

to be fair....your definition is not the general one used by the rest of the world. Hacking is not just using an security exploit to gain unauthorized access to something. But that is part of the process. Social engineering is part of the process.
[doublepost=1467399652][/doublepost]
why? Why would it not be considered hacked? If the system security is so good then it shouldn't be hacked. Part of security is also informing people on what not to do.
If you open an email from your cousin Ned with an attachment that allows control of your computer....that is a hack.
It doesn't matter that you don't HAVE a cousin Ned to begin with.....

The security system was accessed in the way it was meant to be accessed--it wasn't tricked in any way, nor was something was bypassed in it, nor did anything outside of what normally happens and is expected to happen took place as far as the system goes.

Clearly the fact that an attachment does something to the system where it allows control of it or compromises it in some way is related to an issue with the system, and the part of the cousin is moot. In what I'm talking about there is nothing that the attachment would do beyond what an attachment can and is expected to do, so whether you have a cousin or not or open the email or not nothing unexpected or bad would happen as the system doesn't have an issue handling the attachment correctly.

 

[jamezr]

The security system was accessed in the way it was meant to be accessed--it wasn't tricked in any way, nor was something was bypassed in it, nor did anything outside of what normally happens and is expected to happen took place as far as the system goes.

Clearly the fact that an attachment does something to the system where it allows control of it or compromises it in some way is related to an issue with the system, and the part of the cousin is moot. In what I'm talking about there is nothing that the attachment would do beyond what an attachment can and is expected to do, so whether you have a cousin or not or open the email or not nothing unexpected or bad would happen as the system doesn't have an issue handling the attachment correctly.

Not correct..the system was not used as it was designed nor for the original purpose. It was designed for the account holder or data owner. Not someone else to use credentials of the someone other than themselves.That is not how it was designed. That is not the expected outcome of the account holder or data owner who was duped into give out the account information through social engineering.

If you are tricked or socially engineered into giving out your information it is still a hack. Then that info was used to gain unauthorized access to your information. It is still hacking. Hacking is not just one thing....but using multiple processes including socially engineered ones and exploits to the end result.

 

[C DM]

Not correct..the system was not used as it was designed nor for the original purpose. It was designed for the account holder or data owner. Not someone else to use credentials of the someone other than themselves.That is not how it was designed. That is not the expected outcome of the account holder or data owner who was duped into give out the account information through social engineering.

If you are tricked or socially engineered into giving out your information it is still a hack. Then that info was used to gain unauthorized access to your information. It is still hacking. Hacking is not just one thing....but using multiple processes including socially engineered ones and exploits to the end result.

It was in fact designed to be used via the right credentials. The part about who uses those credentials is extraneous to the system. So, yes, there's the unauthorized access as far as someone else using the credentials goes, but there's no exploitation or hacking of the system itself.

The whole thing could certainly be referred to as hacking (just as searching online is generally referred to as Googling these days) but that doesn't mean that the system itself has an exploit or is doing something unexpected or what it wasn't designed to do. So, in the overall colloquial sense of what "hack" has come to imply it would apply in the general sense, it just doesn't mean that the system itself has something wrong with it.

 

[jamezr]

It was in fact designed to be used via the right credentials. The part about who uses those credentials is extraneous to the system. So, yes, there's the unauthorized access as far as someone else using the credentials goes, but there's no exploitation or hacking of the system itself.

The whole thing could certainly be referred to as hacking (just as searching online is generally referred to as Googling these days) but that doesn't mean that the system itself has an exploit or is doing something unexpected or what it wasn't designed to do. So, in the overall colloquial sense of what "hack" has come to imply it would apply in the general sense, it just doesn't mean that the system itself has something wrong with it.

Disagree...in the scenario i have laid out in the multiple posts is indeed hacking. I think there is this misnomer about hacking. That there is some guy huddled around a keyboard pounding away on a DOS or terminal screen until he breaches a system. Nothing could be further from the truth.
Some hacking is done through data collection. Then the data is mined and sold on the internet. Compromising a system is not just done through the "hacker" example I described above. It is done through multiple processes done through a variety of ways. Sometimes it is done using an software or hardware exploit. Sometimes it is done through through social engineering. Sometimes through combinations of both. But it is still hacking.

 

[C DM]

Disagree...in the scenario i have laid out in the multiple posts is indeed hacking. I think there is this misnomer about hacking. That there is some guy huddled around a keyboard pounding away on a DOS or terminal screen until he breaches a system. Nothing could be further from the truth.
Some hacking is done through data collection. Then the data is mined and sold on the internet. Compromising a system is not just done through the "hacker" example I described above. It is done through multiple processes done through a variety of ways. Sometimes it is done using an software or hardware exploit. Sometimes it is done through through social engineering. Sometimes through combinations of both. But it is still hacking.

The underlying point there is that when it's just something like social engineering that is involved, or even none of that at all, but simply someone willing giving their credentials to someone else, the system itself isn't bad or has some sort of an exploit or security issue, as simply saying that a particular system/service/product was "hacked" would often imply for most people.

 

[jamezr]

The underlying point there is that when it's just something like social engineering that is involved, or even none of that at all, but simply someone willing giving their credentials to someone else, the system itself isn't bad or has some sort of an exploit or security issue, as simply saying that a particular system/service/product was "hacked" would often imply for most people.

I think you jumped into the conversation without context. I have said from the beginning with my discussion with i7guy...that the technology often times is not compromised in a normal fashion. That doesn't mean it cannot be hacked or compromised. You can compromise the security of a system without breaking the system.

 

[C DM]

I think you jumped into the conversation without context. I have said from the beginning with my discussion with i7guy...that the technology often times is not compromised in a normal fashion. That doesn't mean it cannot be hacked or compromised. You can compromise the security of a system without breaking the system.

I've been keeping up with the thread (as I do with many others). And as I was saying, using valid credentials to access a system doesn't mean the system's security is compromised if the person that used those credentials isn't the one to whom those credentials belong, it means the system was accessed by someone else with the system itself working just fine and as expected/designed. Again, I'm saying that when it is said that the system was hacked it doesn't mean that the system isn't working correctly or allowing something that isn't allowed as far as the system is concerned.

 

[MRU]

Anyone knows what goes on with Apple's account recovery? Holy **** it is painful. Is that because it is secure, or because they just don't have proper processes in place?

I reset my iPad because it was becoming mind numbing-ly slow. The phone number on my account went to an old phone number I don't have. So they couldn't text or call my 2fa. So I provided my credit card details, zip code and new phone number and it went into recovery.

It took THREE BUSINESS DAYS to get my link at my new number to reset my account! What is going on here? Manual fraud protection? Some other type of review? Joe Genius just manually processing a queue of requests?

It's just they are uber secure especially when it comes to 2 step authentication. I know a few users who have essentially locked themselves completely out of the device by 1. Forgetting Apple ID Login details 2. Putting on a password lock and then 3. Forgetting that password.

 

[jamezr]

I've been keeping up with the thread (as I do with many others). And as I was saying, using valid credentials to access a system doesn't mean the system's security is compromised if the person that used those credentials isn't the one to whom those credentials belong, it means the system was accessed by someone else with the system itself working just fine and as expected/designed. Again, I'm saying that when it is said that the system was hacked it doesn't mean that the system isn't working correctly or allowing something that isn't allowed as far as the system is concerned.

Sorry but that scenario you described is compromising a system. Using someone else's credentials that you socially engineered them into providing to you to access a system that is not your own is compromising the security built around security credentials. It is the very reason why there was separate credentials in the first place.
The system security is NOT designed this way and in fact has measures in place to prevent and discourage that very thing. We are warned repeatedly not to give out passwords or security information to anyone. Because it breaks the built in security and safeguards.
Gaining unauthorized access to information and or accounts other than your own is against the law.

I disagree with you here.......Stealing someone's account information then using that account information to gain unauthorized access to an account and information other than your own is NOT how the system is designed.

 

[mildocjr]

I am security conscious when it comes to my devices and the Internet. I have a Windows 10 PC and an iMac, everyone in my house has an iPhone and my spouse and I have iPads.

My go to device is an Apple device because they are less likely a target based on the amount of malware written by Operating System and I enjoy their "walled garden" because it is a further step that I don't get stung by a bee.

As for privacy settings on the Macs, I use encryption only on computers that leave my house and use the firewall as well as gatekeeper set at it's default setting.

For my iDevices, I only allow apps to use my location if they 1) require it for some actual purpose (i.e. location for weather) and 2) provide an option to only use it while using the app.

On Facebook, I have everything hidden from anyone I do not add and remove my page from search engines. To add me a person must know my email address for Facebook as I have more than a few. Everything added to my wall by an another person must be authorized by me before it is shown.

I do not include information on where I live, my phone number, my age, or my sex unless it is required.

On forums I try not to pass too much information, my gender, ethnicity, education, and marital status are fine but I only use them where the context makes sense. This also allows for me to make non-biased statements about high tension issues without anyone saying oh mildocjr is such and such, of course he'd think that way, I like to come to issues with an open mind and

As I have only started caring about my online presence in the past year I'm sure there is still more information about me on the web than I talk about, but as I find it, I remove it.

When it comes to hacking, nothing is hack proof, however you can certainly reduce your risk of becoming compromised by education on security precautions.

I have a 4 year degree in Information Security with 8 years in the field.

**Added Windows 10***
For Windows, I keep the firewall set on and only allow apps to connect if it is necessary, in my case it is my gaming machine so I allow multiplayer games to connect but only through a private connection.

I do not allow the metro apps to connect or share my data, and I limit telemetry using ShutUp10.

I do turn on important data sharing items like Windows Defender submissions.

Windows 10 is a very resilient operating system when it comes to threats, but as I said above, education will protect you more than Antivirus software. I run with Windows Defender only, but I know that it doesn't save me from everything, my education helps mitigate the other risks. I go through every UAC prompt with a fine tooth comb before I continue on if I don't know why it popped up.

If I had to suggest an Antivirus, for gaming computers check out BitDefender, for average user, check out Avast, both provide great performance and protection, however these change from time to time. I get my results from https://www.av-test.org. BitDefender box looks like a cool solution for people who have many computers on their network with less than 100 Mbps download speeds.

For all of my computers, if I download a file that is new to me and my AV doesn't scream at me, I typically upload the file to https://virustotal.com/ to see if it's a safe file. Also depending on the functionality of certain admin tools such as produkey (from Nirsoft) AV will scream at you by the nature of the program, if you are using deep diving tools such as this, be aware that you may get false positives, but it is ultimately on you for whether or not you run the file.

I do not condone running files that trigger AV scans, and I am not affiliated with BitDefender, Avast, av-test.org, or virustotal.com. This is just my experience in what I have seen fit for my needs on working in home and enterprise environments (>250 devices).

 

[C DM]

Sorry but that scenario you described is compromising a system. Using someone else's credentials that you socially engineered them into providing to you to access a system that is not your own is compromising the security built around security credentials. It is the very reason why there was separate credentials in the first place.
The system security is NOT designed this way and in fact has measures in place to prevent and discourage that very thing. We are warned repeatedly not to give out passwords or security information to anyone. Because it breaks the built in security and safeguards.
Gaining unauthorized access to information and or accounts other than your own is against the law.

I disagree with you here.......Stealing someone's account information then using that account information to gain unauthorized access to an account and information other than your own is NOT how the system is designed.

Let's put it this way, if you have a locker at your work where you store your personal belongings and a co-worker tricks you into giving him your key and then at some point accesses your locker, does that mean that there's a security issue with the lock or the locker or the locker room?

 

[jamezr]

Let's put it this way, if you have a locker at your work where you store your personal belongings and a co-worker tricks you into giving him your key and then at some point accesses your locker, does that mean that there's a security issue with the lock or the locker or the locker room?

Not the same one to one relationship. But there is a security concern with how your belongings are protected.

Then....be your own example...see how easy it is to compromise security? No matter how strong that lock was or how strong the locker is...all it takes is a little social engineering to bypass all that.

Now remember..if you have been staying current as you said you were. I didn't say there was anything wrong with iClouds security. I have said all along that anything can be hacked. You just helped me prove that with your example.

It was i7guy who said icloud could not be hacked.

 

[C DM]

Not the same one to one relationship. But there is a security concern with how your belongings are protected.

Then....be your own example...see how easy it is to compromise security? No matter how strong that lock was or how strong the locker is...all it takes is a little social engineering to bypass all that.

Now remember..if you have been staying current as you said you were. I didn't say there was anything wrong with iClouds security. I have said all along that anything can be hacked. You just helped me prove that with your example.

It was i7guy who said icloud could not be hacked.

And that wasn't really the part I was commenting on, it was the part that came up in that discussion about what simply saying that a service/product was hacked can often imply to most people, and how that doesn't necessarily mean that that particular service/product actually has any issues with its security or functionality that other people who normally take typical/common precautions (like simply not giving away their credentials) would have to worry about.

 

[I7guy]

Not the same one to one relationship. But there is a security concern with how your belongings are protected.

Then....be your own example...see how easy it is to compromise security? No matter how strong that lock was or how strong the locker is...all it takes is a little social engineering to bypass all that.

Now remember..if you have been staying current as you said you were. I didn't say there was anything wrong with iClouds security. I have said all along that anything can be hacked. You just helped me prove that with your example.

It was i7guy who said icloud could not be hacked.

I said iCloud could not be hacked today, given 2fa. Is it possible to brute force and bypass these mechanisms, I don't know, but it's not the same as getting acces to the credentials and phone and entering through the front door. We are not discussing the legality of such actions. A weak system working as described is still a weak system, but exploitation of a stack overflow for example is not the same as entering through the front door legally or illegally.

 

[mildocjr]

@jamezr @C DM @I7guy

The locker room example is a good example, but the key components of security authentication are "Something that you are, something that you have, and something that you know." If you give up these three things though social engineering (going with the example) then you have a breach in security. Something that you are is the owner of that locker, something that you have is the key to that locker, and something that you know is the number of that locker (or the combination to the lock). If someone else has the key to that locker and know the number of the locker they can impersonate you and grab your stuff.

Likewise, with iCloud if you have the username and know the password you can impersonate the owner and grab their stuff. Exploiting vulnerabilities such as buffer overflows, sql injections, and social engineering are all ways to hack iCloud. It is only as strong as it's weakest link. And as with all things, the bigger the fence, the more likely there's a broken link.

I wouldn't worry about who said it could not be hacked, as I said above, given enough time and determination, someone will find a hole in the fence, no matter who's fence it is.

 

[jamezr]

I said iCloud could not be hacked today, given 2fa. Is it possible to brute force and bypass these mechanisms, I don't know, but it's not the same as getting acces to the credentials and phone and entering through the front door. We are not discussing the legality of such actions. A weak system working as described is still a weak system, but exploitation of a stack overflow for example is not the same as entering through the front door legally or illegally.

But it is the same if the end result is the same.

 

[mildocjr]

exploitation of a stack overflow for example is not the same as entering through the front door legally or illegally

Actually it could, falls under the lateral idea that if you push enough people through double doors while you are trying to get a headcount you'll miss someone. Of course this analogy goes for DDoS too.

 

[jamezr]

@jamezr @C DM @I7guy

The locker room example is a good example, but the key components of security authentication are "Something that you are, something that you have, and something that you know." If you give up these three things though social engineering (going with the example) then you have a breach in security. Something that you are is the owner of that locker, something that you have is the key to that locker, and something that you know is the number of that locker (or the combination to the lock). If someone else has the key to that locker and know the number of the locker they can impersonate you and grab your stuff.

Likewise, with iCloud if you have the username and know the password you can impersonate the owner and grab their stuff. Exploiting vulnerabilities such as buffer overflows, sql injections, and social engineering are all ways to hack iCloud. It is only as strong as it's weakest link. And as with all things, the bigger the fence, the more likely there's a broken link.

I wouldn't worry about who said it could not be hacked, as I said above, given enough time and determination, someone will find a hole in the fence, no matter who's fence it is.

Completely agree! Great way to summarize and very succinctly said.
[doublepost=1467407654][/doublepost]

And that wasn't really the part I was commenting on, it was the part that came up in that discussion about what simply saying that a service/product was hacked can often imply to most people, and how that doesn't necessarily mean that that particular service/product actually has any issues with its security or functionality that other people who normally take typical/common precautions (like simply not giving away their credentials) would have to worry about.

Disagree.....people give out their information daily through social engineering and through public persona. It is the everyday person that is the most susceptible to being hacked through social engineering.
They have birthdays and last names(maiden names) addresses and work place freely available on social media.

 

[C DM]

Completely agree! Great way to summarize and very succinctly said.
[doublepost=1467407654][/doublepost]
Disagree.....people give out their information daily through social engineering and through public persona. It is the everyday person that is the most susceptible to being hacked through social engineering.
They have birthdays and last names(maiden names) addresses and work place freely available on social media.

Which doesn't mean that a service/product itself has an issue or is insecure, just as you made it a point to reiterate that yourself in this discussion by mentioning that you "didn't say that there was anything wrong with iClouds security" (using iCloud as an example of this).