0

I checked my internet setting today and it seem that everything has being going through some proxy server for the last few weeks. How screwed am I?

Could they get my internet login password? All my files on Dropbox? I buy things online too, is my credit card compromised?

EDIT:

The IP of the proxy is 85.214.85.193, but on my other computer which was also proxied the IP was something different (I forgot to write it down).

|improve this question
  • 1
    First of all scan your system with an anti-virus software. I would recommend you to try Kaspersky Live-cd, that also detects root-kits more easily. – DevRandom Dec 31 '13 at 20:56
3

This all depends on the proxy itself. A proxy intercepts, and redirects. Everything going towards the Internet was intercepted, but it doesn't mean that all was readable. When you log into certain sites (banks, to buy something) most use SSL which means that, unless the proxy was intercepting with a trusted certificate, most data would be encrypted. If in the event the proxy intercepted SSL, and was capable of forging a certificate, or making you believe a certificate was trusted, then you're data is readable. You would have gotten a certificate error via your browser: "Warning this site uses an untrusted certificate..."

Can you elaborate more on the proxy server. E.g. the IP (if possible). Some ISPs use proxies (rare) to cache and provide content quicker.

ADDED

The IP space belongs to Strato in Germany http://bgp.he.net/net/85.214.0.0/15#_whois and is listed in a lot of "free proxy" like sites. The bigger question for you is, how did your machine manage to get proxied in the first place. This is likely caused by some form of malware that made its way onto your machine if you did not configure that proxy. As noted, SSL could have been stripped so that is something to take into consideration.

Personally, I would try and determine how my machine got compromised, I would clean it up, preferably re-install from a clean source, then go and change all my passwords AFTER the fact I cleaned up. (Makes no sense to type much via way of credentials when you don't know what's on your machine)

|improve this answer
  • 1
    Just to add, the proxy doesn't necessarily need to forge certificates if it uses something like sslstrip to remove any reference to https:// and replace with http:// – David Houde Dec 31 '13 at 16:06
  • I added the IP that I manage to write down, my other computer was also compromised and the proxy IP was different. – Bill Dec 31 '13 at 16:08
  • Great information. I really don't know how my computer got compromised. Maybe because I download stuff on Pirate Bay? – Bill Dec 31 '13 at 16:51
  • 2
    @YongkeBillYu Downloading software from an untrustworthy source is usually a great way to catch malware. – Philipp Dec 31 '13 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.