Skip to main content
GameDev.net gamedev.net
🔒 Locked

Security question...

Started by devronious Jan 13, 2008 at 10:26 PM 11 replies 1.9k views
Original Post
devronious
devronious
I think I'm having hack attempts. I am finding my computer re-boot all on it's own and trying to boot from the built-in network card bios. Yet this is not set to do this. I enter my bios to find everything is normal. Other than this my computer works optimal and perfectly. Any ideas how this could happen? I'm worried this could be a security breach as I have had business data stolen in the past by competitors. -Devin
Hodgman
Hodgman
What happens when it reboots? (e.g. blue screen first, 60-second count-down warning first, just suddenly goes black, etc...)

It could just be overheating, or your PSU could be on the blink... Load up some monitoring software (it should have come with the motherboard) and check the temperatures and all of the voltages to see if there's any anomalies (e.g. 3.3v is only 2.5v, etc...)
devronious
devronious
The funny thing is that I've never been in front of my computer when it happens. It always (Three to four times so far) happens that I leave for a few minutes and come back and it's rebooted on it's own and is trying to boot from the onboard network device. I can work on the machine for days literally and nothing. I am a cooling expert and have advanced air cooling components on the machine. It stays pretty cool all the time. I installed extra hi-speed 120mm fans into the case. There's plenty of ventilation and cooling.

I've left all the voltages stock.
SiCrane
SiCrane
Moved to the Lounge.
Extrarius
Extrarius
If you're running XP, do you have automatic reboot on blue screen turned on (it's on by default)? To check, winkey+break -> advanced tab -> startup and recovery section -> settings button -> system failure section -> automatically restart checkbox
If it's on, you could just be having driver problems that cause a crash and thus a restart. If you turn it off and that is the problem, you'll be able to find the cause from the blue screen information
"Walk not the trodden path, for it has borne it's burden." -John, Flying Monk
devronious
devronious
Yes it was on. Thanks I turned it off. That's annoying! Don't know why I would want to skip by the message showing me what's wrong with my system! It seems like that would send you into a perpetual skip of the problem, thereby perpetuating the problem forever?!? Strange to say the least.


Well hopefully that's it. I'll just have to wait now and see if it happens again.

Thanks for your guys help! You're once again super here at GameDev!!! Best forum I've ever joined.

-Devin

Evil Steve
Evil Steve
Quote:
Original post by devronious
Yes it was on. Thanks I turned it off. That's annoying! Don't know why I would want to skip by the message showing me what's wrong with my system! It seems like that would send you into a perpetual skip of the problem, thereby perpetuating the problem forever?!? Strange to say the least.
Because if you have XP running as a server, or on a machine which is usually unattended (E.g. a business Point Of Sale machine or something), it's preferable that the machine reboots to try and get back into a working state (at least it'll start services if it gets to the login screen). The alternative would mean someone would have to wait to notice the machine wasn't working, go and investigate, and then reboot it manually.

Also, the average computer user will probably panic if they see a BSOD, or at the very least not use it at all, and probably prefer that the PC reboots. More advanced users are generally aware of settings like this (Admittedly I didn't until someone told me [smile]) and are capable of disabling automatic reboot and using the information the BSOD provides.
Don Carnage
Don Carnage
If you've had business data stolen by competitors in the past, it would raise the likeliness of a directed attack on your computer. Since you write only that the system "works optimal and perfectly", besides that little thing with it trying to boot from the net even though not enabled in the bios(!), I don't know if you ran any system scans for virus, mal/spyware, worms, rootkits, etc.

Had I experienced what you describe, with the past history in mind, I'd certainly throw everything but the sink at it, not just glance it over!

You don't need to go overboard if it's just a driver or hw malfunction, but the thing about it happening only when you're away, and it trying to net boot, sounds kind of suspicious. If someone had gained remote access to your box, and was interested in getting all your data without much trace, they surely just wait until the system was inactive for a longer period, get it to boot linux from net and proceed to download your hard disk, easy as pie.

So, assuming windows, get at least anti-virus, firewall, adaware, spybot, ccleaner, hijackthis, rootkit scanner, defender, what have you. Update the scanners with latest signatures, reboot to safe mode with no net, and let it all run. Better safe than sorry. For more specific help and guidance, check out forums or sites dedicated to these purposes, and read up on the basics on keeping your system safe and updated.
It is I, the spectaculous Don Karnage! My bloodthirsty horde is on an intercept course with you. We will be shooting you and looting you in precisely... Ten minutes. Felicitations!
RSC_x
RSC_x
or simply screensaver is hawe bugs or just set to reboot/suspend when its not busy.[some bios's did not support suspending correctly]

and sometimes heawy hd read write actions cause's read write errors and some defections on hardware ?

i had similar expierences. now that hd is gone.[one of the problems was short circuits and or damp]

also i remember my tv card too vas causing reboot when i kill it while tv is running.

and some other things too can cause reboot.
anyway it may be some wirus.
anyway its probally isnt a wirus because there is not enough cleawer hackers that can do that. if they are cleawer they gets easily rich and do not need that.
so there is no problem as it can be on real life.

note:if bill gates becomes poor . ! this means you hawe to start to wory about it 3 or more times more.!
© Loading...<font col
devronious
devronious
Evil Steve,

Oh I See, makes total sense in that case so long as the error is logged and the admin is notified some how so that it can be dealt with later.

RSC_x,

My screensaver is blank screen. I use that to save screen and energy.

Don,

Quote:
but the thing about it happening only when you're away, and it trying to net boot, sounds kind of suspicious.


My exact thoughts. I've been working with computers for the past 30 years now and I've never seen anything quite like it.

Like I said, I have a competitor selling one of my best inventions. I'm not real happy about that and I don't know how they got their hands on it. Only two people other than myself have had access to it. Only one of those could have possibly given the plans away and I had them sign a binding None-disclosure agreement.

Pretend this is a theft... how could they have got my IP to know where to access my computer? I'm on a non-business cable modem behind a DNS router. From a visit to a forum? I'm asking so that I can figure out better ways of pretecting myself. If I know how they got to me then I can better protect myself.

------------------------------------------------------------

Quote:
If someone had gained remote access to your box, and was interested in getting all your data without much trace, they surely just wait until the system was inactive for a longer period, get it to boot linux from net and proceed to download your hard disk, easy as pie.


Is it really that easy? I guess that would be the only way to really bypass the OS that's blocking the attack.

It appeared that the bios section was temporarily modified to boot from LAN cause I hit the reset and tried all kinds of stuff and it would keep trying to boot from LAN. I checked the BIOS and the setting wasn't set to do that. I had to turn off the power to get it to clear the tweak.


------------------------------------------------------------

I have virus scanner (Norton AV) and the two Spyware scanners (SpyBot S&D and Ad-Aware SE). What else do you recomend? And where would you recomend I go to learn more about guarding against this sort of thing?

I kinda wish I learned how to hack now just so I can protect myself. Kinda like... "I wish I learned marshal arts so I can protect myself out on the streets."

Thanks for your help, it's greatly appreciated. I can't afford to lose anymore inventions to theives that's for sure.

-Devin
d000hg
d000hg
Isn't it possible to have your entire disk encrypted? I'm sure I've seen recent hard disks come with this functionality although I don't know how they work.

The only way to be 100% safe is to store your work on a PC which isn't on any network of course...

You might like to ask the folks over at techzonez.com as they are very good at this type of thing.
devronious
devronious
Quote:
The only way to be 100% safe is to store your work on a PC which isn't on any network of course...


Probably the most powerful yet simplistic approach, abstinance! :) I am currently using a mix of this and firewalls. When I don't need to connect I've been leaving my system offline by disconnecting the cable. Can't break thru a dis-connection can they?

Works great but is getting to be a pain to have to connect, disconnect, connect, disconnect... and so on.
devronious
devronious
Also, I put a password on my bios for setup and system. That way if it does get re-booted it goes to password and hangs.

-Devin

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.