am I being paranoid about malware?

[rfakhrai]

Recently, I've had a few security scares. Paypal was hijacked and I had to go through the arduous task of reclaiming my money. I've had spam e-mail sent out on my behalf. And I get some weird spam sometimes.

Usually I come to the forum to get or give help but I'd like some advice. I'm installing AVG on my machine right now. Am I overdoing it? I'm paranoid of the internet!

[GreyGeek]

Re: am I being paranoid about malware?

PayPal runs Linux and F5 Big-IP driven servers. I doubt that they were hacked, but you can be a victim of phishing or pharming. Phising is when you get an email asking you to verify your account name and password, or some such stuff. The email looks official. MOST of the links point to paypal, but the important one, the one taking you to the "paypal" login screen, is different. IF you went to that phony link and entered your name and password you probably got a nice "Thank you, your account has been confirmed", or some such nonsense .... and ... YOU were conned. A pharming attack isn't your fault. It is an attack where the hacker replaces the Paypal IP address with his IP address on a regional domain name server. When it is updated from one of the 13 main servers the hacker's IP is overwritten and lost. But, he can replace it if the subdomain servers are not secured properly. With pharming you log in with your name and password to a "paypal" web page that is a carbon copy of the real one. Even the IP address is correct. Your name and password is collected, and the hacker site passes you seamlessly off to Paypal's secondary page. You'll never know your name and password were stolen until your paypal account money disappears. A pharming attack works against ALL OS's and all browsers.

AVG won't hurt, but it probably won't help, either.

How do you know that the spammed email is coming from your box, a reject or "reply" with headers saying it came from you? It was spoofed. Your're supposed to click on some link in the body to see what they are doing. Your FireFox will probably warn you that the website is a forgery.

[Ole Juul]

Re: am I being paranoid about malware?

Am I overdoing it? I'm paranoid of the internet!

That's really hard to say. I tend to take a bit of a relaxed attitude until I see something suspicious and then I start look under every rock. I certainly know how you feel.

I suspect that the Paypal problem had nothing to do with your computer. The e-mail in your name is a common trick and is related to your server and not your computer. Play around with telnet and you'll see how it's done. Who is your e-mail provider? If it's something like Yahoo, then I suggest you move to some more responsible company - they're the worst from what I can see. I use the mail servers from my webhosting provider and I haven't had more than one (possibly two) spams in the last 3 years. Hosting companies tend to be more professional because the want your business, whereas Yahoo doesn't care because they're - well, Yahoos. That said; I've heard that G-mail is very professional.

[rfakhrai]

Re: am I being paranoid about malware?

Thinking back on it, I can't really blame the linux box for any of those security issues. The spam e-mail was sent from my university gmail account so the server security as a whole could've been undermined.

The paypal problem was a bit of a shock because I never click any link in a suspicious e-mail. Perhaps it was the pharming that you were talking about, GG.

At the end of the day, I'd like to have a more robust sense of security. After fiddling around with AVG, I'm no more confident in its ability to provide that. So! I guess we soldier on, comforted by the knowledge that at least we're not using windows.

[oshunluvr]

Re: am I being paranoid about malware?

My provider email address (verizon) is so full of spam and crap I don't even use it. Yahoo is worse. My sister got a virus on her windows laptop that apparently supplies some spammer with all her email addresses. I now block everything from yahoo and never even check my verizon account.

Seems to me that any ISP could offer you the ability to block domains and/or locations like the entire African continent. They clearly want spam to persist.

The really amusing sites are those that have the "You're Infected" warnings. Why aren't spam and willful spreading of virus's illegal

[GreyGeek]

Re: am I being paranoid about malware?

.....
The paypal problem was a bit of a shock because I never click any link in a suspicious e-mail. Perhaps it was the pharming that you were talking about, GG.
...

For financial accounts it is a good idea to regularly change the password. I'd do that now on your PalPal account and use a randomly generated 8 char or more key. You can keep it in a hidden file under the root account, owned by root with the group set to root. When you need it use
sudo cat /root/.hiddenfile
to expose it and then copy and paste it into your account passwd text box. Close your konsole.

[oshunluvr]

Re: am I being paranoid about malware?

Or you could go the old fashioned way - post-it note on the monitor edge!