Bob Barrows email hacked

[Nev]

Bob had his email account hacked today, and many of us have received emails from his account. The emails have no names, and ask the recipient to contact him urgently. Presumably the recipient will be parted from their finances shortly thereafter, in favour of the hacker.

Bob knows of the issue now and has received numerous calls today from many of us to give him a heads up. He certainly appreciated the calls, and has suggested that a short post on the forum here might allow him to get off the phone and back to designing aeroplanes.

[geraldmorrissey]

All of the people all over the world, and they hack Bob Barrows???
Gerry
Patrol #30

[Mark Goldberg]

I received the bogus email from Bob's computer as well. A couple hours later I sent Bob an email requesting LSA plans be sent to a new customer. I got a reply requesting payment. I knew this request to be bogus as Bob sends me a written invoice in the mail for plans. So I replied to the scammer that I had forward his email address and all the information available to two of my customers who are with the FBI. Told the scammer that these FBI guys were builders of Bob's planes and would use their IT forensic professionals to investigate.

I actually do have two customers one of whom is still with the FBI and the other is retired. But I would not bother them with this. But it sounded good to me and hopefully gave the scammer some pause that he should go somewhere else to be a thief. Mark

[schu]

All of the people all over the world, and they hack Bob Barrows???
Gerry
Patrol #30

That's not how it works. Typically, hackers will whack a forum or some other online repository of accounts, which yields them a bunch of email addresses and passwords. Knowing that people typically use the same password over and over, they will use an automated system to try the password at the email account, especially if it's a common email account like yahoo or gmail. If the password works, then they use that email account to send spam, again all automated.

So, it has nothing to do with Bob being the target of attack, it almost certainly is because of password reuse. The solution is to use different passwords for everything and perhaps multi-factor authentication (the stuff that emails you a code or texts it to your phone). Of course this makes password management a huge headache, which can be solved with a password manager which requires you to remember one master password, but then allows you to cut/paste your other passwords from it. I use a 1password.com family account. No two accounts have the same password, and my wife can see any password I have which means that she can get to absolutely everything should I become the smoking hole at the end of the runway.

schu

[Steve W]

And just a heads up for those of us who use Barnstormers a lot. I have had an add running for some time looking for 2200 amphib floats. I've received three replies that are scammers. They basically find some pictures from past advertisements and send them representing the floats for sale. I've recognized all the pictures so far and have reported the incidents to Barnstormers. They even called from a Virginia area code but I didn't answer it as I screen all my calls to voice mail that I don't know. The email through Barnstormers messaging came shortly afterwards. Their bogus account was created two hours before I reported it to the Baroness.

[geraldmorrissey]

Thanks for telling the rest of the story schu. 4 bucks a month for 1password sounds like a deal.
Gerry
Patrol #30

[schu]

Thanks for telling the rest of the story schu. 4 bucks a month for 1password sounds like a deal.
Gerry
Patrol #30

Sure, it's important to note that a password safe program automatically generates random passwords when you first insert a new account into the safe, you then use the generated password during signup. The result is that I have no idea what my passwords are for anything, and all of them are random, but, once I login to 1password with my master password (which I memorize) then I can copy/paste the random password to whatever website I'm trying to login to.

Up until a few minutes ago when I updated my password, my bearhawkforums password was:

zuk2tult_zaig!POOH

schu

[svyolo]

If I wanted to start a career as a hacker, I would start by starting a cybersecurity outfit and "secure" password service. Sorry, but I am a cynic.

[svyolo]

No Bearhawk content here, and I was a contributor. Apologies.

[schu]

If I wanted to start a career as a hacker, I would start by starting a cybersecurity outfit and "secure" password service. Sorry, but I am a cynic.

That's because you are ignorant of how it works. Shed your ignorance here. Absolutely nothing needed to decrypt the data is stored on the 1password servers.

Now I'll relate it to the bearhawk. If you use the same password for this forum as you do your email, and this forum gets compromised (it doesn't take much), then there is an extremely high chance that everybody that has interacted with you via email will get spam from you.

[schu]

More information here: https://support.apple.com/en-us/HT202303 The 30 second version is that icloud uses encrypts your data directly on your device before sending it to icloud, and none of the pieces needed to decrypt that data live on their servers. For that reason it's pretty safe, and MUCH MUCH MUCH safer than reusing a weak password.

For me, 1password is still worth the premium because I can have shared 'vaults' with my wife so she can see my passwords, 1password uses an additional 'security key' that you enter when you install your account on a new device that is figured into the encryption which makes even the password 'password' VERY secure, and I like that they have browser plugins for stuff that isn't apple, and it works on my windowz and linux computers.

I'm an equal opportunity hater and can poke at apple just as fast as M$ and linux, but I will say that I will NEVER have an andoid phone. The fact that the file system is encrypted by default and Apple flat refused to give the FBI hacked firmware as it opens Pandora's box meant a lot to me. I'm not saying it's bullet proof, but ask any law enforcement about the difference between android and apple when it comes to using a cellbright and they will tell you that the iphone security is worlds better.

At this point, I've extended my off topic posting long enough, so I probably won't say anything further, but, I did want to share useful information that will help other builders as I always try to do on this forum.

[JimParker256]

I agree with schu about the security on Apple devices, but am concerned about one item in his post. He is absolutely correct that the text "password" stored as a password on an iPhone would be well-secured and highly inaccessible to a hacker (as he stated), meaning that it would be exceedingly difficult for someone to decrypt the information store to retrieve that password. But it is absolutely NOT a "secure" password to use for ANYTHING.

For years, I received a summary report on the most-often-used (and hacked) passwords, and every single time, the words "password" and "Password" show up on that list. Likewise "12345678" and "qwerty" show up somewhere on that list (along with "asdfgh" and other sets of adjacent keys on the keyboard). Pretty much any "easily guessed" password falls into that category as well (wife or kids names, dog or cat names, etc.).

I once "hacked" into a pretty secure system (at the request of the business owner) by looking around his office, and using the name on the transom of the boat in a picture framed above his desk as the password. It was the first thing I tried - 10 seconds into the process. Needless to say, he was quite embarrassed... That boat was his pride and joy, but it's name was a lousy choice for a password because it was obvious and easily guessed.

[schu]

Jim, you missed what I said, I said "1password uses an additional 'security key' that you enter when you install your account on a new device that is figured into the encryption which makes even the password 'password' VERY secure". In other words, in the 1password world, 'password' is also combined with 'A3-LV56YH-34FEGW-SDFE34-6CM99-ASDFE-HJKU78' (the security key) to encrypt. I am not recommending 'password' I'm saying that 1password has additional layers of protection to protect against even that.

[schu]

To demonstrate why it's dangerous to use shared/weak passwords, I just went to leak-lookup.com and discovered that even this forum has been subject to a data compromise. And judging by the ipaddress it captured for me, within the last year and a half:

Screen Shot 2021-03-26 at 6.48.41 AM.png

Thankfully the forum appears to be using bcrypt password hashing so my password is well scrambled, but if the forum was using something like MD5 and I had selected a weak password, it wouldn't take long for the Russians and Chinese hackers to whack it.

The engineers at opentable.com didn't pick a secure hash algorithm, and my old opentable.com password is out there for anyone to see. Good thing it's not my bearhawkforums or email password.

schu

[svyolo]

It took the US government over 25 years to come to the conclusion that paying to install PC security software from a Russian company wasn't that great of an idea. Paying someone or a business that you have never met to secure your personal and financial information just doesn't make sense to me.

[Nev]

Using any manually entered password becomes susceptible to a keystroke logger - a small app that simply logs everything typed on the keyboard and sends it to the hacker.

[svyolo]

Again, this is not Bearhawk related, and if Jared deletes this whole thread, I won't feel violated. I am not critical of any technology. I am an educated engineer, although minimally experienced in that. I taught myself to code (FORTRAN), 37 years ago when I worked as an engineer. My education in differential equations and calculus is in my distant past. My life long education is in aviation, with a minor in corruption.

I have no doubt that someone online can extole the ventures, mathematically, and statistically, how secure their password system is. I will just say that they may be incorrect, or corrupt, in their advertised assumptions.

I will also offer, that a really good computer hacker can break into your bank or brokerage account in a week. An exceptional computer hacker will coerce 10,000 victims to pay them to secure their financial logins by paying them a fee. In the same week. A dollar a month - no problem!

Which hacker makes more money?

My security, is my problem. Paying someone else, to do the same, seems. well, I won't go there.

[svyolo]

Send me all your money, I will give you a 12% return forever. I will send you receipts printed on a 1980's dot matrix printer. every month.

I promise I am legit.
Berny Madoff.