Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have read many websites which state that, "We can hack into computers while chatting on the internet."

What are the best precautions to be taken while chatting to prevent unauthorized access?

I thought one might be to use a firewall, but firewalls sometimes fail in this issue.

for reference as one of the trusted sites

share|improve this question

closed as not a real question by Polynomial, Terry Chia, Gilles, Scott Pack, Iszi Oct 7 '12 at 14:51

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Can you provide a source of where you read this statement. Because most of the time, when somebody says "I can do ..." I expect proof in order to believe it. –  Ramhound Oct 4 '12 at 11:26
    
@Ramhound i added link –  BlueBerry - vignesh4303 Oct 4 '12 at 12:23
    
It is strange to call a "trusted site" a Web forum where anybody can write, apparently without any required respect for grammar, spelling or meaning. –  Thomas Pornin Oct 5 '12 at 22:46

2 Answers 2

up vote 3 down vote accepted

Sure, but it's got nothing to do with the chatting itself. If your computer is attached to the internet, it is possible to get hit with an attack. Malware is abundant, as are random drive-by attacks.

If you want to protect yourself, all the usual stuff applies:

  • Keep your OS patches up to date.
  • Keep your browser and browser add-ons/plugins up to date.
  • Keep your applications up to date - especially those who access the internet or load common document formats (e.g. PDF)
  • Use a firewall, configure it properly, and keep it up to date.
  • Use an anti-malware solution, and keep it up to date.
  • Use strong passwords, and never use the same one twice.
  • Don't click stuff blindly.

This can be helped by:

  • Having the Windows Update schedule configured to run frequently, and never dismissing the updater on a Patch Tuesday.
  • Using a decent password manager, and only using randomly generated passwords (except for the one you remember for that password manager)
  • Following various security folk / vendors on Twitter. You'll get news of breaches and 0-days faster than anywhere else.
  • Uploading any suspicious files, or files from untrusted sources, to VirusTotal.
  • Taking the time to understand the implications of what you're about to do, before you do it. Does this website really need to run a Java plugin? Are you really sure you want to run an executable you found on a forum?
  • Recognising the normal set of processes that run on your computer, and identifying (through tools like Process Explorer and Autoruns) anything unusual.

However, technology is not a panacea, so let's look at some ways you can help yourself in case you do get owned:

  • Accept that you got owned, try to work out how it happened, and take it as experience. You have no choice but to nuke the machine from orbit and start over.
  • Some data is irreplaceable. Keep backups. Yes, backups are annoying to set up. Yes, backups can be expensive to keep. However, it's several orders of magnitude worse to lose all of your data. I've been there. It hurts. RAID mirror only protects you against drive failure, but not malware destroying your files. Make regular remote backups of your important files, whether that's to an external drive or onto a service like Dropbox. Also, your ISP may offer a free backup service - mine gives me 50GB for free.
  • Have installation disks and copies of basic programs and hardware drivers ready. It saves you a lot of time if you have to rebuild a box.
  • Remember to change all of your passwords. Since you're using a password manager (as I said you should above!) you'll have a nice big list of accounts, so it'll be hard to miss anything important.
  • Use the experience you gained to avoid getting owned again.
share|improve this answer
1  
Well, I guess there are the two possibilities of: vulnerability in the chat software, socially engineering the victim to click on or run a script...but you cover these off anyway with your points 2, 3 and 7 –  Rory Alsop Oct 4 '12 at 10:10
    
@RoryAlsop Yup. The above covers most situations for the normal internet user. I'll add to this in a minute, because it'd be nice to include some loss-prevention to the list. –  Polynomial Oct 4 '12 at 10:39

A firewall is something you should be running simply because your plugged into a network not specifically due to using chat applications.

You've first got to define what they're trying to hack into: is it your local files which you are worried about, the chat conversation itself or other network communication using the same interface.

Techniques

To keep your local machine secure you should use a reputable chat application and protocol as there's no way of knowing if an unknown protocol or application will allow injection or include a backdoor. This is of course on top of the standard security strategies (firewall, least privilege ect).

As for the conversation you need to use encryption like SSL for transmission. The server should use truecrypt full drive encryption (this way if the machine is physically seized the data is useless), be secured with good passwords and firewalls and preferably have all logging disabled (just in case).

As for securing other network communication or meta-data about your communication (who's connected, number of users ect) you should be looking at proxies and systems like tor. If you're using private proxies then these should obviously not be under your name and should exploit laws and diplomatic difficulties between nations (ie authorities in Russia are unlikely to cooperate with US authorities unless it's in Russia's interest)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.