Interesting little AIM attack...

[wnied]

For all those running Aol Instant Messenger...

I had something happen to me tonight, while talking with my idiot cousin on AIM, who didnt bother to use Anti virus protection on his machine. As we chatted, I got a little message display that asked me if I wanted an AIM member name Mr.X to be allowed to browse my files. Now I have manually setup my preferences on AIM, so that the program asks me permission to run any request or transfer anything in the background of my conversation. I dont allow buddy icons, or file transfers or talk requests, or any other file for that matter to travel through this program and have access to my machine. This screen name wasnt recognizeable by me so I didnt allow it. Then it got me thinking to check over all my preferences to be sure there werent any other back doors it could worm its way through. At about 12:30am tonight my aunt called me to tell me a couple of creditcards she used online were being used for nefarious purchases. I remembered the little AIM incident and began to put 1 and 1 together. Her son, my cousin is a complete idiot. He's well known for using her computer to chat in AOL chatrooms. Hes gotten hacked once before this time. I reset my aunts machine with a clean install that time and redid all her software. I included Norton Anti-Virus 2001. Set it to automatically update once a week. When I asked her about her Anti-virus being upto date she admitted disabling it because shes on 56k and "it takes too damned long to download." Well recently she went on a trip to georgia to visit my non-idiot cousin and his new baby. She used her creditcard online at Priceline.com and checked her bank statement online before her trip. I told her to not get online, call her creditcard companies, tell them she'd had her Creditcard #'s stolen and afterward report it to the police tomorrow. I pass this incident onto you guys to warn you to recheck your preferences in AIM.

And to be wary of any idiot family members who scoff at anti-virus.
~wnied~

 

[Krugger]

i highly doubt that's how her credit numbers were stolen. i've never heard of that. AIM sets up a default directory to share your files from and someone would have to change it to share the entire diskdrive and share to everyone, for that attack to work. more likely someone hacked a website that she had used her credit card at, that happens all the time. i'd love to hear more if it it's discovered who did it, but i highly suggest going over her previous transactions and contacting the websites to see if they've had any attacks.
-----Krugger

 

[Valhalla1]

i gave up reading your post after 1.5 lines... spread your post out more, one big paragraph is hard to read

 

[bugsysiegel]

ouch, hope she has cards which don't hold her responsible for those charges. good luck!

 

[wnied]

i gave up reading your post after 1.5 lines... spread your post out more, one big paragraph is hard to read

Sorry, but I don't cater to the lazy. Read it or not, no skin off my back eitherway.


i highly doubt that's how her credit numbers were stolen. i've never heard of that. AIM sets up a default directory to share your files from and someone would have to change it to share the entire diskdrive and share to everyone, for that attack to work. more likely someone hacked a website that she had used her credit card at, that happens all the time. i'd love to hear more if it it's discovered who did it, but i highly suggest going over her previous transactions and contacting the websites to see if they've had any attacks.

She used Priceline.com to get her tickets to goto Georgia that weekend, but the creditcard #s had been used a couple weeks before that. I looked over the machine and found a Sub7 renamed to pass through her firewall. You are right krugger about the default directory, but what you failed to realize was that this was a directory on my aunts machine which allowed the perpetrator to upload and open a backdoor trojan on her machine which then gave him complete access to her computer remotely. Sub7 is just like having PCAnywhere on your PC, allowing someone with permission to act as though they were sitting at your computer with you. Her computers since been cleaned, the police alerted and the credit card companies are watching where the merchandise ordered is going. Hopefully they'll catch the jerkoffs who did this and chuck them into the can for awhile. But more likey is that they'll get away with it or come away with a slap on the wrist.

~wnied~

 

[NikPreviousAcct]

Originally posted by: wnied
Sorry, but I don't cater to the lazy. Read it or not, no skin off my back eitherway.

Do you cater to proper grammar or common courtesy??

nik

 

[Ameesh]

i dont use virus protection at home, we just use a firewall so it block almost all in coming traffic. it works fine.

 

[Valhalla1]

oh so now you're name calling... you want people to help I suggest not being an asshole

 

[Hossenfeffer]

Originally posted by: Ameesh
i dont use virus protection at home, we just use a firewall so it block almost all in coming traffic. it works fine.

Famous last words

 

[GoSharks]

Originally posted by: Hossenfeffer

Originally posted by: Ameesh
i dont use virus protection at home, we just use a firewall so it block almost all in coming traffic. it works fine.

Famous last words

that will help against hackers, but it wont help against viruses from emails and whatnot.

of course that is also my only defense, but in the 10+ years of using comps at home, i dont belive that we have ever gotten a virus