Beware! Possible Ransomware

Hi again everybody.
Well I thought my posting would liven up the thread and it certainly did that. Let's face it it has been pretty dull around here of late, so their is nothing like a good Christmas argument to set the spirit (LOL). So if I can address johns posting first and try to link in others

I don't recall specifying smartphones, Windows and Android are available on a variety of platforms including desktops.


I think you're confusing secure with what people do. Just because millions use an app to access their bank account doesn't mean its secure. Tescos for example.

Fingerprints, well yes but you can lift a fingerprint off a glass surface and create a mould from it. The moulds read reasonably well.

My favourite security tale at the moment, the Met police in London have worked out how to gain access to someone's Apple smartphone or tablet, you wait until the suspect is using it then grab the phone and keep it active. You don't need the password.

I think you're missing a point on the web site side. When you enter a web address it goes to a DNS server to be resolved. Many of the DNS servers do not have their security patches so without HTTPS you don't actually know if you've been directed to the correct web site or not. Beyond that it is very difficult to secure a web site. Most US banks for example have web sites that are vulnerable to having code added.

Strangely enough people running TANE often have a windows machine. These windows machines can run a variety of email packages. Unlike smartphones you don't have to change the machine often to keep them secure or did I misunderstand you?

If you were referring to passwords then the latest research on passwords recommends the use of a root password that has something added per site. The researchers found that forcing people to change their password frequently meant they used weaker simpler passwords.

Cheerio John

John again with the greatest respect to your above posting, but if interpret your first paragraph correctly you believe that Android is available on desktops which is not the case. It is at the present time only available on tablets and smartphones. There has been going on all year within Google a development to allow chromebooks and desktop chromebase machines to run android apps. However, the progress has slowed to crawl and the CEO of Google stated last week that their would be no full integration of Android and Google OS at any time in the foreseeable future.

The above I believe encompasses the major development in IT communication throughout 2016, that being it was the year that the smartphone became the first choice of communication for the vast majority of persons in developed countries. As Larry page stated at the start of the year, the smartphone will be the all powerful computer in people's hands for emails, texting, writing (voice dictating) documents, gaming, navigating and accessing information on a scale never witnessed before.

Yes, all the above can be carried out on a PC or desktop, but a smartphone is the only device which is totally and easily portable and with us to do any of the above at any time wherever we are. Evidence to the above happening throughout the year can be seen in the continuing decline of PC sales (down a further 6%) despite the release of windows 10, and also the decline in tablet sales on all platforms as smartphones gained the power to “sideline” them.

Therefore John whatever the problems in security on phones the seemingly unstoppable trend towards using them in almost everything we do will continue. Yes, people may have them snatched out of their hands or criminals may forge fingerprints and users will access dodgy websites but the uptake of the phone to do ever more in our lives will be ongoing and increase as the power of the devices increase.

Of course, much of the above security on those phones is in the hands of users. Do stupid things with them and you can expect disastrous results. As can be seen when you walk down any street or in any workplace office smartphones are now used constantly in almost everything we do, the keyboard is out and voice dictation on a smartphone casting to a large screen monitor in.

In the above there will be the need in many commercial and educational situations for better security and that is where Google OS has pitched its role. Anyone who has used that platform will know that if you try to access a website that the Google servers sense as insecure you now get an onscreen warning and access is denied.

As you say John many on this forum may still use their desktop PCs or Windows laptop for all communication, but with every respect to all forum members and this hobby that is not now the most common use of those static devices. A windows PC or laptop is great for very high end gaming but it is left wanting in today's “on the go” demands of communication.

I suspect that their are even on this forum many like myself who now only use their PC for a few well loved games. With myself that is Trainz 10-12 and Train simulator 15. Everything else is now done on mobile.

Bill
 
Last edited:
Hi again everybody.
Well I thought my posting would liven up the thread and it certainly did that...

On the contrary, I find that some of your more prolonged and drawn out and, quite frankly, boring and tedious ramblings could put a glass eye to sleep!

Let me just re-iterate the warning I posted at the beginining of this thread. Anyone who has bought Trainz assets from LMS_MAN aka Gary Price should be aware that his email account may have been hacked and those people may receive emails purportedly from Gary Price that may contain links to malware, ransomware and other such nasties, just as I did recently.

Rob.
 
Last edited:
Hi Malc.
I believe i may have a Rasberry Pi being given to me as a Crismas present, not sure yet only what I have heard in regard to what grandchildren may be giving me. Getting Android on it could be a good project. There is also a "single board computer" now being made that has windows 10 inbuilt as standard. Cannot remember what the name of it is now, but it gets you a windows 10 computer for around eighty dollars.

Now there's a bargain, I wonder if it will run TANE. :D

Bill
 
A long time ago I specified desktop computers and servers. When I looked at the functional requirements I was unable to differentiate between the two. Both used a CPU that ran the same instruction set, the software for either would run on either hardware platform. Some applications required ECC memory but that might be on a PC used for financial calculations or a server.

Android is available for a number of processors. One of which is the raspberry pi. Now what makes a desktop a desktop? Separate screen and keyboard? I can add these to my raspberry pi. Don't forget the Pi is now available with a quad-core 64-bit ARM Cortex A53 so its quite powerful.

I get the impression that you feel if you say something forcibly enough it will be accepted as the truth. Including N3V should port TANE to a smartphone. What you are not doing is looking at the requirements. You're pushing a solution first without understanding what the requirements are or what the risks are. In security circles there is something called a TRA or Threat Risk Assessment and I don't think you are assessing the risks.

Think about where Google has most of its servers. Now think about the CIA wanting access to any and all data on any US servers.

The thread started on the security risk and that is where the discussion lies. What can we do to limit issues. Not how do a bunch of school kids text each other. Since everyone in the forum has a machine that will run Trainz or at least I assume they do, then either the Windows and Apple operating systems are available to them and that's the first place to look for answers. Surely we haven't got to the stage where everyone has to buy a Chrome notebook to write their Christmas letters and emails to be secure? What about those poor souls on buses typing away at their laptops without an Internet connection in sight? Are they doomed from a security point of view?

Big organisations have complex needs. You may not be aware that Microsoft Word can access SQL databases etc by running Visual Basic. Many businesses are well aware of it and use it as a report writer. Products such as Blender run better locally as does Photoshop. Running software locally means not having to wait for a response. The more complex the software the more this is true. Waiting for a response costs time and that is money to businesses.

The cloud sounds wonderful, yes but when our city council IT systems were audited they found many systems that used the cloud but there were many security vulnerabilities identified.

Cheerio John
 
Hi Malc.
I believe i may have a Rasberry Pi being given to me as a Crismas present, not sure yet only what I have heard in regard to what grandchildren may be giving me. Getting Android on it could be a good project. There is also a "single board computer" now being made that has windows 10 inbuilt as standard. Cannot remember what the name of it is now, but it gets you a windows 10 computer for around eighty dollars.

Now there's a bargain, I wonder if it will run TANE. :D

Bill

The requirement to run TANE is the ability to run the X86 instruction set. The Pi runs the ARM instruction set.

Cheerio John
 
I have Crypto Prevent installed which should knock most Ransomeware on the head before it does anything however, there is always going to be something one step ahead of any protective measures, so it pays to watch what you are doing and not assume that your anti whatever software is foolproof.
I always Google any unexpected links from what could be a genuine contact and see if it is a known Malware or worse site and it has been so on a couple of occasions from people I know, same with links on forums, if it isn't obvious what the link is to.

@ Bill you are thinking of the LattePanda Windows10 single board PC, its smaller than most phones and around $80
Rasberry Pi's are quite a lot of fun to mess with so I'm told and you can learn a lot from adding various bits to them.
 
I have Crypto Prevent installed which should knock most Ransomeware on the head before it does anything however, there is always going to be something one step ahead of any protective measures, so it pays to watch what you are doing and not assume that your anti whatever software is foolproof.
I always Google any unexpected links from what could be a genuine contact and see if it is a known Malware or worse site and it has been so on a couple of occasions from people I know, same with links on forums, if it isn't obvious what the link is to.

@ Bill you are thinking of the LattePanda Windows10 single board PC, its smaller than most phones and around $80
Rasberry Pi's are quite a lot of fun to mess with so I'm told and you can learn a lot from adding various bits to them.

I might look into the Crypto Prevent myself and also do the same.

What's interesting too is saving the email to a file then viewing it in a text reader. I have old list.exe which is an old MSDOS based text viewer. You can throw any file in there and view its contents including binary, though they show up as garbage. With email, however, most are in plain text or partially anyway, and you can view the headers and the information in there. I traced a few emails back to their source servers that way. Now depending upon your email client, you can do this using their built-in tools as well so there's no need to save the email first to a file.

John
 
Ah List! used to be one of my most used programs still got it on a DVD I stuck all my useful Dos stuff on. I did have an old Pentium Laptop running Freedos up until a year ago when it died, one of the Old Dell Lattitude XPI's with the docking station, it had a good and life!

I have Thunderbird set to show full headers, used to belong to one of the antispam sites back when reporting it actually achieved something!
 
Ah List! used to be one of my most used programs still got it on a DVD I stuck all my useful Dos stuff on. I did have an old Pentium Laptop running Freedos up until a year ago when it died, one of the Old Dell Lattitude XPI's with the docking station, it had a good and life!

I have Thunderbird set to show full headers, used to belong to one of the antispam sites back when reporting it actually achieved something!

I remember those laptops well. I used to support the old Latitude machines - the same except for business along with the docking stations. Those old machines were made well unlike the stuff we have today. :)

List still works on Windows 10. I setup a shortcut on my desktop and drag things on top of it. It's definitely a nifty utility.

I gave up on trying to get Alpine running on Solaris. The download was difficult to get and let alone install for Solaris. While poking around the Java Desktop, which is basically Gnome, I came across Thunderbird. I have used this before on both Windows and Solaris and it was quick and easy to setup. It even found my mail server automatically. I have it running now on Solaris in a Virtual Box VM. No worries now about ransomware affecting that. :)

John
 
I think Robd was right to remind us of the original purpose of this thread but I also think it's been rather interesting.

I'm a confused IT dinosaur. :) I like new technology but smartphones leave me cold. All I want in a phone is a gadget that actually makes phone calls and sends/receives text messages. My kids live on their phones but I don't. That said, I'll probably get an iPhone the next time around because my Android based phone is annoying me. My iPad is gathering dust and probably is a few updates out of date and the battery probably flat as well. But it is useful for taking on trips. I don't like laptops and will continue to build my own PCs until parts are no longer available or I fall off the perch - whichever comes soonest. :hehe:

Raspberry Pi based kits are very cool. I got one last Christmas but still haven't had the time to explore it as much I as would like. I know the processor has been updated at least once if not twice since then but they are very cheap.
 
I worked at Westinghouse where, as most Fortune 10 companies, we had our own private world-wide email system running on long forgotten Univac 494 main frames. I venture that this was the first commercial email system. No smartphones but messages to/from teletype machines switched by computers. There was only one security feature and that was message numbering. Something I miss today since my trust in commercial systems is next to zero.

While personal users need the internet for inter-connectivity I wonder why the high security operations (nuke plants, CIA, NSA, Norad, etc) do not have a private fiber network. With all of the fiber in the ground today that should not be a problem and quite secure.

I do not follow all of the myriad of items preceding this message. However, the bottom line seems to be, as it was since the internet was born, it is up to the individual user to protect themselves. You can't always trust those who say they protect your data since they in-turn are either selling or making money from it with targeted adverts. If you can't trust Google who can your trust???

This set of messages (AKA thread) is enlightening since there are references to some tools and services I might take a look at. Thanks.....

PS: I have Windows10 mail and can see no way to look at a received message's header to determine its validity.
 
Last edited:
PS: I have Windows10 mail and can see no way to look at a received message's header to determine its validity.

It doesn't work in Windows 10 mail, the application, but you can do that in Outlook.com which is the webmail version or similar. Right-click on messages in that and view source.

Received: from MWHPR20CA0024.namprd20.prod.outlook.com (10.171.151.162) by
DM5PR20MB1610.namprd20.prod.outlook.com (10.171.159.137) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.789.14 via Mailbox Transport; Sat, 17 Dec 2016 13:01:35 +0000
Received: from inbound.mail.protection.outlook.com (207.46.163.56) by
MWHPR20CA0024.outlook.office365.com (10.171.151.162) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.771.8 via Frontend Transport; Sat, 17 Dec 2016 13:01:35 +0000
Received: from CY1NAM02FT056.eop-nam02.prod.protection.outlook.com
(10.152.74.57) by CY1NAM02HT020.eop-nam02.prod.protection.outlook.com
(10.152.74.220) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.771.7; Sat, 17 Dec
2016 13:01:35 +0000
Authentication-Results: spf=pass (sender IP is 74.112.64.87)
smtp.mailfrom=bounce.mkt746.com; msn.com; dkim=pass (signature was verified)
header.d=maillist.trainsmail.com;msn.com; dmarc=bestguesspass action=none
header.from=maillist.trainsmail.com;
Received-SPF: Pass (protection.outlook.com: domain of bounce.mkt746.com
designates 74.112.64.87 as permitted sender) receiver=protection.outlook.com;
client-ip=74.112.64.87; helo= mail1331c.mkt746.com;
Received: from SNT004-MC2F52.hotmail.com (10.152.74.51) by
CY1NAM02FT056.mail.protection.outlook.com (10.152.74.160) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.771.7 via Frontend Transport; Sat, 17 Dec 2016 13:01:34 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:A8E31A021C9F948B8312E57C5E66A78AE39E0BEAB793180465E782A446DA4E14;UpperCasedChecksum:B0123D2995CEBAC1580BB38CFED5B968AF9B9C9251CC5BA669559C98E15F8D62;SizeAsReceived:1895;Count:20
Received: from mail1331c.mkt746.com ([74.112.64.87]) by SNT004-MC2F52.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143);
Sat, 17 Dec 2016 05:01:33 -0800
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=spop1024; d=maillist.trainsmail.com;
h=Date:From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:List-Unsubscribe; i=TrainsMagazine@maillist.trainsmail.com;
bh=rlmzBqUwqWiMflz5h+Eco7N1Zs0=;
b=Jctadra5ZSJUl1+2zWuSEWZWmhduOYSOKCkFJCCTRAq9b2jvSL+oeCSHeBUPatS7E1v4yV0Sxd6N
3zE1fHKqn56exvCgT5Bq9QHeOrcIHsDUSXrrfUJZ3jvvzFC3C4WjMphq0WLa0ow5gfdxQmEDBbCI
ypeaY66HZvYntJwRwpA=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=spop1024; d=maillist.trainsmail.com;
b=Mox+Lk26JflkBO/1M64Wa35aeKbjayIXfsfgOUUj27lLw8OX7IJqapjUxAfQ9PBZFfsM3jhZdz8N
kc5A3RjRSQG3d1Iu9BkZfbT9T94r52sT78FxE3RIQkYMvpLBo0jNTvSLkT8vojR91mtdXvkbPXVK
cym8Y9tgjjdbYEVgWE8=;
Received: by mail1331c.mkt746.com id hakriq19if4d for <jcitron38@msn.com>; Sat, 17 Dec 2016 13:01:08 +0000 (envelope-from <v-bkapbia_bldcbbpfem_didefjeg_didefjeg_a@bounce.mkt746.com>)
Date: Sat, 17 Dec 2016 13:01:08 +0000 (GMT)
From: Trains Magazine <TrainsMagazine@maillist.trainsmail.com>
Reply-To: Source Email address
To: my Email address
Message-ID: <280688209.1032892251481979668327.JavaMail.app@rbg32.atlis1>
Subject: Don't Forget: Last Chance to Save 64% on Your Gift!
Content-Type: multipart/alternative;

and so on...
 
Hi everybody.
I think Robd was right to remind us of the original purpose of this thread but I also think it's been rather interesting.


I'm a confused IT dinosaur. I like new technology but smartphones leave me cold. All I want in a phone is a gadget that actually makes phone calls and sends/receives text messages. My kids live on their phones but I don't. That said, I'll probably get an iPhone the next time around because my Android based phone is annoying me. My iPad is gathering dust and probably is a few updates out of date and the battery probably flat as well. But it is useful for taking on trips. I don't like laptops and will continue to build my own PCs until parts are no longer available or I fall off the perch - whichever comes soonest.

Raspberry Pi based kits are very cool. I got one last Christmas but still haven't had the time to explore it as much I as would like. I know the processor has been updated at least once if not twice since then but they are very cheap.

Inline with others I would agree that whatever system anyone is running be that PC or mobile then having security software onboard is essential. The only exception to the foregoing would be Google OS (not to be confused with Google Android) where users are instructed not to install any such security apps on the system. The foregoing is not to state that the online operating system will never be compromised, but in the six years of its existence no one has so far hacked the system in any way.

Many commercial organizations here in the UK with good broadband connections have moved all their IT onto Google OS, therefore that is a reference in itself to the trust that many place in the OS.

pcas when thoughts turn to buying a new smartphone the considerations in my humble opinion are the same as when buying a new Windows PC system. First think on what you want to get from your new phone, is that gaming, photography, posting on social media or just texting or even for just making phone calls (highly unusual these days).

If it's gaming or photography then to get from the best you will need the latest in build and android version (assuming you are thinking of buying android and not this overpriced Apple rubbish LOL) in the above you would need to be looking at purchasing a high end Samsung galaxy S7 or S7 Edge, or at minimum an S6 or Sony,LG etc equivalent. The latest Google Pixel phone(s) just launched are reported to be a further step forward from the Samsung's S range.

However, a Google Pixel XL with 128gb onboard storage will cost anyone close to £800 British Sterling (1000 US dollars). That stated you will get for that superb graphics for gaming, photography to rival any stand alone camera on the market and voice recognition that is without doubt literally faultless.

Of course anyone can find smartphones at prices from £100 or less. That stated, if your interest is photography, gaming having great graphics or high activity on social media by way of voice recognition, purchasing anything less than the best may well quickly leave anyone wanting.

Bill
 
Last edited:
Back
Top