Have people been asking you about that trip to London where your hotel room was trashed and you lost all your cash?
Or has your Facebook account been locked because you were supposedly hacking people’s accounts?
Or maybe not you, but somebody you know?
Wouldn’t you like to know what happened?
Well, honey-chile, I’m going to try and explain it to you.
> > > You Were Hacked! < < <
Nothin’ personal. May’s well be you as anyone else. You just got un-lucky.
I’m going to try and keep this simple and understandable, but it’s going to get a little deep here and there.
They hacked your account because they got your password.
There are a couple or four ways they got your password. Here’s how, and how to prevent it from happening again.
1. “Get the Password”
If your computer is running a little slow, it is not because the thingy inside is slowing down. Quite the opposite, really. The thingy inside is extra busy now, doing what you want it to do along with three or four other things someone else wants it to do.
Let’s talk about those “other things.” Those other things are called “malware,” malicious software, software written to harm you.
The passwords you use are stored in well-defined places inside your computer’s memory. They are stored in an encrypted form, but encryption is not perfect, some encryption is better than others, and some passwords are better than others.
What the malware is doing is trying to de-crypt your passwords. This may take minutes, days, hours, or weeks, but it’s being done by computer so it never gets tired.
When the malware has de-crypted your passwords, it sends them across the ‘Net to where the bad guys can use them.
So it’s a good thing to not let the computer remember your passwords for you.
Yeah, sure, like you’re going to do that. Nobody is going to enter their email password every time they go to get their email.
So there’s where it sits. You get some malware on your machine and in a short time they have your email passwords. So that’s how they broke in to your GMail account.
At least don’t let your browser remember your passwords for you. Browsers store your passwords in a very easy to find way, very easy to crack, and then they have access to your bank, your Web-based email, your address book…anything you had protected.
If you have been letting your computer remember your passwords for you, tell it to stop. Each application that remembers passwords can turn that feature off.
If you need help remembering all your passwords (and who doesn’t?), there is an app that will remember your passwords for you and store them in a hard-to-crack form. It’s called RoboForm. Check it out.
Of course, the first thing you should have done is removed the malware. When your computer even starts to slow down, get rid of the malware.
2. “Try the Password”
If the bad guys aren’t already in your computer, there are ways they can break in.
People have this image in their heads that hacking your computer is like what they see on TV, be it Abby on NCIS or Angela on Bones or Kono on Hawaii Five-0, someone pouring over a keyboard typing.
Nope.
Computers hack your computer, not people. Hacking is automated.
Remember when you used to check the change slot in pay phones or coke machines when you were a kid? Every once in a while you got a nickel or a dime. So you kept doing it. Once, I got seven nickels! 
Or imagine walking through a parking lot trying to open the doors of all the parked cars. Almost all of them will be locked. But not all of them.
Today, you can program a computer to check thousands of computers per hour across the Internet to see if any of them have a door open. You can buy this software pre-written and customizable.
Let’s use the parking lot metaphor one more time.
Suppose you’re in a parking lot that has a whole bunch of cars and you have a truckload of car keys. You try all the keys in each door one at a time. Something will open up eventually.
And that’s how they got your password. They use a computer. They try a whole mess of keys. Eventually something opens up. You can buy that software too.
This kind of attack is called a “brute force” attack. The way to combat a brute force attack is to use a strong password. A strong password is hard to guess.
A strong password is also hard to de-crypt. See section #1 above.
Here’s one way to create a strong password.
Start with two sentences that are meaningful to you…
HI YO Silver, Away! The Lone Ranger Rides Again!
Turn the sentences into a string of letters. Use the first letter of each word.
HYSATLRRA
Mix upper and lower-case. Lower-case every other letter
hYsAtLrRa
Put a number that is meaningful to you between the sentences
hYsA69tLrRa
Put a punctuation mark at the beginning
!hYsA69tLrRa
Put another one at the end
!hYsA69tLrRa{
That’s a strong password.
3. “Listen to the Passwords”
Maybe they got your password when you were using a wireless network. Some wireless networks are easy to hack. I wrote about that almost four years ago here:
http://blog.comphelpco.com/?p=45
Since that time, coffee shops that used to make you pay for Wi-Fi are now letting you use it for free.
This is good for you, and bad for you.
The good part is you don’t have to pay to use their network.
The bad part is open wireless networks are, just that, open. Somebody with a clever piece of software on their laptop can sit two tables away from you and see whatever you’re watching on your laptop. All that, and drink a grandé caramel soy latté with low foam at the same time.
Here again, you can secure what you’re doing by taking two steps, one simple, one not.
A. The simple step: Ask them for the name of the wireless network where you are. They will know it. Connect to that one, and not to any other one that may be available. With network names, spelling is important. As I did four years ago, I went back to that coffee shop and scanned for available wireless networks. There were fourteen, and four of them were “open.” The four open ones were named:
1. Linksys
2. MASStarbucks
3. Starbuck-s
4. Open237D
Quick! Which one is the correct one? If you answered #2, you answered correctly. I have no idea what numbers 1 and 4 are about, but I will bet someone is watching all the traffic on Starbuck-s for anything interesting. Watching with a computer.
B. The not simple step: What you need to do is encrypt all your traffic when you’re connected to an open Wi-Fi network.
How to do that?
You want to be sure your browser uses a secure connection for each Web site you go to. Google mail and Yahoo mail already enforce this. AOL does not. Outlook does not. Others, I don’t know; some yes, some no.
You want to force Outlook and AOL and all the other Websites you visit to use a secure connection. This requires a few steps.
1. Replace the “http://” part of every Web address you visit with “https://”. The extra “s” stands for “secure.” This means you will have to edit your list of Favorites.
2. Get into the habit of typing “https://…” when you are typing a Web address into the Address Bar of your browser. It’s a simple enough thing to remember.
3. Get on the phone with your Internet Service Provider and ask them how you can connect to their email servers using a secure connection. They may already be doing this but you want to be sure.
If you use the Firefox browser, there is a Firefox add-on called HTTPS Everywhere that does the trick whenever you use it. However, it will not help with AOL, Outlook, or any browser other than Firefox. I predict someday this problem will be solved so you won’t have to worry about Wi-Fi connections, open or secure. But until then…
4. “Go Fish”
A very popular way for Joe Hacker to get your password is to send you a phish in an email and wait for you to follow the instructions. It will probably tell you to go to a familiar Web site. You try to log in, only to find out your password is invalid. You try a second or even a third time before concluding there’s something wrong with the Web site.
There isn’t anything wrong with their Web site, and now they have your username and password.
Here’s how to spot a phish:
http://blog.comphelpco.com/?p=63
Don’t go phishing.
Whew, a summary.
The reason your email or Facebook account was hacked was because someone stole your password. And the way they got your password was by:
· A phish
· A brute-force attack
· An open Wi-Fi connection, or
· Malware.
I’m sorry that this was so long. I’m like that. I’m from MIT.
