Warning: Change Your Passwords After Ad:Tech

Status
Not open for further replies.
Derek Pankaew

Derek Pankaew

New member
Mar 10, 2009
99
0
0
Most affiliates don't really pay attention to security. Open networks like the one at Ad Tech are very easy to crack; and sniffing passwords is as easy as monitoring the traffic data on the network.

There is literally no protection against someone just picking up your data and isolating your password.

Dozens of affiliates were logging into accounts worth thousands if not millions of dollars. There were at least two people I know of who were joking about how easy it would be to steal keywords at Ad Tech.

My friends didn't do it, but someone else may have. It's a lot of money on the table. If you have keywords, campaigns or data worth protecting and you logged in to your AdWords, your affiliate accounts or your tracking at Ad Tech, then it's probably a good idea to change your passwords.

- Derek
 


Very basic but important. I recommend getting a cert for your propser server too so you can login over https
 
Me and my roommate were sitting in Psychology class (800 person class) and he showed me how to packet sniff. Anything anybody logged into during that class, we had the password to it (unsecured connections only, of course).
 
JamesH said:
Me and my roommate were sitting in Psychology class (800 person class) and he showed me how to packet sniff. Anything anybody logged into during that class, we had the password to it (unsecured connections only, of course).
Click to expand...


Want to make a couple bucks? LOL, just joking. I would be interested to see how that is done though......kind of crazy.
 
what if i'm using softwares like roboform to login to my stuff, are the passwords still able to be compromised?
 
Would using secure tunnel services like Gotrusted help in this case?

Any recommendations of how to securely log into tracking/etc when traveling out of the office? Am I good to go with an aircard and some secure tunnel service?

Derek Pankaew said:
Most affiliates don't really pay attention to security. Open networks like the one at Ad Tech are very easy to crack; and sniffing passwords is as easy as monitoring the traffic data on the network.

There is literally no protection against someone just picking up your data and isolating your password.

Dozens of affiliates were logging into accounts worth thousands if not millions of dollars. There were at least two people I know of who were joking about how easy it would be to steal keywords at Ad Tech.

My friends didn't do it, but someone else may have. It's a lot of money on the table. If you have keywords, campaigns or data worth protecting and you logged in to your AdWords, your affiliate accounts or your tracking at Ad Tech, then it's probably a good idea to change your passwords.

- Derek
Click to expand...
 
Why are you logging into anything unsecurely anyway? I'm pretty sure that all networks use SSL, and my email is always always SSL as well. If you're running a tracking script on your own, that should be behind SSL as well. It's just common sense.
 
Hahah, if you think this is scary you should check out what RATs do and what a mean spirited person can do with web browser exploits (hint: they can install RAT to your computer without you knowing when you visit malicious website like CNN from XSSed link) :D
 
Derek Pankaew said:
Most affiliates don't really pay attention to security. Open networks like the one at Ad Tech are very easy to crack; and sniffing passwords is as easy as monitoring the traffic data on the network.
Click to expand...

And apparently those who do pay attention are ill-informed. There's nothing to "crack" on a public wifi network. That said wifi traffic capture is not a weekend job. You either need lots of transceivers in lots of places or specialized equipment with specialized antennas or both. Most intrinsically valuable passwords that would traverse the wifi are protected by ssl, which is not trivial to break. 99.999% of the traffic on any public wifi is totally worthless which contributes a steganographic obfuscation.
 
PSU4Life said:
When doing this, did you have any issues with IE7? Like it warns the user of a certificate error which would lower your convs. Did you come up with a fix for this? Wes from masterlesssamurai has a post on it.
How To Install Prosper202 On An SSL (HTTPS) Server | MasterlessSamurai.com
Click to expand...

i would only use ssl for logining in, not for my redirects

edit: basically i would not do steps 3 and 4 in his guide. I dont need all traffic going over https (in fact that might slow things down and result in unforseen problems like the one mentioned about IE7)
 
intermanic said:
And apparently those who do pay attention are ill-informed. There's nothing to "crack" on a public wifi network. That said wifi traffic capture is not a weekend job. You either need lots of transceivers in lots of places or specialized equipment with specialized antennas or both. Most intrinsically valuable passwords that would traverse the wifi are protected by ssl, which is not trivial to break. 99.999% of the traffic on any public wifi is totally worthless which contributes a steganographic obfuscation.
Click to expand...
This.
 
Never log onto anything unsecured. Also, keep your wallet in your front pocket. Crowded conventions are a pickpockets dream - no school like the old school.
 
When you say networks use SSL are you referring to Affiliate networks? Unless there is something I'm missing maxbounty, neverblue, Hydra, Incentaclick don't have https on the log in page.

Azoogle, Copeac, affiliate.com don't have the https on the homepage, but if you leave the login fields blank and click "login" it will take you to a Https login page. Same thing for Godaddy and Namecheap.

If you go to a networks homepage and log is your id/pw unsecure if the Https is not showing? Or does it go through https once u enter it? Wonder why they don't use Https on the homepage.

tvmatt said:
Why are you logging into anything unsecurely anyway? I'm pretty sure that all networks use SSL, and my email is always always SSL as well. If you're running a tracking script on your own, that should be behind SSL as well. It's just common sense.
Click to expand...
 
Status
Not open for further replies.
Top Bottom