Malware warning

vanzandt · Sep 7, 2020

qaz said:
Anyway there is a class of Malware that is not detectable by an antivirus scan. I will not elaborate further due to the lack of a solution available to the general public.
More...

Its called Windows 10.

Bugsy · Sep 7, 2020

Just an update I disputed the $700 transfer to Robinhood with my bank. They didn't lose any money and in fact I got on and sold the stocks with a $10 profit I didn't care about. Provided documentation of computer repair shop and emails to Robinhood prior to the stock purchases. Robinhood has no human contact and were extremely slow in replying with canned emails with no sound of any caring about the incident in any true customer representation. I kind of felt like they would try to just sit on my money for who knows how long if I let them conduct their "investigation" in their time frame. My bank had the money back in my bank account in 3 days from the time I filed the dispute and have unlinked that bank account. About to go look for a way to delete that Robinhood account entirely. I'm amazed anyone would utilize their brokerage services with such shit customer service or response.

Bugsy · Sep 7, 2020

Nobert said:
Hmnn, untrusted user then it was, the one who uploaded the file (?)

Noneless, hiden well
More...

Dude you spoke in Yoda words

Bugsy · Sep 8, 2020

Here was a recent one I just read about on Reddit:

TL/DR – Mass emailed, it was a cover-up to hide changes to my PayPal account. Could have lost tens of thousands of dollars.

This will be a fairly long story, but it relates to a scam I’ve never seen mentioned on here. A few months ago I had just finished my work at around 10 am when my phone notifications blew up. I looked and it said that I had approximately 100 new emails. This was certainly out of the ordinary. I immediately opened my email to check, and by the time I got in there, there were about 200 new emails. Over the course of the next few minutes, approximately 400 emails had poured into my inbox.

All of these emails seemed to be introduction emails to some sort of service or product – but all different. Never the same one twice. They were all mostly “Thanks for signing up for BLANK.” This would be the kind of email you get when you want to receive more information about a product or subscribe to an email list. None of the names were correct, and they were varied. Sometimes it would congratulate “Steve” for signing up for something, other times “Robert.” There or approximately 50 different names. At first, I simply thought that my email had gotten on to some list that blasted emails to various services hoping I would sign up for one. However, something really didn't seem right.

I decided I needed to go through my entire inbox and look for anything that seemed out of the ordinary. Since all these emails were not really legitimate, I started looking for anything that DID seem legit. Low and behold, about halfway through, I spotted an email from PayPal. I clicked on it, and it was indeed an email from PayPal letting me know that an authorized user had been added to my account. I hadn't logged into my PayPal that day (though I do use PayPal regularly for invoicing clients), so I knew this was not a change I made.

I immediately logged into PayPal, half expecting not to be able to log in at all. However, it did let me log in, but I could not see any suspicious purchases at all. I found the “Manage Users” section of my account and did see one authorized user. Here is the thing, the authorized user did not look suspicious. It was my name. Actually, it was my middle name, which is the name that I use for my PayPal business account. My PayPal is under my first name, but my clients see my middle name. I almost closed out thinking nothing was wrong, but something still didn't seem right. I hadn't added any authorized users.

The details are a bit fuzzy here because this was a few months ago, but from what I remember, the phone number for the authorized user was not mine. While they used my name, they had their number. Maybe it wasn’t their number, but I still knew I hadn’t made any changes. I immediately called PayPal and got through to customer service. They immediately agreed to put me through to their security team because they thought something was suspicious as well. The PayPal security team said that an IP address from somewhere in another part of the country logged into my account and just added an authorized user. While on the phone, the PayPal security team told me to delete the authorized user, change my password, and recommended enabling two-factor authentication.

From the moment I got all of the emails to the moment I was on the phone with PayPal security, the time frame was only 15 minutes. I think the scammer was going to play the long game on me, but because I took the time to look through all the emails and notice something was wrong, they never had the chance. My PayPal account balance hovers around $200 at any given moment, but it handles tens of thousands of dollars of transfers per month for my business. I always transfer this to my bank account quickly because…because PayPal. Had I not noticed something amiss, they could have waited until one of my larger invoices came through and drained me of my money.

Long story short, if you get blasted with hundreds of emails at once, look through every single one of them to see if something seems legitimate. All of those emails are probably a cover-up for something related to your finances.
More...

and one from a completely different user that also just happened, and also involving Paypal and their email account:

Hey all,

Just wanted to warn people because I received a VERY legit looking PayPal scam email.

The email looks like it was forwarded right from PayPal, and the website looks very legit as well. It has all the animations you would expect, the only reason I didn't fall for it was because it didn't take me to the right website the first time.

I work in IT security (granted I'm not as vigilant about checking emails as I should be) and it definitely would have been real enough to trick my tired ass this morning.

That is all, and if anyone recieved [sic] a suspicious PayPal email this morning and used the link they may want to change their password.
More...

pixel · Sep 22, 2020

Damn, that is too much. Thanks for the head up, man

Dmajirb · Sep 22, 2020

Been there buddy, such a maddening and paranoid feeling.
My story: Years prior I had set up my wife’s MacAir to be able to access our NAS b/c her drive was full. At some point she happened upon some malware despite using a Mac (assuming it was the fake Adobe Installer I found on her MacAir but who knows). Eventually our NAS became compromised with a persisted exploit that created a clandestine JVM for a backdoor RAT. Not only does our NAS store TBs of our most sensitive data, but it also sits at the most guarded center of our network with unfettered access to everything. Months pass and I am none the wiser, maybe our data was stolen maybe not. Suddenly one evening I get a very urgent email from EC2-Abuse (at) amazon.com informing me that I have a compromised EMR cluster in my AWS account that performing a massive DDoS against someone. Sure enough that was the case, my personal computer (MacBook Pro) had logged into the AWS cmd terminal and initiated a EMR cluster of largest size and was sending ~700 GBs/sec of trash at some poor system—costing me ~$500 in less than 15 minutes. After shutting down the cluster, changing my password, and resetting the router, I got another email from EC2-Abuse about 20 minutes later—it had happened again. Ended up ripping apart my AWS account, factory resetting my router, restoring all 5 macs at our house, and shutting off all power to our ~50 IoT smart home gadgets to be safe. But it happened a third time the next morning. Then I purchased top of the line (at the time) UniFi security gateway with a remote cloud key. I was able to see more details about traffic than previously with wireshark or tcpdump although was still obfuscated. Skipping even more craziness as I’m on mobile and this too long already, eventually an Apple update fixed all of our Macs and prevented them from being susceptible to sudden hijack, NAS drives were wiped and OS restored, all macs restored, etc. This was the only time I ever shorted AAPL as I thought ‘this is a big deal’, but in reality it was quietly fixed behind the scenes and many of those affected were likely unaware. Reminds me of the scene in Men In Black where Tommy Lee Jones tells Will Smith that the earth is always on the brink of destruction but the only way people carry on with their lives is that they do not know about it.
My Advice: Assume no privacy. Use end to end encryption if data is sensitive. 2FA always, even 3FA with a Yubikey. Password manager for everything. Update software always. Quality home network equipment—make sure to segment the shit out of your network to isolate your computer/NAS/workstation from those 20$ smart switches/outlets/bulbs/etc that were made in China and rushed to market without any thought for security. Finally, if your system ever does get compromised, don’t try to solve the mystery and surgically resolve—simply nuke everything from space, and then move on with your life.

HeSaidSheSaid · Oct 11, 2020

Technologies nowadays are cheap. get one laptop for your banking, trading, and business emailing, and save everything to a thumb drive, not on the local drive.
then get another laptop for your web browsing, facebook, twitter,... save everything to another thumb drive.

Farmas · Oct 12, 2020

Last month I caught a virus on my PC that corrupted a lot of files. But I managed to restore them with the help of Partition Recovery. After that, I back up my important files.

piezoe · Nov 17, 2020

Scataphagos said:
Even that's apparently possible these days... "Air gap"?
More...

just because something is in print is not a reason to turn off your brain.