The Computer Layman's Guide To Internet Security

[Leixor]

DISCLAIMER: This guide is provided as an informational aid only. I take no responsibility for the use of the information herein. If you are uncomfortable with this information, but still are concerned about computer security, you should consult a professional. It is possible that misusing this information could cause data loss, hardware destruction, or other consequences. I am by no means an expert on security and furthermore like all humans, I do make mistakes. In short, no one is responsible for the use of this information but you. Last updated: September 17, 2006 Most of this information is based on the PC architecture running Windows. Some of the information (such as spam, wireless security, instant messaging, peer to peer safety) is platform independent. If you are running a Mac or Linux, it doesn't mean you are completely secure. Security by obscurity is not assurance that you won't become infected. I don't know how many Mac and Linux viruses there are, but if there is even one and you aren't protected, you're at risk. I don't have a Mac and I'm pretty new to Linux (and oblivious to other UNIX flavors) so I generally won't be offering advice on those systems. If someone has a Mac or a Linux box, and knows a lot about security, feel free to PM me and I can incorporate your information into this guide (crediting you, of course). Finally, this guide is going to be written in such a way as the solutions it provides will be free of cost. I.E. The applications I recommend will not cost you anything. Sure, there are commercial alternatives, and if you want to use something like that, that's fine. There are good free security tools available though, and that is what I will be focusing on. The internet can be a dangerous place. Viruses, spyware, hackers, identity thieves, spammers and more. Because of this, and because I'm bored I am going to attempt to write a simple guide to computer security. This will by no means be all encompassing. Some of this I have learned from personal experience, some I have learned by reading. The information is easily available out there, but I am going to compile it all here in one place. Let's begin by asking a simple question. Do you need to be concerned about computer security? Yes, you do. You don't have to be completely paranoid but a little foresight goes a long way. Most people learn about computer security because they didn't have any to begin with. For instance, an acquaintance of mine recently asked me to help her fix her computer. She said her ISP had called her and told her someone was running a DDOS (Distributed Denial of Service) attack using her PC. They said if she didn't remedy it they were going to cut off her internet service. After taking a look at it and confirming that was indeed what was going on, I managed to fix it with a little effort. So what do you need to do to protect yourself? It's really pretty simple. That's why it's so unbelievable that so many people don't protect themselves at all. I am going to divide this guide into parts. You don't have to read any part you don't want to, so just skip where you wanna go, or read the whole thing. General Internet Security Usually this goes without saying but the following is a list of do's and don'ts if you want to be safe on the internet. DO NOT post personal information (Name, address, age, birthdate, social security number, credit card number, a list of your fears, etc) on message boards or on your personal website. Name, age and birthdate is kind of open really, as there isn't too much people can do with just your name. Basically anything you wouldn't be comfortable telling a total stranger, don't post it on the internet. DO NOT fall for the trick "dialog box" ads. Like the ones that appear on a webpage, look just like Windows dialog boxes and say "Your computer may be unsecure. Click to scan now". Don't click it AT ALL. Since in most cases it's an ad, it doesn't matter if you click yes, no, cancel, go away, etc. If it comes in a pop-up(more on pop-up blockers later) and you are going to close it, make sure you use the REAL close button, not a fake one that's part of the ad. DO NOT install software from untrusted sources. DO NOT use peer to peer file sharing applications. (If you REALLY insist on it, see the section later in this guide. DO NOT open email attachments from people you don't know. DO NOT open unexpected email attachments from people you do know. Scan all email attachments before using them. DO be very careful when typing addresses into the address bar. A typo of one letter can lead to an entirely different site, or worse a spoof site attempting to steal your information. DO run a good firewall. (See the section later in this guide) DO run anti-virus software BUT NOT MORE THAN ONE (See the section later in this guide) DO keep your operating system up to date (See the section later in this guide) DO use an adware scanning application (See the section later in this guide) SPAM We'll start of with something simple. Spam. Nobody likes spam, but most people have it. Now there are filters to catch spam, and they are getting better and better everyday. What we are going to focus on, however, is how not to get any spam in the first place. I have had my current email address for almost two years, and I get no spam. The way to achieve this is pretty easy. First and foremost, be careful who you trust your email address to. That is, don't put your email in every time a new site asks for it. A lot of times when websites are offering "free software" and they just need your e-mail address, in reality they are going to sell your email address to make a profit. How can you be sure that a particular site isn't going to sell your address? Well you can read their Privacy Policy. You know that thing that all decent websites have and nobody ever reads? They are required to disclose what they will do with your information in there. If a site doesn't have a privacy policy, then it's likely they are going to sell your information (or worse). Another neat tool that has recently come about is by McAfee. It's called site advisor. You can find it here. If you go there and plug in the name of a website you are wondering about, they will give you a report on it. They give you an overall rating, a list of user comments, and even a sample of the emails they received after providing the site with their email address. McAfee also provides a tool that integrates into the browser and does the same thing, but I can't speak of it because I've not used it. Lastly, if you REALLY need a piece of software, and you are fairly sure they are going to sell your email address, what you can do is open a second email address (E.G. Hotmail, Yahoo, etc) and use that email address for occasions where a website's trustworthiness can't be easily determined. Another way spammers can get your email address is by bots that scour the web looking for things like [email protected] If you have a public profile on a message board, or post your email in a post (or anywhere else publicly viewable on the web) then bots can collect that and spam you. You have two choices in this case. As above you can use an email address that's "unsecure" I.E. that you don't mind if the spammers get. The other option is tricking the e-mail gathering bots. It's really pretty simple. Let's say your email is [email protected] (hopefully that's not a valid address, someone tell me if it is and I'll change it). Let's then say you wanted to have that email publicly in your profile. You could post it as JaneDoe_at_dreamviews_dot_com or JaneDoe@dreamviews_no_spam_.com. This has the effect of confusing some email collection bots. It also has the unfortunate side effect of confusing people who can't see through the "mask" so to speak. These two simple steps are why I am spam free. If you get a spam OK you've already got spam. Well if you've got a lot of spam(like more than once a week) it's likely too late. Either use a good quality spam filter, or get a new email address and protect it from the start. But let's say you've been following my instructions and you get a spam. Don't panic. First of all, we need to define spam. For the purpose of this guide we are going to assume Spam is any promotional or marketing email that you don't want. That's not a valid definition of spam, but it will serve our purposes. First thing to determine is if the email is from a reputable site. You can check that at SiteAdvisor. If it's a well known company (GameSpot, K-Mart, real companies you have heard of etc.) then the best thing to do is unsubscribe. HOWEVER! And this is very important. If you get an email that's not from any known company, possibly has a lot of misspellings, and is offering Viagra for cheap, or free gifts, or that you have won a contest you never entered etc; the best course of action is to do NOTHING. Why? It's simple. In situations like this clicking "unsubscribe" or replying saying to unsubscribe usually only serves the purpose of confirming to the spammer that your email is real and in use. If you don't reply or unsubscribe and continue to get spams, then really you're shot. Your best bet is to get a spam filter or a new email address. Now you see why it's better not to get spam in the first place. Updating your operating system Updating your operating system is a simple but quite effective procedure you can do to make sure the base operating system is as secure as possible. It's really very simple and I'm not going to go into how it works and all that. I'm just going to tell you how to do it. Microsoft Windows Windows Update That's the website if you want to do it manually. That's how I do it because I like to know what I'm installing and what's going on. Note that you must be using Internet Explorer 5.0 or later. If you are using Firefox or another browser and it's set as your default and you don't know how to open Internet Explorer, you can usually find it in Start > All Programs > Internet Explorer. Alternatively you can use Start > Run and type in "iexplore" without quotation marks. This is slightly less secure because a lot of trojans masquerade as iexplore.exe. If they've messed with the path environment variable then you could inadvertantly launch another instance of the virus. It's normally a pretty safe way to launch Internet Explorer though, so don't spaz about doing it. If this is the first time you've been to the Windows Update site it will likely want you to update your Active X control for the updates a few times. This is normal, don't spaz. Once you do that then it should scan your computer to see what updates you need. If you are a true layman and don't wanna mess with the specifics, once it has scanned you should see two buttons. "Express" and "Custom" just pick Express and be on your way. It's pretty self explanatory and you shouldn't have any problems. Once it's done youll probably have to reboot your machine. Once you reboot go right back to the Windows Update site. Since some updates require other updates to be installed first before they can be installed, it's likely there will be more updates to install. Keep checking after each update until there are no more in the "Express" category. One final note: If you have a slow internet connection, the download will probably take forever. Back when I had dialup, after a reformat of my PC and a fresh install, all updates had to be done. On dialup this took close to 24 hours, and even more updates have been released since then. I think they've streamlined the update process a bit though. They also used to offer the updates free on CD for those with slower internet connections. I don't know if they do that any more. Anyway, If you are going to do it over dialup prepare for it to take a while. Finally, if you are gonna do it manually like this it's a good idea to check at least once every two weeks. The other way to update Windows is with automatic updates. This, as it's name implies, automates the update process. Windows will automatically download critical updates and prompt you to install them when they are ready. If you wanna turn this on, there is a button at the Windows Update site above that will guide you through it. This makes it a lot more transparent if you don't want to have to remember to update every few weeks. One last thing to note is that not all versions of Windows are updated anymore. Windows XP still is since it's Microsoft's flagship Product. I think Windows 2000 and Windows Server 2003 still are as well. Windows ME might be, though if they haven't stopped updating it yet I know they are going to soon. If you've never updated before and you have one of these versions(or older), you still should update to the latest version. Just understand that no NEW updates are being made. It's time to upgrade to a newer version of Windows Windows Genuine Advantage An important thing to note as far as Windows Update goes is the recently added Windows Genuine Advantage tool. Basically its a program that Windows Update wants(possible makes) you download to check to see if your copy of Windows is legit. Microsoft got sued over this because the application was "phoning home" without having notified end users it was going to do so. If you download the app via Windows Update and are running a pirated version of Windows(whether you yourself pirated it or the person who sold you the PC did) it will notify you as such. If you pirated it yourself then you're probably spazzing about now eh? I'm not gonna give you a big talk on software piracy. You didn't come here to hear that, you came here to get secure. I realize (as does Microsoft) that even pirated software should be updated. Why? Well if Microsoft refused updates to pirated versions of their operating systems, more of those systems would be infected. This would facilitate the spread of said infections to legitimate copies of Windows as well. So it's better for everyone if they allow pirated versions to update as well. I don't know if Microsoft collects the names of the people running pirated versions or not. Maybe your in the other group though. Maybe you bought a PC with Windows pre-installed and it says your running an illegitimate copy. That would be a shock too. There are two possibilities. One is it could be a false positive. The other is the vendor you obtained your PC from may have pirated Windows. Microsoft provides support if this is the case. The following is from Microsoft's website, and as such is copyright to Microsoft: Q: What are the details of the genuine Windows offer? A: To help customers who unknowingly purchased a counterfeit version of Windows XP, Microsoft has created two genuine Windows offers for those who qualify: * Complimentary offer: Microsoft will make a complimentary copy of Windows XP available to customers who have been sold counterfeit Windows. Customers will be required to submit a proof of purchase, the counterfeit CD, and a counterfeit report with details of their purchase. Only high-quality counterfeit Windows will qualify for the complimentary offer. * Electronic License Key Offer: Microsoft will offer an alternative for customers who find out via the WGA validation process that they are not running genuine Windows, but do not qualify for, or choose not to take advantage of, the complimentary offer. These customers will be able to license a Windows Genuine Advantage Kit for Windows XP online for a price of $99 for Windows XP Home edition or $149 for Windows XP Professional. The Windows Genuine Advantage Kit for Windows XP will include a new 25-character Product Key and a Windows Product Key Update tool that will allow customers to convert their counterfeit copy to genuine Windows XP electronically. If you purposefully pirated your copy of Windows then I would strongly suggest you get a legitimate version. Piracy is unethical and illegal. If you get notified that you are running pirated Windows and didn't do it yourself, you should contact Microsoft for support. If you want to read more about Windows Genuine Advantage (like what info it collects, the controversy surrounding it, etc) then you can here: Wikipedia - Windows Genuine Advantage Anti-Virus Anti-Virus programs are just like they sound. They are applications designed to protect you from viruses. The one we will be focusing on is AVG Free edition. You can obtain it here. AVG Free edition is a version of Grisoft's professional, pay to use anti-virus software. The main differences in the free and paid versions are: Free version has no technical support. Free version is given lower priority when connecting to the update server. Free version is only available in one language, you don't get super advanced settings, and you can't use it in a commercial setting (like for your business). Those limitations being noted, it is a really good free application. Besides being a standard anti-virus program in that it lets you scan for viruses, it also has a what it calls Resident Shield. What that does is scan files as they are run (or attempt to run). The feature is not fool proof but it does a pretty good job of catching malicious things before they happen. Also it can integrate into email applications such as Outlook, Thunderbird etc. Then it will scan all your incoming emails for viruses. Now, even with a feature like Resident Shield, you need to SCAN for viruses from time to time. Perform a full scan of your entire system. I know it can take a while, sometimes a few hours. In such a case you can do it at night. Start the scan before you go to bed. Another important thing to do is everytime you download a file, scan it. AVG integrates into the Windows operating system so it's really quite easy. Let's say you downloaded the installer for a new application. Before you EVER run the downloaded file, right click on it and select "Scan with AVG Free" (most other antivirus software integrates in this way as well) It'll only take a few seconds. This also applies to peer to peer filesharing. ANYTHING that you download from a Peer to Peer network using an app like Limewire or Kazaa needs to be scanned before it is used. Peer to Peer filesharing is really a security nightmare, which is why I don't recommend using it in the first place, but if you must then it's important to take steps to protect yourself (see the section about it later in this guide). Note that if you buy software from a reputable source (like a real store, such as Wal-Mart, Target, Best Buy, ETC) You don't really need to scan it. You can if you are super paranoid but retail software is pretty safe. Of course if you buy it from a place that also sells bootleg DVDs you might wanna be a little more cautious. Next, and this is important to note: Do NOT run more than one anti-virus application. The reason is simple, they can conflict and this can cause them not to function properly, or even worse can cause damage. One is enough. Lastly, anti-virus programs are not fool-proof. AVG Free does a good job but sometimes a new virus, trojan or worm etc(or variation of an old one) can infect people before the virus databases have been updated to protect against said viruses. Getting rid of a virus to which there is not yet an antidote can be really frustrating. I know because I've had to do it. See the section below on what to do if you become infected for more information. Anti-virus checklist: DO run ONE good Anti-virus Application DO scan your entire system for viruses on a regular basis (I do a full scan about every two weeks) DO scan EVERY file you download from the internet, ESPECIALLY from Peer to Peer networks. DO understand that Anti-virus programs are not fool proof, and they are not a substitute for good common sense The scope of this guide is quite large, and I really don't feel like writing it all in one sitting. It will be kind of an ongoing project, and I will try my best to add one new section a day. Comments, questions, and suggestions are always welcome. If your question is unrelated to internet security, please don't post it here. I want this thread to stay clean. For other questions there is currently an "Unofficial Software Help" thread. You can also PM me with any computer related questions. I'll try my best to help you, and if I can't I'll point you to someone who can. Approximate days left until completion: On hold until people express interest. If you want more information please post as such and if enough people do I'll consider finishing. It's too much work to do if no one wants it. To be added: Instant Messaging Safety Firewalls Pop-Up blockers Adware scanning applications What to do if you become infected Wireless security. Peer to Peer safety Browser Wars (E.G. Should I use Internet Explorer, Firefox, Opera etc)

[Kaniaz]

Security by obscurity is a decent start[/b] Well, I'd be careful with that one.

[Leixor]

Well, I'd be careful with that one. [/b] So noted and updated.

[ilovefrootloopz]

Alternatively: Get a mac or install linux

[Kaniaz]

Get a mac or install linux [/b] That's called security mostly imagined because the market share is basically a minor fraction of Microsoft's but, hey, who cares?

[ilovefrootloopz]

No, it's called security for lazy smart people

[Kaniaz]

but, hey, who cares?[/b]

[Leixor]

I think Kaniaz is right. Imagine that there were only two type of cars in the world. 80% of people own Volkswagen Beetles. The other 20% own Honda Civics. Of course more Beetles are going to get stolen, because there are more Beetles to steal. That being said, just because you own a Honda Civic doesn't mean you should leave your car unlocked in a bad neighborhood. Beetles aren't being stolen because they are easier to steal, it's because there are more of them. Now, in that same example, let's assume Person A is an up and coming car thief. Let's also assume that the way you steal a Beetle is different than the way you steal a Civic. Person A will likely learn how to steal Beetles, simply because there are more of them to steal. Then let's say person B comes along. He sees that the car thief people are focusing mostly on Beetles and that the Civic owners have a false sense of security. He may choose to learn to steal Civics because even though there are less Civics to steal, not as many people are stealing them and the owners aren't taking the proper precautions because they feel safe in their niche group. It's kinda like that, I think. Originally when I had said "security by obscurity is a decent start", well honestly I feel that right now it is. Because not too many Person B's have came along. I'm not at all recommending that Mac or Linux users not protect themselves though. That's why I changed what I had said.

[Ynot]

Yeah........well....... sticking with the car analogy The Honda Civics have an alarm system that is built right into the car this alarm monitors all forms of mal-entry, and is driven by it's own power source this power source is behind the mal-entry detection it's not so much a car with an alarm but more an alarm with a car built around it the Beetles, on the other hand roll out of the factory with no such alarm in-fact, you have to buy an alarm, and fit it into the car yourself this alarm only monitors the doors on the car the alarm draws power from the car battery any savy person could just pop the bonet, disconnect the alarm, then break into the car also, the wheels on the Beetle will fall off at least once a week

[Leixor]

also, the wheels on the Beetle will fall off at least once a week [/b] Lol. I suppose I could reply "only if you don't know how to drive properly" I had some problems with my Windows box a while back. I finally determined it had to be data corruption caused by overclocking. I reformatted and reinstalled and I've been running smooth ever since. No crashes, no freezes, no blue screens. As far as stability goes, I've managed to crash Linux more than Windows. You might say "Well, you just don't know what you're doing". You'd be right. I propose that maybe some of the people who crash Windows all the time don't either. I'm referring to Windows XP here, I used to have ME. Oh what fun that was... But seriously though, that wheels analogy made me laugh. I'm gonna stop replying about this particular topic now because it's gonna turn into a long argument that no one will win. My final thought on this topic will be: Is a base install (no updates, no additional software, nothin&#39 Mac OS or Linux Distro more secure than a base install Windows system? Yes, probably. Do they both have room for improvement? Yes.

[Kaniaz]

Well I'm really glad we're using Honda Civics and Beetles as a way to argue sensibly about the state of operating systems, because that makes so much sense. CARRY ON. We haven't even talked about the window wiper/sunroof functionality yet. EDIT: Goddamn guys, I want my sunroof functionality and I want it now.

[Ynot]

your windscreen wipers are incompatable with your steering lock please upgrade your steering lock

[ilovefrootloopz]

To make that anology right, people don't bother to steal the Honda Civics

[Leixor]

So does anyone find this information useful at all? It takes a while to write and I still have a lot left, I'm not really interested in continuing if no one wants me to. Let me know if you think it's helpful, useless, good, a waste of time etc. If a reasonable amount of people actually want it then I'll finish it, otherwise I'm done.

[Waite]

yeah, and its really to bad that both civics and beetles suck ass

[Leixor]

Well, no one really seems to want any of this information, so this project is postponed indefinitely. If in the future enough people request it that I feel it might be worthwhile, I'd finish it.

[TweaK]

Even though there's been going on a lot of discussion in this topic about security, I really like your guide. An antivirus application is not really needed though. I mean, fo really. I have no virusses whatsoever, and havn't had one in over a year, and I have not installed or had installed an AVG. How do I know I have no virusses ? Online scan. I scan my computer online for virusses once per 1-2 months, and I'm always clear. Spy and adware on the other hand.. I get tons of those.

[Leixor]

Even though there's been going on a lot of discussion in this topic about security, I really like your guide. An antivirus application is not really needed though. I mean, fo really. I have no virusses whatsoever, and havn't had one in over a year, and I have not installed or had installed an AVG. How do I know I have no virusses ? Online scan. I scan my computer online for virusses once per 1-2 months, and I'm always clear. Spy and adware on the other hand.. I get tons of those. [/b] Online scan is definitely a viable option, the reason I like AVG is the resident shield though. It also has unnoticable performance hit, and of course it's free. If you are using online scan as your virus protection, I really hope you are using an program access control firewall, like Zonealarm or some such. The reason is let's say you scan for viruses on January 1. On January 3 you get a trojan. If you've got a good firewall then you just realize what is up and deny the trojan access, do a scan and fix it. If not though that trojan can do it's nefarious deeds until you scan again. Also online scans don't provide easy on demand scanning. I download a LOT of stuff, all of it legally I might add . Even still I scan every file I download. As for your spyware/adware you don't say if you have a scanning app for that. If you don't I'd recommend Lavasoft Ad-aware. The pro's being it's fast and probably the most reliable. The main con is it has no on demand scanning. ewido anti-spyware was bought by AVG and they offer a free version which can do on demand scanning. Right now though it's detection is not as good as Ad-aware. It also has a resident shield function that prevents adware from ever getting on your PC but that's only in the paid version, the free version only does that for 30 days. I use both. Ad-aware for full scans (ewido's full scan is RIDICULOUSLY SLOW) and ewido for on demand scanning of downloaded stuff. I'm glad to hear at least someone appreciates my effort though, thanks. There is a ton more I could write and if a few more people appreciate it and ask me, I will.

[TweaK]

Online scan is definitely a viable option, the reason I like AVG is the resident shield though. It also has unnoticable performance hit, and of course it&#39;s free. If you are using online scan as your virus protection, I really hope you are using an program access control firewall, like Zonealarm or some such. The reason is let&#39;s say you scan for viruses on January 1. On January 3 you get a trojan. If you&#39;ve got a good firewall then you just realize what is up and deny the trojan access, do a scan and fix it. If not though that trojan can do it&#39;s nefarious deeds until you scan again. Also online scans don&#39;t provide easy on demand scanning. I download a LOT of stuff, all of it legally I might add . Even still I scan every file I download. As for your spyware/adware you don&#39;t say if you have a scanning app for that. If you don&#39;t I&#39;d recommend Lavasoft Ad-aware. The pro&#39;s being it&#39;s fast and probably the most reliable. The main con is it has no on demand scanning. ewido anti-spyware was bought by AVG and they offer a free version which can do on demand scanning. Right now though it&#39;s detection is not as good as Ad-aware. It also has a resident shield function that prevents adware from ever getting on your PC but that&#39;s only in the paid version, the free version only does that for 30 days. I use both. Ad-aware for full scans (ewido&#39;s full scan is RIDICULOUSLY SLOW) and ewido for on demand scanning of downloaded stuff. I&#39;m glad to hear at least someone appreciates my effort though, thanks. There is a ton more I could write and if a few more people appreciate it and ask me, I will. [/b] Yeah, you&#39;re right. But that kind of thing doesn&#39;t really happen to me. I have tons of internet experience, including crack downloads - which often contain trojans. I know what to watch out for. I am currently using Webroot SpySweeper as my anti ad/spyware application. It has an enormous pile of awards received, and I&#39;m loving it. It&#39;s like Norton in terms of features (not system resource hogging): I can scan on demand, but it also "live" scans. It has these features that are really nifty. For example, IE-Shield. Toolbars, Homepage changes, etc etc are being blocked by default, and you have to choose if you want to allow it or not. The same goes for applications that try to install stuff in your Boot directory, msconfig boot load, start menu, etc. So to say, it "live shields", rather than for example Spybot S&D that only scans when you click the Scan button. It has a huge spy-adware detection database. Personally, I didn&#39;t really like this application until I was kinda forced to use it. My mom bought it for her own PC, and she praised it into heaven. I thought Spybot S&D was fine, until I had very irritating adware that I could not locate. I tried Hitman Pro, Ewido, Lavasoft Adaware, Spybot S&D, and some other small spy-adware scanning applications. None of them detected it. I installed Spysweeper, as a last resort; Against my will kinda, but my mom insisted me to install it as she was convinced that would detect and remove it. Naturally, I wanted to prove her wrong, and installed it to show her it wouldn&#39;t detect it. ...It did. I was amazed and crapped myself. After changing my boxershorts, I removed the Adware, and now I&#39;m happily engaged with it. <3 Also, it scans pretty fast.