Protecting Your Personal Info While Traveling?

AdEbh asks: "I was just listening an interesting article on a local radio station regarding computer security. In it a member from the AFP cybercrime unit mentioned that they are starting to see keylogger software installed on public access terminals, such as internet cafes. With friends & family overseas at the moment or soon to be what advice should I give them? Is this a real concern?"

Comments

Tell them

[2names]

not to use the public machines for any financial or private communications.

Re:Tell them

[antarctican]

not to use the public machines for any financial or private communications.

Agreed. When I travel what I do is change my password on all my accounts to one which I will throw away when I return home. Yes, there's still a risk of abuse, but the window is hopefully small enough if you're only gone for a few weeks that it won't be a problem.

What I also do is forward all my email accounts to a throw-away Gmail account. Again, so I can read and respond to email but not be concerned someone could try and break into my box. It also means I'll avoid at all costs trying to ssh into my machine.

The final really geeky thing I sometimes do is setup an almost honeypot box. A machine that I can ssh into with a throw-away password that is on an isolated network. I then place an ssh key somewhere on this box and use it to ssh to one of my other boxes if needed. This way the only password I will type will be to this honeypot box, not to the actual machine I need access to (being a sysadmin, sometimes you need to pop in to a machine while away, but I'll never 'su' - I'll ask whoever is covering for me to actually do that 'work'). Again one great advantage of this is you can then just erase the key from that honeypot box, so even if the keylogging person is somewhat techno-savvy, they can't get access to that key. If you hide about 3 keys on the machine, you can do this use/erase method 3 times over your trip.

And I know others will probably suggest an ssh-key on a usb key, another very good idea - as long as you're going somewhere that has a high enough level of computing to be able to use this method. Most of my trips have been to the developing world, where machines are still running win98. USB keys don't exactly work too well on those machines, if they even have USB slots. ;)

The key takeaway message is - use a one-time password and create a throw-away email account for communication. And I agree, no banking! Leave your online banking info with someone at home and email them to do it for you. Nothing wrong with being a little paranoid. :)

A tip

[ylikone]

Don't type anything you wouldn't want anybody else to see when you using public terminals. Kind of obvious?

Re:A tip

[cjellibebi]

But in order to log into your e-mail account, you would need to supply your password. One way to get round this is to type the first few letters of the password, switch to an other app, type some gibberish, and then switch back to your web-browser / telnet-session (doing more switching if you're feeling insecure). If this is one of those hardware devices that sit between the PC and the keyboard, it cannot know what belongs where, but there might be some software out there that can detect app-switching and record kepresses on a per-app basis.

Re:A tip

[mattspammail]

Or go to a web page and copy and paste characters into the password blank. It might take awhile, but it's key-free.

AND make sure you only log in to https sessions.

Re:A tip

[Anonymous Coward]

You're kidding right? Have you ever seen keylogging software?
They spyware varieties rarely log every key. Instead, they intercept web submission forms, or data from specific applications. Switching windows and typing gibberish won't do anything to prevent information loss.

The best approach is one of:

- Bring your own computer. Use SSH or other VPN software to access your home computer and then your email. Do not trust public systems. Do not trust public WiFi networks.

- Setup a web interface for accessing email. The password should change automatically after every successful login.

- Bring putty on a floppy disk and use it to SSH into your home computer for accessing email. But don't trust the local web browser to not be infected.

- Knoppix. Boot off your own software, check email or surf, then reboot back to the (likely) infect operating system.

Things you should not do:
- Do not assume the computer is not infected. Even if it runs a virus scanner or you're told that it is clean. If it isn't yours, don't trust it.
- Do not assume the wireless network is safe.
- Do not assume the connection between the internet cafe and the internet is safe. (Who knows what is being tapped.)
- Do not assume that if you "just login for a moment" that you won't compromise your information. It only takes one login and the bad guys don't miss.
- Do not assume the risk is limited to public terminals. Hotels and coffee shops with "free" wireless are commonly monitored by 3rd-parties. Any place that isn't "home" should be considered a risk.

If you want to have fun, run 'netstat' on the public terminal. See any open ports? You probably will...

Infected public terminals is a much bigger problem than even most government cybercrime investigators believe.

ctl+alt+del

[natron 2.0]

If I am forced to use a public terminal I like to check the tasks that are running in the background, to see if there is anything suspicious. It has saved me a few times, of course not all kiosks will let you use that command.

Re:ctl+alt+del

[nine-times]

That works so long as the keylogger (or whatever) is software-based. There are also hardware-based loggers that sit between the keyboard and ps/2 port, for example.

No financial activities

[fembots]

If you're using a public machine, you shouldn't do any financial activities like banking, paypal etc., at all.

Sensitive information should be transmitted separately, for example, credit numbers via email and expiry date via phone.

Re:No financial activities

[Gorath99]

If you're using a public machine, you shouldn't do any financial activities like banking, paypal etc., at all.

Try and find a bank that requires one-time passwords. I don't know how common such systems are internationally, but over here in the Netherlands, it's pretty much standard.

My own bank provides its users with a small calculator that, when unlocked with your PIN, will also generate one-time login numbers. For extra security every transaction requires an extra one-time number keyed to that particular transaction (so highjacking the connection after the login is provided is mostly harmless).

I'm sure it's still not 100% safe, but crackers will definitely have to work for their money.

Well...

[Poromenos1]

I am becoming increasingly paranoid about typing passwords in public terminals... I am even reluctant to type my password in a friend's computer... Generally avoid typing your password for anything you don't need while at a public terminal, and if you're REALLY paranoid you could have it written in a file in a USB keychain and pasted (keyloggers don't log pasting, do they?).

Simple Rules

[COMON$]

Its just like anything else, why should computers be any different when it comes to common sense?

You wouldnt give your credit card # to someone over the phone in a public place.

You dont throw away check stubs without shredding them.

You dont give strangers your home address.

I guess I dont understand how people can not connect the dots.

Create a disposable webmail address

[cactux]

If you want to keep in touch with friends and family during travel, create an email address with one of the many free webmail services available.

Then use only this adress while traveling, and only for casual messages, nothing important. Specify to your correspondants that this adress is temporary, and subject to be "stolen", so they should be suspicious regarding messages coming from it.

They caught on to this a long time ago

[jeffmeden]

A good key logger will monitor anything coming and going from the clipboard. If you want to be paranoid, dont trust info on a machine you cant verify, assume whatever you do is going to end up on a billboard.

First do your homework...

[feloneous cat]

1. Get professional sweep gear.
2. Cordon off the area and do a thorough sweep of the Internet Cafe in question.
3. Make sure that and patrons and workers empty their nastly little pocketses.
4. Disassemble any electronic hardware that is shielded to make sure the keylogger isn't hidden in its nasty bowels.
5. Once the all clear is given, log in to AOL, download porn.

I'm just saying...

Advice?

[artifex2004]

1) Carry a laptop
2) ssh into your home server, or use HTTPS for webmail.

Using your own laptop means nobody is keylogging you, unless they get access to your machine, in which case you're screwed anyway. Sticking to SSH or HTTPS means you're not sending anything worthwhile unencrypted up the pipe.

Also, you'd be amazed at the number of compromised terminals at universities and colleges, too. Better warn your kids before they go off to college not to do any financial transactions, etc., from them, no matter if school policy is to run antivirus and spybot killers. Those are no match for good old fashioned hardware keyloggers, assuming they even use the latest updated programs to check.

Security vs. Obscurity...

[mellon]

If you want to access your email remotely, and you want to be sure it won't be hacked, bring your own computer. Otherwise, just accept the risk that your password will be sniffed, and change your password when you get home.

Ideally, you should change your password before you leave, and then change it back when you get home, because if you're like most people there are lots of things online for which you use the same password.

Oh, and if you need to do any kind of transactions _other_ than email while you're abroad, definitely bring your computer. Doing serious transactions on a public workstation is about the same as writing your PIN on your bank card and leaving it stashed near your favorite ATM so you don't have to carry it in your wallet.

Re:Security vs. Obscurity...

[mellon]

The output from the on-screen keyboard has to go to the same place. So you can't assume it's safe. Of course, it probably is safe in many cases, but if you care about the contents of your bank account, you can't assume it is.

In the case of banking transactions when you're backpacking, you have a few choices. One is to appoint someone to manage your bank account while you're unavailable - this is what people did before online banking was ubiquitous.

For example, when I traveled to Nepal in 1993, I left a stack of envelopes with my sister (if I remember correctly). Each had a date on it, and she mailed it on the appropriate date. I had direct deposit at work, so that was no problem.

If you need someone to make decisions, as opposed to just doing something for you, there are people who provide this service professionally. Check them out to make sure they're legit, but if they are, then unless you are inordinately wealthy, they aren't going to be tempted by the contents of your bank account.

You can also carry a small computer, rather than a big one. Unless your bank is really evil, you should be able to do transactions from a Palm Pilot or wince machine. I'd recommend a Linux PDA, personally, but they're harder to find. The new Nokia would be an excellent choice. You can also now get fully-featured notebooks from, e.g., ASUS, that weigh only two pounds. Bringing one of these along is not as bad as you suggest.

I've heard that some European banks do one-time passwords - you just print out a sheet and bring it with you. This would be the ideal solution if you don't care about privacy, but of course if, like me, you live in the U.S., you probably don't have this option.

Use the mouse

[BenjiTheGreat98]

When you are on a public terminal you can type in your username and/or password by typing in the last half of it then use your mouse and go the front of the text box and type in the 1st half. It's not full proof but at least someone won't have your password in plain view in front of them.

Re:medium threat

[Vellmont]

This threat is not any different than the threat that almost all wireless users at cafes have faced for years....


This threat is completely different from wireless cafes. At a wireless cafe if you're using your own machine, all you have to do is be sure to use the SSL protected https site when checking mail, doing bank transactions (which should be SSL only anyway). If you're using a public terminal, there's basically nothing you can do to protect any sensitive information.

My advice is buy a portable PDA with wireless capability if you need to do anything involving sensitive information while away on vacation.

Fun Experiment

[deadtree9]

While in Hawaii on vacation last September I prepaid for an hour of web cafe time. After answering all my emails and checking what news I felt like reading, I still had a good chunk of time left over and my GF was still in the same strip mall shopping. I decided it might be interesting to download and install ad-aware. (They were old windows 98 machines, so there was absolutely NO security.) In the 15 minutes or so I hung around watching and chatting with the clerk running the place, ad-aware ticked off over 2,000 spyware items found, and it wasn't anywhere near done!

Morse Code

[spoonyfork]

I thought Cryptonomicon was required reading here. I guess times have changed. Use Morse Code.

Practical

[Markus Registrada]

Don't worry about hardware keyloggers. They cost more than software loggers, so they won't be there. Cops and spooks break in to install them on dissidents' machines; they are probably very rare otherwise. Just bring along an Ubuntu LiveCD, and boot from it. If you can't do that, and you can arrange to produce your own web site, have web-page javascript password-entry scheme that uses just the mouse, unrepeatably. (That is, each time the page is (re-)loaded the buttons appear in different places on the screen.) Or, bring along a USB key with a pile of temporary-use private keys in it, and a copy of ssh configured to use only those key files. Be sure to delete the corresponding public key after each use. Even if they log keystrokes they won't copy the entire contents of every USB key plugged in; and it doesn't matter so much if they do, anyway.

Re:Practical

[Locke2005]

Uh, those methods do nothing for you if the software is designed to simply record HTTP POST and SMTP operations, in which case it doesn't really matter how the data was entered into the machine. Yes, one-time-use keys would work, except that none of the mail readers support them, do they? Hmm... bringing your own copy of ssh might work... do public access terminals let you run your own software? Seems to me that I would disable floppy, CD, and USB file system.

Stop worrying! :)

[caluml]

You know what I say? Stop worrying about things. Live life. Life is dangerous. You might be killed tomorrow. Disease, car crash, something like that. And there are lots of people in the world. What are the chances it will happen to you. Set your root password to password. Run an open SMTP server. Do whatever you want. It's better to regret the things you have done than the things you haven't.

Re:Keylogger

[jimbolauski]

The easiest trick is to pour water in the back of the machine just below the power switch. This is where the key loggers are inserted. The water will short it out. Most key loggers do not have a plastic cover, but just incase, insert a small screwdriver and try to puncture the plastic cover to pour in the water.

Something to consider...

[IcyNeko]

I once worked at a computer lab where I was able to test some software (iOpus, I believe) that had some keylogging software. This software was incredibly ingenius, and would very accurately tell me what was typed where, when, and by whom. I also had the option to take screenshots every once in a while (I could set how often the screenshots were taken). These files (log and screenies) could then be saved on a location where the current user would not be able to access due to user restrictions.

Be wary of this, since I was able to catch the logins of several users. (My purpose of installing this was to catch someone was using our network traffic downloading porn and illegal filesharing. Needless to say, with the screenshots and logs, I caught him rather red-handed.)

But these days, such precautions are to be expected with terrorism on the rise and such. My only advice: Be very careful when doing this on a public location where spying and keylogging is easy to implement. Not all people were as nice as I was and let the small info go. A small slip of the Credit Card number, and away goes several thousand dollars!

Re:Something to consider...

[fuzzybunny]

(My purpose of installing this was to catch someone was using our network traffic downloading porn and illegal filesharing

What you did is strongly illegal in many countries, including parts of the US (look up state & federal wiretapping laws) especially if done without informing users. Aside from that, it pushes the ethical boundaries of what's acceptable (I think it's filthy, personally, but I'm giving the benefit of the doubt and being diplomatic.)

Not all people were as nice as I was and let the small info go

If you can't tell what's wrong with this statement, you shouldn't be administering systems used by other people. You're perfectly correct about being wary of using boxes beyond your exclusive control; however, we're talking about crime and not exercising control over your own computers.

I didn't have a problem

[Cro Magnon]

I posted to slashdot from an Internet Cafe, and nobody stole my password.

Re:I didn't have a problem

[Cro Magnon]

Shows how much he knows. I've been using Cro Magnon's ID since he did that.

Re:Next best option

[Technician]

I've heard that some European banks do one-time passwords - you just print out a sheet and bring it with you. This would be the ideal solution if you don't care about privacy, but of course if, like me, you live in the U.S., you probably don't have this option.


Nobody has mentioned the simple way to limit your losses. Open a travel account at another bank. Set up automatic weekly transfers. Use it for gas and such. My travel account gets $200/week. If it gets hit, I contact my bank. My potential loss is very limited. The checking account is not backed up with overdraft protection. Keep track of your balance and use the bank ATM whenever possible. The rest of the bills are set up from the primary account at another bank with auto payments. If the electric is a little off one month, it can be adjsted upon my return. They are happy to receive a regular payment even if it is a little over or under. Let them know what's up. They are very good working with you to get paid.