Checking if my user account is being spied on [closed]

Question

At work my computer I am working on is also used by another person. The OS is Windows XP SP3, and we have different password protected users. Because I am doing e-banking from that computer, and also working with online money transactions, I would like to know if there is any possible way the other user can spy on me, i.e. find out my bank accounts or reveal any private things i possess ?

I am accessing the e-bank system through the Firefox browser - is there any way he can discover what I've been doing or even worse - reveal the passwords ?

Answer 1

If someone has physical access to a computer system he has access to all data written on disk:

• Boot another OS
• Unmount harddisk and install in another system
• etc

Later depends if the written information is encrypted. That will make it harder, or even very hard.

Answer 2

Not to make you paranoid, but yes, they can! Any Internet connection you use at work will go through the company's router and thus the administrators can tap into it. All kinds of software can be used to detect whatever you're doing and record every keystroke and mouseclick you make. There are even hardware keyloggers which are attached to the keyboard cable which will remember every key you press. And a lot more. There are thousands of ways to spy on someone who uses a computer, enough to push a paranoid person over the edge.

But what will protect you against these evil spies, except for the law? Well, basically you're interested by how boring the data is that you're sending. No one really cares that you pay $25 to have a box of bonbons and flowers sent to your girlfriend. Not many people even know how they can misuse such information and a lot of people are actually quite honest and won't even look at your screen when you're doing online banking in front of their noses.

However, if you do any online banking, you might still prefer to do it in the privacy of your own home. While your collegues might not be interested, your boss probably is, wondering why you're spending time to online banking instead of your regular job. Basically, you might put your job at risk if you spend too much time on online baning and not enough to your job...

Answer 3

There are quite a few programs that allow to log events on your computer. For instance Spector Pro can record every 'event' that happens on your computer. Moving your mouse, opening folders etc. It can also take a screenshot when certain events happen.

Then again you do need to have Administrator access to the computer to be able to install these programs. So to answer your question: yes, it is possible to spy on you on a shared computer.

Answer 4

Yes, given sufficient resources and the incentive to deploy them.

As well as risks from information and passwords stored on the disk or in the browser, especially if any of these could be unencrypted, there are also risks associated with keylogging software and other malware introduced, for example, from visited web sites, not just by people with access to the physical machine.

Keylogging hardware can be used, as well as more esoteric hardware-based interception mechanisms if these are worthwhile.

Social engineering and associated weaknesses (e.g. leaving a piece of paper with the account details and even passwords on your desk) are outside the scope of the question, as are issues around network interception (even with robust SSL protecting the data in transit subversion may be possible when one has control of the PC and its network infrastructure and enough interest and knowledge to put in the effort to do it).

If these are transactions for your employer and they are of sufficient value and the risks thought to be high enough then perhaps a secure, dedicated machine could be considered. If they are your personal transactions then, even when the use of work resources is allowed for this, perhaps you would feel safer using a personal machine that you control and that you could use in privacy, away from work.

Answer 5

It is theoretically possible yes, if the sites you use are not HTTPS based and/or are badly designed such that the browser ends up caching (or storing in URL history and such) information that you do not want recording.

Two methods that would mitigate this risk:

1. don't use a shared work machine for private sensitive tasks, especially if you don't fully trust the other people who have access to the machine (or especially if you shouldn't be using the machine for personal tasks, which may be the case depending on your company's rules)
2. use something like firefox portable (http://portableapps.com/apps/internet/firefox_portable) to keep the cache/history/other off the machine an on a USB stick that you carry with you

Answer 6

Don't store passwords on a computer to which there is shared access unless you store them in an encrypted file. Use Firefox's ability to clear private data when the application closes to remove any sensitive information that Firefox may have cached. Typically I set up Firefox not to ever remember passwords for sites. Even if you don't share a computer with someone (say it's your home computer) all it takes is for someone to steal it and hack into it and you've got a bigger problem than just the lost computer.

Answer 7

Use logmein.com to log onto your personal workstation at home during times when you need to do personal stuff.

Answer 8

The answer is yes but it depends on the level of access that he has to the system.

If you are working in a well controlled environment then such things are a little harder and provided he stays within the constraints of using his own user account and that account is not an administrator account on the PC then he should not be able to see any of the files that you keep within your own profile area (Desktop\Documents etc). Anything you put elsewhere on the PC might be visible.

At the physical level it's unlikely to happen but certainly not hard to clone the hard drive and then browse through the files depending on how well secured your environment is. Alternatively if the system has an optical\USB drive that can boot the system he could boot to one of many Live-CD based environment that would allow him to mount the internal hard drive and browse to the files relevant to your user account. Analysing your Firefox browsing history from that is simple but accessing passwords should be much harder provided you have chosen to set a master password within the firefox password manager. A sufficiently complex master password in Firefox should be enough to protect personal passwords but I haven't researched this extensively so there might be ways to attack that.

Systems admins in your environment can also gain access to your personal files but generally if that happens you should be informed about it (eventually). This is one of those situations where you have to accept the fact that you are using a system managed by someone else and they have to be able to inspect it in detail if circumstances arise.

Answer 9

The answer is yes but it depends on the level of access that he has to the system.

If you are working in a well controlled environment then such things are a little harder and provided he stays within the constraints of using his own user account and that account is not an administrator account on the PC then he should not be able to see any of the files that you keep within your own profile area (Desktop\Documents etc). Anything you put elsewhere on the PC might be visible.

At the physical level it's unlikely to happen but certainly not hard to clone the hard drive and then browse through the files depending on how well secured your environment is. Alternatively if the system has an optical\USB drive that can boot the system he could boot to one of many Live-CD based environment that would allow him to mount the internal hard drive and browse to the files relevant to your user account. Analysing your Firefox browsing history from that is simple but accessing passwords should be much harder provided you have chosen to set a master password within the firefox password manager. A sufficiently complex master password in Firefox should be enough to protect personal passwords but I haven't researched this extensively so there might be ways to attack that.

Systems admins in your environment can also gain access to your personal files but generally if that happens you should be informed about it (eventually). This is one of those situations where you have to accept the fact that you are using a system managed by someone else and they have to be able to inspect it in detail if circumstances arise.