Personal Information Breech on XP Network Computer

[Laura Parker]

Hello,

I am a USA citizen who has two friends in Iraq serving as contractor with the Department of Defense with KBR (Halliburton in Houston). I have been writing both friends by email to stay in touch. I had not heard from one of my friend for about 6 months until I recieved an email marked Urgent with my friend's email address. I of course opened the email.

The email was asking me for $3000.00 and requested that I send the money to London England by Western Union. My friend was claiming he was sent to London on official business and that his money was stolen out of his hotel room with his credit cards, plane ticket etc. and he had no way to get home to the USA. I thought this odd as he did not address me by name and that he did not address this need to his immediate family or to the USA military contractor employer.

I wrote back saying I did not have $3000.00 to send him and made suggestions for how he might solve his dilemma. I suggested: USA military contractor contact; British army; Churches and Traveler's aid.

My friend wrote me back and stated the situation is totally bogus and that someone stole his email address and all his personal information. He stated he got an email that looked official claiming that unless he verified his password and birthday his IP address would be cancelled because it was not in use. You can probably guess, my friend replied and breeched his own security.

My friend can be forgiven because he stated it took him about 5 hours to figure this out due to the fact that he is now in the states on medical leave due to undergoing chemo-therapy and he has been really drugged up.

However, it now appears that someone had enough information on him to attempt this scam to know he has not used his IP address. My friend claims he has blocked this intruder from his computer system.

In the mean time, I have an XP computer that is connected to a network. This individual has my email address that of course came from my friend's computer. I checked my MCAfee's security (I also have AOL) and there was a place that listed what I would allow under personal information.

It would appear that someone changed the box to allow personal information to be shared. I changed it to not allow it to be shared due to my fear that this may have been changed electronically. How much control could this intruder have over my computer is my question and what can I do about it?.

Also, could KBR Halliburton (Dept. of Defense) computers be affected?. My friend states that his original message came from Washington D.C. but when I was written, this intruder wanted me to send money to London. The other issue is that my XP computer network is connected to my husband's company as my husband works for Florida Power and Light.

All software is of course licensed under this network. My husband has remote control to his company from home. While I do not use my husband's remote control to his company, I am wondering if any of this could affect his company's security and well as my own personal XP computer?.

Please advise.

Laura Parker

[SecTrainer]

It would be necessary to examine the specific headers in the email(s) in question at the very least to begin to understand what has happened in that regard. With respect to the other networks that your system is linked in with, it would be necessary perform even more extensive computer forensics to know exactly what has been compromised.

Having said that, this would not be the sort of system compromise that antivirus software deals with or prevents, and even the typical personal firewall software would not be adequate.

From your description of the nature of the networks for which users of your system have access rights and privileges, I would classify this as an extremely serious situation. You should immediately contact the administrators of every network to which the users of your system have any access rights and privileges to determine what steps they wish for you to take. Do not shut this system down in the usual way and do not use it for any purpose until you have talked with these network admins. (The network admins might need to perform forensics and in that case they may wish to examine volatile memory, or they may instruct you to shut the system down by pulling the plug out of the wall to prevent the normal shut-down process from altering certain system files.) Please advise your friend that he, too, needs to talk with his own system administrators. This isn't something for him to "diagnose" on his own and there's too much at stake.

You might also want to start doing some surveillance on your own personal identity records (credit, etc.) Once email is compromised, many other things can be compromised as well. For instance, if you've made a purchase online, you likely received confirmation email that can contain bits of personal information (e.g., your address for shipment), and from this information other information can be obtained. Or, if your password and/or username to any system, forum, newsgroup, etc. has been emailed to you, this will be clear text unless your email is specifically being encrypted. These people can find out where you bank, what newsletters you subscribe to, who covers your health or life insurance, where you shop online, who your friends and associates are, what church you attend, and a thousand other bits of information about you by compromising nothing more than your email account, so don't think of this as "just email"...it can have much wider implications.

[SFDocBartman]

Laura and SecTrainer,

Good explanation Sec Trainer - here is a OK explanation and example - wish I had access to more right now.

Double / Triple check the e-mail. If in fact the e-mail was broken into - they could send right from the account.

Hackers - can make it look like anyone's address by what is termed url spoofing. basicallly it looks like the image I uploaded - see the link showing in the part of the e-mail... NOW look at the bottom bar of the window - it does NOT show what is in the link above. That is url spoofing - a way to direct e-mails / responses back to a fake address - even though it looks safe.

Hope this helps

VR

Bart