What Hackers Know That You Don't - Part One
Windows All Versions

This is not a tip to teach you to be a hacker. This is a tip to make you aware of things you might not know - but hackers do. The more you know what lurks out there on the Web the less you'll be afraid of the boogeyman. Sometimes the bogeymen you imagine skulking around the in the dark are pathetic creatures when exposed to the light of day. Our goal is to shine the light on these "bogeymen" so you can see what you're up against. Knowledge is always your best weapon.

Let's cover three things that hackers know that you probably don't. We'll show you a couple tools hackers use, and we'll show you where they get them. Please don't download these kinds of programs. They are very difficult to use. Besides that, we have not checked them and we don't know if they are full of badware, malware or spyware. The only goal of this tip is to let you know that there are things out there you probably never knew existed. And you can will see as your read more of this article that there are some pretty nasty stuff floating around on the Web. But then again, if you read the news, there has always been some pretty nasty stuff floating around in the real world too. It's nothing new. But the odds are in your favor, you are very unlikely to ever see the cyber-bogeyman.

Hac/king Web Sites
There's a tool called ObiWan. It is a password-stealer. It is used to crack passwords of password-protected sites and servers. That means that all of us who have Web sites are vulnerable to this sort of software. Many Web sites are hacked every day. But you may never hear about them because they are not the popular sites you probably know.  Sites get hacked all the time - and every once in awhile it happens to a very popular site, like the Super Bowl site last January.

Hackers use tools like ObiWan to crack sites. Then, they can, if they wish compromise the files on those sites. Then innocent folks like us come along and download something unexpected. A trojan perhaps. Maybe a virus. Maybe a tricky piece of spyware. That's why it's so important that you keep your anti-virus and anti-spyware up-to-date. It's also important that you have more than one anti-spyware program on your computer. And, it's a good rule of thumb to say away from off-the-wall sites which exist on the dark fringes of the Internet, such as por/n sites, gambling sites, known adware/spyware sites, and other not-so-nice sites. We cannot put a link to the ObiWan site in this newsletter simply because so many ISPs would probably censor this newsletter. If you really feel a need to learn more about it, do a Google Search for ObiWan password stealer (leave the forward slashes out, of course).

Harvesting Email Addresses Like Yours
Many of us get lots of sp*am. Sp*am has become so much a part of Internet life that we have come to take it for granted. We wish it wasn't that way. But, then again, we wish people wouldn't murder each other. We wish that peace on earth would become a reality. We wish that young children wouldn't ever have to go through a terminal illness. Wishing, unfortunately, doesn't do much good but prove that wishing doesn't do much to change the way things are. (Aren't you glad we go off on these philosophical tangents right in the middle of an article about Hac/king?)

If you've ever wondered how that infamous lot we refer to as "spamm/ers" get our email addresses so easily, we're going to tell you some software applications used by spa/mmers called "harvesters". We'll also touch on a couple other ways they get your email addresse(s).

A "Harvester" is a program that "spiders" Web sites looking for email addresses. Any email addresses it finds in those web sites it collects and stores them in a database. Among these addresses may be yours and mine. Some of you have personal Web sites. Did you know that when you include a link so people can contact you, your email address is vulnerable to harvesters? It is inevitable that an email harvester will come along at some point and "spider" your personal Web site or Web page and "harvest" your email address. You might sign a guest book and include your email address as part of your "comments". The Harvesters will get it. And entire Web sites can be "spidered" and email addresses gathered from them in a matter of seconds. Email addresses are all over the Web. On Web sites, on mail servers, on ISP hard drives. Harvesters can spider thousands of Web sites in a very short time and gather up every email address it finds.

One tool that is not specifically an email harvester, but has the harvester's capability of extracting all email addresses from Web sites, is called "Blackwidow". And there are dozens of others too. Blackwidow must be a very popular one, because many hackers and spa/mmers seems to recommend it. In fairness to the developers of "Blackwidow", the program was not meant to be used as a hac/king tool. Once you read more about it, you'll see why hackers love it.

Email addresses are bought and sold like any other commodity of value. Spammers make millions of dollars a year spa/mming people. And, furthermore, it's easy to do. Easy money is a very hard-to-resist lure for those willing to take the risk. While most sites, that require your email address to sign up for something, have strict policies about selling or sharing your email addresses, others such as spyware and adware makers do not. You don't think a spyware/adware maker really cares what you think, do you? They're already doing unethical things by using your computer as a billboard and extracting data from you, so why would you think they'd not make a ton of extra money by selling your email address or "sharing" it with others? If not spa/mmers they'll share it with their advertisers. And these advertisers then might share it with spa/mmers. Valid email addresses are worth a lot of money. One sure way of increasing your sp/am is to allow adware or spyware to reside on your computer. If you like sp*am, install a lot of adware and spyware. You'll have a feast of sp*am in a few months.

Here's another way your email address ends up in a spammers hands: Did you ever subscribe to a magazine where they ask for your email address, so you fill it in? Did you ever look closely at those sign-up postcards? Most don't have any privacy policies stated on the subscription postcard you fill out and send in. What do you think will happen with your email address in those cases? Well, one thing that could and probably will happen is that your email address will be sold to "email marketers".  Then these email marketers will sell lists of millions of email addresses (including yours and mine) they've purchased to sp*ammers. It might not be the primary company you give your email address too that will increase your sp/am, it will be the second and third line companies who buy addresses from the company you trusted with your email address. When sp*ammers buy lists of millions of valid email addresses, they sell these lists to other sp*ammers. And you know where this all ends. It ends with your inbox full of sp*am.

One important note: There are many fine companies that will not share your address or sell your address for any amount of money. They don't share their mailing lists with anyone. We have never shared our lists with anyone and we never will. Beware of the companies that say the won't share your email address with any third party without your permission. What constitutes permission is the catch. "Permission" when used in that way, can be anything. It's subjective. Beware of sites that say they won't share your address without your permission.

Virus Construction Kits

You can go to Home Depot and buy a kit and build a greenhouse or a storage barn. Kits are handy ways for those without all the skill necessary to build things from scratch, to build storage barns, greenhouses, etc. from kits.

But, would you be surprised to learn that there are sites out there selling (and giving away) Virus Construction Kits? Indeed there are. And, they're not hard to find. If you are a miscreant with some computer skills but not enough to build a virus/worm from the "ground up", a Virus Instruction Kit can help you build a virus or worm. After you've built your brand new virus or worm, and added your own personal "touches", they will even tell you how to disseminate it, so you can infect the largest number of computers in the least amount of time.

Here's a good explanation of Virus Construction Kits from Addison-Wesley:

"Virus writers continuously try to simplify the creation of virus code. Because most viruses were written in Assembly language, writing them remained out of reach for many kids. This inspired virus writers to create generators that can be used by just about anyone who can use a computer.

Virus construction kits evolved over the years as viruses targeted new platforms. Construction kits and virus mutators were built to generate a wide variety of malicious code, including DOS COM and EXE viruses; 16-bit Windows executable viruses; BATCH and Visual Basic Script viruses; Word, PowerPoint, and Excel viruses; mIRC worms; and so on. Recently, even PE virus code can be generated by such kits....." (Read more here.)

You'll be thrilled to know there are such things as Trojan Construction Kits too!

Knowledge Is Always Your Best First Line of Defense

We wrote this article, not to scare you, but to inform you. There are billions of computers connected to the Internet. The chances of your computer being singled out for attack is small. The chances go up dramatically if you install adware or spyware. Or if you visit the "wrong" kinds of sites (and you know what I mean). Or if you click links in emails and you aren't sure where the email came from.

Knowledge is a great thing. The more you know the safer you are. Still you need to keep a good anti-virus program installed and updated. You should make sure your anti-virus program is updated at least once a week. You should install at least two good anti-spyware programs. At least one of them should be commercial-grade like Spyware Doctor. Spyware Doctor can detect and remove most keyloggers. For a secondary anti-spyware program we recommend Spybot Search & Destroy which is free.

But more than any program you can use, and more important for your safety, is educating yourself and learning how the dark side thinks and how they operate. And that was the main thrust of this "tip".