How to Join Member's Area Private Library Search Today's Topics p Login
Main Forums Discussion Tech Talk Mature Content Archives
   Nav Win
 Discussion
 pipTalk Lounge
 Internet Dangers
 1 2 3 4 5 6 7 8
Follow us on Facebook

 Moderated by: Ron   (Admins )

 
User Options
Format for Better Printing EMail to a Friend Not Available
Admin Print Send ECard
Passions in Poetry

Internet Dangers

 Post A Reply Post New Topic   Go to the Next Oldest/Previous Topic Return to Topic Page Go to the Next Newest Topic 
Ron
Administrator
Member Rara Avis
since 05-19-99
Posts 9708
Michigan, US


0 posted 01-29-2000 06:29 PM       View Profile for Ron   Email Ron   Edit/Delete Message      Find Poems   Click to visit Ron's Home Page   View IP for Ron

Recent threats made in OP have, apparently, made a few people concerned about security on the Internet. Last night, I received an email (circuitously) from one of our Members detailing what her fairly knowledgeable boyfriend thought were possible ways a troublemaker could attack our forum and those who post here. With her permission, I've decided to post my answers to her list in hopes it would both alleviate some of those concerns and, more importantly, provide everyone with some simple precautions all Internet users should take regardless of threats.

>The primary things are:
>
>1 - The software being used to develop Passions - various options (ie
>passwords, entry etc.) are available from the net and thusly...
>
>2 - There are already hacks for the software (and IP masking/camoflage)
>that are easily available on most hack sites (not necessarily the same version
>but you get the point). Thus anyone with access to these and a "creative"
>mind can cause some real trouble for both Ron and anyone he wishes.

Yes, there are hacks of the UBB software available. While of possible educational value, they are otherwise useless unless an individual can gain direct access to our web server. Even intimate knowledge of the software does no good unless our software can be reached, modified, or replaced. Even the possible educational value is dubious - because our version of the UBB has been so heavily modified I doubt the original author would recognize it.

As for IP spoofing, it's a technique used to gain unauthorized access to computers, whereby the intruder sends messages with an IP address indicating that the message is coming from a trusted port. To engage in IP spoofing, a hacker must first use a variety of techniques to find an IP address of a trusted port and then modify the packet headers so that it appears that the packets are coming from that port. In the US, IP spoofing is a Federal crime and, more importantly, it ain't easy. Here's an article that describes in nauseating detail exactly how to perform spoofing: IP Spoofing.

Why would I post an URL to such potentially devastating information? Two reasons. One, once you've read it you'll see it requires a bit more technical acumen than is commonly found. Two, it would be absolutely useless in attacking our server.     Ceres, our web server, has no trusted ports. She doesn't identify me by IP number, but rather by password. Unless you can guess my password, you ain't getting in. And, believe me, the password - a long string of random letters and numbers - is not guessable.

>3 - Everyone probably accepts every single cookie when is comes without
>inspecting it - here, the virus scanner doesn't scan it probably (it's
>Norton, but either way it doesn't inspect everything)

A virus is a program. It requires three things: a computer language sophisticated enough to control a computer, access to the computer, and the ability to execute.

Access to the computer is gained when you download a program. Execution is only gained when you actually run the program. In other words, I could download viruses all day long, but nothing will happen to my computer until I run one. Only then does the virus gain control and go about its nasty little tasks.

Historically, viruses are written in C or C++, though a few famous ones were hand-coded in assembler. Those computer languages are powerful and can result in programs that have FULL control of a computer. More recently, the macro languages behind many software applications have become powerful enough to support viruses. Microsoft, as the primary example, now embeds a subset of Visual Basic (VB) into many applications - including Excel, Word, and Outlook. While not nearly as powerful as C, VB can produce programs powerful enough to cause serious damage to a computer. They can format your hard disk.

Besides being so ubiquitous, the real danger to VB viruses is the fact they blur the line about "running" a program. What we once thought of as "data," like a word processing or spreadsheet document, can now contain powerful macros that run the instant you "open" the document. So, in just the last year or two, looking at a poem written in MS Word can now activate a virus - even though you theoretically didn't run a program downloaded off the Internet. Fortunately, newer versions of Word and Excel allow you to turn off all auto-run macros, meaning you can again look at the data without worrying about a macro-program-virus running by doing so.

Unfortunately, not everyone is aware of either the danger or the precautions. The worst offender is MS Outlook: It contains a "Preview" feature that can automatically preview an attachment the minute it comes into your email box. To do that, however, Outlook must "open" the document, which obviously has the potential to "run" any macro-viruses it contains. For more information about the virus that originally exposed this Outlook weakness - and for steps to prevent it from happening to you - take a look at this article: Bubble Boy Virus

A cookie on the Internet is a very tiny piece of data. It's not a program. It can not contain a virus. The only ones that can give you a cookie are web servers - not other users on the Internet. If you'd like to see what cookies our software passes to you, you'll find a link in the Members area, off the "Preferences" screen, that will list each of the cookies used by our software. As you'll easily see, they are nothing more than bits of data. While not pertinent to viruses, it's also important to realize that only you and our web server are able to examine your cookies. All of the browsers are specifically instructed to return a cookie only to the domain that originally gave it. That's why, when we moved to the new server, everyone lost their cookies from the old forums. The new server was completely unable to access cookies from another server - even though it would have made all our lives easier.

Java and Javascript are both languages designed specifically for the Internet and, again, passed to you by web servers (not other users). As languages, one might think they have the potential to contain viruses. But, because they were designed for the Internet, that potential has been purposely disabled. Neither of those languages have the ability to write to your hard disk, let alone format it. Poorly written Java and Javascript programs can badly disrupt your Internet experience, can even "lock up" your machine - but can in no way gain control of your computer. ActiveX controls (from Microsoft) do have more control and "could" possibly contain a virus. Our forum software uses Javascript, mostly to pass cookies but also to enter your Username and Password into the forms. We may one day use Java, if we find a good chat program, but will never use ActiveX controls.

In summary, the only way to get a virus from our forums is for another Member to email you one as an attachment to regular mail. You should never "open" such an attachment without taking the proper precautions.

>4 - E-mail bombing is incredibly easy via Hotmail and other "free" e-mail
>servers. Also, it is possible to trace IP addresses and determine people's
>locations precisely (by accesssing Windows 9x user information direct
>online - it has happened to me!!!).

The term Email bombing simply refers to excessive, unwanted email. It can be darn irritating to receive dozens or even hundreds of identical email from the same individual. It's a waste of shared Internet resources and it's harassment. In severe instances, when thousands and thousands of messages are sent very quickly, it can even crash your email server and possibly get you booted from your ISP. The latter case, however, requires both programming experience and access to an Internet mail server and is fairly rare. It's becoming even more rare since the US Government classified it as a form of domestic terrorism and subjected such individuals to Federal prosecution.

Less extreme examples of email bombing can, indeed, be done using Hotmail and other such services. All it takes is a lot of time, patience, and prodigious use of the Back button. The good news is that it takes the sender a WHOLE LOT more effort to send than for you and I to delete. A complaint sent to the free mail service will usually result in a complaint to the sender's originating ISP - and they will be the ones looking for a new ISP very shortly.

As for IP numbers, yes, they can be traced. When "Soup 81" sent an AOL instant message to Columbine sophomore Erin Walton, saying he was going to "finish what begun," the FBI was able to trace the IP directly to 18-year-old Michael Campbell in Florida. And it only took them about 48 hours.

Fortunately, most people don't have the resources of the FBI, and IP numbers cannot be easily traced to specific individuals or even geographical locations. The exception to the latter can, however, occur if your ISP is a local one. Give me an IP and I can tell you in 30 seconds who owns it - i.e., who the originating ISP is. You can do the same thing by going to http://arin.net/whois/index.html  and entering an IP number. If the ISP is a local ISP, obviously I can surmise the user resides in the same GENERAL geographic location. A few of the larger ISPs (but not AOL) also use different IP blocks in different parts of the nation - so, again, with the proper information, a GENERAL geographic area might be determined. But except in rare instances (usually involving a business that owns their own IP block), only the proper authorities can track an IP to an individual.

>5 - Not everyone is in the know - people can open e-mail attachments that
>aren't stored as an "attachment" (ie included via binary encryption inside
>the document) which when opened can also cause some nasty damage to files
> on hard disk which not every virus scanner is equipped to prevent.

Agreed - not everyone is in the know, and the best protection is always knowledge! The general advice is to never open attachments except from people you trust. Personally, I don't think that's good enough. An email attachment is like sex in at least one respect - you aren't trusting just one person, but all the other people that person trusted in the past, creating a chain that can include hundreds of thousands of individuals. USE PROTECTION!

As for including a "binary encryption" within a plain-text email message, that is indeed possible. However, just as with downloading virus programs, nothing will happen. Remember - one of the three criteria includes execution of the program and there is no way to execute plain-text email. It just looks like garbage on your screen (which it is). The only possible exception to this (and I know of no known instances) would be email sent as an HTML document. Theoretically, an HTML email message "could" contain anything a web page can contain, including ActiveX controls. The answer is to simply turn of HTML encoding within with your email program, though honestly, I doubt it's even worth the trouble.

In Summary Participation on the Internet will never be 100 percent safe. I'm not entirely unaware of the dangers, and I think I've taken reasonable precautions to protect us, but there are certainly no guarantees. You should be careful about viruses, but your best protection is simply to insure you have backups of valuable data. Just in case. If someone successfully attacks our web server, the worst that's going to happen is we'll be down for several hours while I restore the system and we could potentially lose about 24 hours worth of posts. If you backup your data regularly, you can enjoy the Internet with equal confidence.

As for the specific threats recently made, perhaps our best protection lies in a very simple truth: Bigots, almost by definition, are notoriously stupid people.    
Isis
Member Ascendant
since 09-06-99
Posts 6390
Sunny Queensland


1 posted 01-29-2000 06:50 PM       View Profile for Isis   Email Isis   Edit/Delete Message      Find Poems   Click to visit Isis's Home Page   View IP for Isis

Yes Ron they are stupid and it seems they have nothing better to do with their time.
Thanks for the info, I'm sure it will put some minds to rest.

 Let your heart guide you. It whispers, so listen closely.
~Isis~
(Sovereign of the Spirit)


Munda
Member Elite
since 10-08-1999
Posts 3629
The Hague, The Netherlands


2 posted 01-29-2000 08:09 PM       View Profile for Munda   Email Munda   Edit/Delete Message      Find Poems   Click to visit Munda's Home Page   View IP for Munda

Hmm, that was a long read, but well worth it   Thanks for the information Ron.

[This message has been edited by Munda (edited 01-29-2000).]
RainbowGirl
Member Elite
since 07-31-99
Posts 3167
United Kingdom


3 posted 01-29-2000 09:54 PM       View Profile for RainbowGirl   Email RainbowGirl   Edit/Delete Message      Find Poems   Click to visit RainbowGirl's Home Page   View IP for RainbowGirl

Ron: Nicely laid out, informative and good for the layman.. )

I had some cute email last night: one with the subject of Goodbye and a cute smiling face from PIP, namely icon No.3 and another called Seeya that simply said "Boo"....neither had the intended affect but did make me smile..

HUGS

 Memories give you the power to collect roses in the winter...
WhtDove
Member Rara Avis
since 07-22-99
Posts 9561
Illinois


4 posted 01-30-2000 12:06 AM       View Profile for WhtDove   Email WhtDove   Edit/Delete Message      Find Poems   Click to visit WhtDove's Home Page   View IP for WhtDove

Thank you Ron for taking the time to tell us all this. Very informative!  I have one question though about this....Also, it is possible to trace IP addresses and determine people's locations precisely (by accesssing Windows 9x user information direct
online - it has happened to me!!!).

Is this accessing the windows or the IP?  And is there anyway to protect yourself from that?
Sunshine
Administrator
Member Caelestus
since 06-25-99
Posts 67715
Listening to every heart


5 posted 01-30-2000 10:11 AM       View Profile for Sunshine   Email Sunshine   Edit/Delete Message      Find Poems   Click to visit Sunshine's Home Page   View IP for Sunshine

Ron, I for one [and several others will, once they get here to read this] feel very fortunate [once again] to know that the "Webmaster" is there, protecting all, sharing  knowledge, and taking care of the poets.  Thank you.
Alicat
Member Elite
since 05-23-99
Posts 4277
Coastal Texas


6 posted 01-30-2000 10:28 AM       View Profile for Alicat   Email Alicat   Edit/Delete Message      Find Poems  View IP for Alicat

Ron, I heartily thank you for providing this information for the rest of us without your vast knowledge and experience with computer systems and languages.  This is just another reason why I call Passions my internet home away from home...you, as our beloved Webmaster/Passionate Guru, are almost always accessible to us, and always respond in some fashion to our questions and fears.  Thank you for providing such.  

Alicat
Marge Tindal
Deputy Moderator 5 ToursDeputy Moderator 1 TourDeputy Moderator 1 TourDeputy Moderator 1 Tour
Member Empyrean
since 11-06-1999
Posts 43042
Florida's Foreverly Shores


7 posted 01-30-2000 10:05 PM       View Profile for Marge Tindal   Email Marge Tindal   Edit/Delete Message      Find Poems   Click to visit Marge Tindal's Home Page   View IP for Marge Tindal

Ron-
I trust you know how much I appreciate all the work it took for you to do this explanation.  
It is very informative.

I'm just sorry it was/is necessary.

I enjoy the fact that you can maintain a great sense of humor in the face of what you've been through lately.

Please know that you are appreciated.
~*Marge*~


 ~*The pen of the poet never runs out of ink, as long as we breathe.*~
noles1@totcon.com

Pepper
Member Elite
since 08-19-99
Posts 3134
Southern Florida

Official Passions Reader
8 posted 02-02-2000 03:10 PM       View Profile for Pepper   Email Pepper   Edit/Delete Message      Find Poems  View IP for Pepper

Yes, very appreciated Ron....
Thank you..
 
 Post A Reply Post New Topic   Go to the Next Oldest/Previous Topic Return to Topic Page Go to the Next Newest Topic 
All times are ET (US) Top
  User Options
>> Discussion >> pipTalk Lounge >> Internet Dangers Format for Better Printing EMail to a Friend Not Available
Print Send ECard

 

pipTalk Home Page | Main Poetry Forums

How to Join | Member's Area / Help | Private Library | Search | Contact Us | Today's Topics | Login
Discussion | Tech Talk | Archives | Sanctuary



© Passions in Poetry and netpoets.com 1998-2013
All Poetry and Prose is copyrighted by the individual authors