The most serious online breach I've seen, it's honestly worth checking if you're in it

[voipio]

Ah thanks for the explanation. It was actually a bit upsetting, taking the time to write that up to help protect a community, and to be then accused of being a scammer

Anyway, this account not hacked, this is me. But yes I was in the data breach I've written up and also recently I noticed my son somehow managed to install a PUP (less malicious than a virus) despite only having a child account on the PC, so I'm on on edge and trying to ramp up security.

The wording of the thread title rang alarm bells, as it bore similarities to some of the email subject lines I've received from spammers, and had a clickbait-like feel to it. The original posting also read a bit like like AI-generated text.

It wouldn't be the first time a forum account has been hacked.

Please don't get upset. The internet, as you well know, can be a bit like the Wild West at times. I tend to be quite wary of things on the web, even on a well respected forum like this one.

 

[bump]

I don't normally post stuff like this, but the ALIEN TXTBASE Stealer Logs breach is the first one that's scared me.

I've used the internet extensively since the early days, using all sorts of tech for personal interest and for my work. I am a tech nut. As a result of my prolific internet use I've been in a lot of breaches. Every breach I've been involved in so far has involved single services (eg Netflix) and therefore only a limited set of low value credentials have been stolen. This breach is different as it's accessed the browsers password vault, and uncovered all of the victims passwords.

If you're concerned, go to https://haveibeenpwned.com, enter your email, and check if you've been exploited by ALIEN TXTBASE Stealer Logs.

Below is a provisional list of things I'd do. If anyone has other suggestions, please comment.

- Check that a reputable Anti Virus is working on all machines (Windows built in AV was once considered low quality, apparently its better now, BitDefender apparently still the safest suite)
- Run full manual scan
- If machine has had dodgy/suspicious software installed over a period of time then consider reformatting
- Review all the websites, services, and accounts you access/own that are of high value and ensure multi factor authentication is enabled
- Monitor your email inbox and spam box for notifications of suspicious access to any of your accounts
- Ensure you monitor any old email addresses as well, and that your family does the same
- Sign yourself and your family up to the haveibeenpwned.com service to be alerted of future breaches containing your data. I think this service is also built into some anti virus solutions.
- If you have kids or less tech savvy users ensure they have a non admin account on your machine and AV is enabled
- Sign up with credit reporting agency and regularly check for any accounts that have been opened in your name and any searches done against you. I use Clearscore as it's free, it accesses one of the major agencies.
- Keep everything up to date, including your anti virus, firewall, operating system, browser.

Disclaimer: I do high level business technology designs which isn't a security role, and is basically a fancy way of saying my designs lack any detail. Although I've risen through the ranks and done many tech roles I am not specifically a security specialist. The info I provide here could be wrong. The list I've compiled is from my point of view, as a dad who's kids use the PCs, who has old machines, but has used unique passwords for a long time now. Other types of users may have other things they should consider doing.

Good advice. I would add to it to use multi factor authentication that isn't SMS based. I recommend Authy as an app version and Yubikeys for hardware (these were also recommended in my previous Gov Tech role).

Use a password manager and use unique autogenerated passwords for each site. Bitwarden is a pretty good choice here, KeePass is great if you are a bit more nerdy and have ways of managing synchronisation between devices already.

 

[roofman]

My main email must get 5 to 8 spams aday pretending to be my home fuel supplier and even my virgin media...never had any problems up to about 18 months ago when screwfix, halfords, and toolstation got my email ...mad at myself because normally i am a bit more savvy over this stuff and should of gave them a hotmail account instead.

 

[rcx132]

Good advice. I would add to it to use multi factor authentication that isn't SMS based. I recommend Authy as an app version and Yubikeys for hardware (these were also recommended in my previous Gov Tech role).

Use a password manager and use unique autogenerated passwords for each site. Bitwarden is a pretty good choice here, KeePass is great if you are a bit more nerdy and have ways of managing synchronisation between devices already.

We've been told at work to stop using SMS authentication in our designs as it's not secure. It's still much better than just a password though.

I think most people with a little effort can use Keepass. Just save the database file to OneDrive or Google Drive so it syncs across your machines. Hackers and viruses will more likely target browser password vaults or cloud solutions like Lastpass because (a) more people use them (b) likely less secure and (c) they know where the database is, whereas Keepass database can be anywhere.

 

[jmp49]

Smishing and sim swapping attacks are too common for SMS to be considered secure and it scares me how many people were blindling trusting devices that could be affected like this for so long & pretending it was secure for banking level stuff with banks etc replacing hardware 2fa tokens with a sms based solution, but even the yubikeys had a flaw in their onboard crypto routines library which meant you had to replace them to fix it. But the attack required that a attacker had physical access to the key to take it apart and modify it with specialist kit and if they wanted to go unnoticed and return the key to the unsuspecting user, it had to have a new case moulded on after, so the barrier to exploit sucess was pretty high. I haven't lost sleep over it personally as I have the mitigations in place prior to it becoming known & I'm not that valuable a target.

Security Advisory YSA-2024-03

Security Advisory YSA-2024-03 Infineon ECDSA Private Key Recovery Published Date: 2024-09-03Tracking IDs: YSA-2024-03CVE: In ProcessCVSS Severity: 4.9 Summary A vulnerability was discovered in Infineon’s cryptographic library, which is utilized in YubiKey 5 Series, and Security Key Series with...

www.yubico.com

Keepass and KeepassXC are not one and the same btw, having to run mono under linux put me off the former and sets its security stance, security storage software but it pulls in a mess of 3rd party microsoft libs into linux before it will work. You might be interested in this blogpost the XC people put out a few years ago on the memory leakage stuff. https://keepassxc.org/blog/2019-02-21-memory-security/

Also of note, https://app.opencve.io/cve/?product=keepass&vendor=keepass vs https://app.opencve.io/cve/?product=keepassxc&vendor=keepassxc

 

[Nomad]

Thanks OP for the info / reminder, I've checked the Have I Been.. website in the past but not for a few years ... checking it now shows most of my "main" email addresses appear on hacked lists. The only ones that don't are my business email and my "throw-away" accounts.



For info, I have a free account at Mail.com and it's great for me.
It lets you create extra accounts with lots of "fun" @****.co.uk extensions and you can access them all with just 1 login - they appear as linked accounts.
It suits me well, might be useful for you? It also makes it easy to create "throw-away" email addresses (handy for the websites where you need to enter your email address before you can use the website). If you start to get lots of junk emails & spam just close that email address and create a new one

 

[rcx132]

Thanks OP for the info / reminder, I've checked the Have I Been.. website in the past but not for a few years ... checking it now shows most of my "main" email addresses appear on hacked lists. The only ones that don't are my business email and my "throw-away" accounts.



For info, I have a free account at Mail.com and it's great for me.
It lets you create extra accounts with lots of "fun" @****.co.uk extensions and you can access them all with just 1 login - they appear as linked accounts.
It suits me well, might be useful for you? It also makes it easy to create "throw-away" email addresses (handy for the websites where you need to enter your email address before you can use the website). If you start to get lots of junk emails & spam just close that email address and create a new one

Most of incidents on haveibeenpwned.com are the websites we use getting hacked, and not your machine, so check before you stress. I don't think websites being hacked is a huge deal for the individuals so long as you use unique passwords and sensitive accounts use MFA and other safeguards.

I do use throw away accounts, I have a domain, and all-email-address@my-domain.com forward to my mailbox.

 

[Dragnet]

Plus addressing is handy, too. Easy to spam-filter. Simply sign up with your normal e-mail address but add an identifier before the "@" symbol introduced with a "+". E.g. myemailaddress+migweldingforum@gmail.com. As far as the e-mail servers are concerned, anything after the + is ignored, so it gets delivered to myemailaddress@gmail.com. In your e-mail client you can set a rule to filter a specific plus-address if it becomes spammed. I think it unlikely a bot harvesting system bothers to strip any plus addressing so can happily brute-force the address as much as it likes but it would still only be associated with the login for one website.

Delightfully, I have yet to be pwned.

I use Keepass portable in a Dropbox so I can access it elsewhere, with Keepass generating all the bonkers passwords. I did start to look into two-factor authentication like Yubikeys (I dislike mobiles so have no desire to be constantly pinged with texts or fingerprint authentication requests) but was quickly overwhelmed by the jargon and different options available. If anyone has a link to an idiot's guide to hardware authentication I'd like to read it.

 

[rcx132]

Plus addressing is handy, too. Easy to spam-filter. Simply sign up with your normal e-mail address but add an identifier before the "@" symbol introduced with a "+". E.g. myemailaddress+migweldingforum@gmail.com. As far as the e-mail servers are concerned, anything after the + is ignored, so it gets delivered to myemailaddress@gmail.com. In your e-mail client you can set a rule to filter a specific plus-address if it becomes spammed. I think it unlikely a bot harvesting system bothers to strip any plus addressing so can happily brute-force the address as much as it likes but it would still only be associated with the login for one website.

Delightfully, I have yet to be pwned.

I use Keepass portable in a Dropbox so I can access it elsewhere, with Keepass generating all the bonkers passwords. I did start to look into two-factor authentication like Yubikeys (I dislike mobiles so have no desire to be constantly pinged with texts or fingerprint authentication requests) but was quickly overwhelmed by the jargon and different options available. If anyone has a link to an idiot's guide to hardware authentication I'd like to read it.

I'm not keen on carrying a hardware key yet, but apparently KeepassXC can be set to use phone as a second MFA kinda device in addition to master password. I'm willing to try this. The issue I'm facing at the moment is there's no secure way to move passwords from Chrome to KeepassXC without exporting to a plain text file !

I'm pleased this thread is drawing out some good security tips.

 

[ajlelectronics]

I'm pleased this thread is drawing out some good security tips.

I give everyone a unique address. That helps weed out the junk and is another layer of security.

 

[pint]

...along with having installed a webcam recorder on my main desktop to record my perverted activities. Which is impressive as I dont even have a webcam on it.

i had one of those emails, i also don't have a webcam and they massively over valued my dignity at $2000

 

[MysterG]

I have a notepad in my desk drawer with login details for various site written down.
I don't let browsers remember login details or keep them on a PC.

A couple of my addresses are on the list, passwords have all been changed (some multiple times) since the breach dates reported though.

 

[arther dailey]

Well , from my perspective , a totally non techie as far as this stuff goes ..Most of this goes completly over my head , all these differant names I know not what they are , you could all be from another planet ! as some will tell you I have enough trouble with grammar and punctutaion (there is a reason) but hey ho I do try and get the jist . And I think its good that as ever people on this forum that are knowledgable about a subject are more than willing to help others out and teach/share , many thanks as ever. stay safe .