Joey862
Hello.
In my university there is a network connection, is it totally private to access the websites, and to chat?
Thank you
samer
If I were you, I'd tunnel everything via ssh (you'll need a shell account on a machine connected to the internet).
mir
There are several ppl that may want to Invade ur privacy
you have the admin ppl from the uni who want to monitor the activities on the network
and you have the other student or any person who is accessing those computers
and usually public computers are a big target
so, my advice..don't do something very important or confidential on those computers
and choose couple of computers .. check them.. make sure that they are clean and use them
first install some decent anti-malware.. run a full scan or something like that
then check the process list in the task manager... do google search on them and see if something seems unfamiliar
install ur own monitoring system..so you know what is happening around
another option.. is use a live CD :D
like that you have less things to worry about !
and by the way..what is the name of ur uni :D .. maybe i know something about it
and since that is ur post no 1 .. welcome to the forums :D
nuclearcat
I want to add, that some students practicing in writing trojans, keyloggers and etc.
Problem is that ANY public computer is insecure by default. Never trust for it.
There is tricks to make half-secure access. For example you need to use graphical keyboard (on-screen, like on PDA), and type words by mouse. So keylogger will not work. Still there is possible sniffers of traffic, but also possible to avoid them.
mahdoum
it does in the end depend on the university and their level of security on their computers....
mir
i don't wanna go off-topic .. but lab computer computers are made for all kind of testing
there is the word lab in "lab computers"
and i think they can teach you a lot about security - wether u are the one writing keyloggers,trying to own the network, trying to defeat the sec policy or wether u are the one who is trying to protect himself
Good luck Joey
and tell me what are the stuff u did so far
maybe we can do a step by step thing to help u out
samer
Nuclearcat, on screen keyboards aren't always the answer, I have seen key loggers that defeat these kinds of techniques. Anyway, Mir's suggestion for a live CD is a good one though they tend to be a bit slow. If you manage to get a fast booting liveCD then tunnel all your traffic through SSH, that should bring you a decent amount of security.
Note: the communication between the computer where you have a shell account and the internet can still be sniffed. So I would suggest having the shell account in some remote country (like the US) so the attacker would not have access to the wire.
nuclearcat
Against this keylogger, LiveCD will not help
http://www.keyghost.com/
samer
Nuclearcat, I was talking about software keyloggers :) - i usually check if there's one of these attached on the public gear before using it.
nuclearcat
Samer - it can easily fit inside keyboard.
mir
Nuclearcat, i think you have a good point
we must not only take care of the software.. but of the hardware also
now who would really open the keyboard before using it
but again.. i don't think someone would do such kind of attacks on uni computers
anyways.. i think for hardware keyloggers they have a certain amount of keystrokes that they can store
you can hope that lot of other ppl use the keyboard after you . filling the space (i donno if when filled. it starts erasing from the start and writing again )
if that is the case, then i think you can do a small piece of software that generates keystrokes filling the space and erasing the meaningful strokes
but if there is no over-writing.. then.. umm something has to be done
i think there must be something that would detect those devices
But i really agree that public computers .. are public computers.. so.. no confidential data should be accessed or saved on them
it just depends where u are and what u are doing :) :D
nuclearcat
For authorization you can use "one-time" passwords.
Sure u must not type secret things and etc after that. But for example to fix some network(emergency) issue, it's ok to use public computer with one-time password, if there no other choice.
samer
if someone is interested in what nucealcat is saying, checkout " opie " (one time passwords in everything)
nuclearcat
S/Key, for unices... already i have tested it. I like it
battikh
what i do in netcafes, and when i dont trust them while putting my password is teh following.
let's say my password is: password
i first type panda, then with the mouse, i select "nda" (leaving only "pa"). i don't use the erase key, i just continue typing. then i type sand, select "and", then type switch, then select itch and type orlando, then select lando and type read, then select ea and erase it :P
it seems a little paranoid, but it's effective. if there is a keylogger, it will catch "pandasansword..." just words next to each other. and the person who is usingteh keylogger wont think that the real password is hidden in there as all these letters have a meaning...
and yes, it's very anoying to do all the time, so sometimes u just say to yourlsel: screw them, if tehere is a keylogger, letthem have my password, i dont care :P
nuclearcat
S/Key more simple
u can have calculator let's say on ur mobile
and even if they intercept password - it is useless
mir
hehe batikh
yes i used to do that method too :)
i think it is about combining couple of methods :)
i believe security is never possible or at least so hard to achieve
Padre
lol, keyloggers are MUCH more performant guys :) and most of them (include the one i wrote) are not detected. but thats not the biggy. the scary part about labs and stuff like that , is that EVERYTHING can be read ....even ur uber super encrypted SSH communication with that 1000$ server in the US :)
my advise, stick to ur PC and even there .....
rolf
In my uni, internet browsing is done on sun thin clients. every student has his own login account.
If there is any sniffing/keylogging it would be from the university IT department, and I dont think they do such things.
Nuclearcat great trick to use the onscreen keyboard.
