Include safe computing in your list of New Years Resolutions

The New Year is a time of reflection, and traditionally a time to consider changing one’s habits.

Our reliance upon computers and networks has exceeded our means to safely use and control them. Every computer user has some responsibility to make sure that their computer and use of the Internet does not introduce unknown and unwanted risks. By following these recommendations you will greatly reduce your risk to fraud, identity theft, and other risks related to Internet usage.

1. Change your passwords. Use strong passwords, which cannot be easily guessed by others, even those who know you. Do not share your password with any other person. If needed, store your passwords in a protected vault such as Password Safe or KeePass. I recommend you not use an online vault for password storage: if their security is compromised, so are your passwords.

2. Scan for Viruses and other malware. Configure your anti-virus software to scan your entire computer at least weekly. Make sure that your anti-virus software is checking for updates at least once per day. Also scan your computer with one of several online virus scanners at least once per month.

Panda: http://www.pandasoftware.com (look for the ActiveScan link on the home page)

Symantec: http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym

Trend Micro: http://housecall.trendmicro.com/

Kaspersky: http://www.kaspersky.com/virusscanner

CA: http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

3. Block spam, and don’t open spam messages. The majority of spam (unwanted junk email) is related to fraud. Spam messages advertise fraudulent or misleading products, or lure you to websites that contain malware that will attempt to take over your computer (without your knowing it) and steal valuable information from you.

4. Get a firewall. If you use Windows, turn on the Windows Firewall. Ask your broadband service provider to upgrade your modem/router to one that contains a firewall (most newer modems / routers do have firewalls or other similar protection).

5. Remove spyware. Obtain a good anti-spyware program and use it to find and remove spyware from your computer.

6. Update your software. Obtain up-to-date copies of browsers and tools on your computer, as many older versions are no longer secure. This includes Firefox, Internet Explorer, Opera, Microsoft Office, OpenOffice, Java, and other programs.

7. Install security patches. If you are using Windows, turn on Automatic Updates, and configure it to automatically download and install security patches and updates.

8. Use separate accounts on shared computers. If more than one person uses your computer, set up separate accounts for each user. Make each user an ordinary user or power user, but never an administrator. Making each user an administrator makes the entire computer more vulnerable to malware (viruses, etc.).

9. Browse Safely. Change to Firefox and use the NoScript add-on. This is the only combination designed to block the new “clickjacking” vulnerability present in all other browsers. Also consider using Flashblock (works only with Firefox) if you want to control the use of Flash content in your browser.

10. Protect your wireless WiFi network. The old an still-common “WEP” protocol designed to encrypt your wireless traffic has been broken, and is no longer safe. Upgrade to WPA, even if it means buying a new wireless access point.

11. Back up your data. All kinds of bad things can happen, from mistakes to hardware failures. If you cannot afford to lose your data, then you need to copy it to a separate storage device. External hard drives and high capacity USB thumb drives cost well below US$100. You’ll be glad you did, sooner or later.

12. Encrypt your hard drive. Mostly important for laptop computers, but also important for desktop computers. The TrueCrypt tool is by far the most popular one available, and it’s free. If you don’t encrypt your data, then anyone who steals your computer can (and will) read all of your private data.

13. Check your credit reports. Fraud and identity theft can result in thieves opening new credit card and loan accounts in your name. They run up a balance and then never pay the bill, making that your problem instead. Consider a credit reporting service as well, which will alert you to inquiries and changes to your credit accounts, limits, and balances.

Annualcreditreport.com

Federal Trade Commission information on free credit reports

Equifax

Experian

Transunion

Recommended Tools:

Secunia Personal Software Inspector – free tool that examines your computer and alerts you to all of the unpatched and older versions of programs that need to be upgraded.

Password Safe – safe and secure storage of all of your Internet passwords. Also remembers userids and URLs.

NoScript – the only way to control third-party javascript and clickjacking. Works only with Firefox.

TrueCrypt – safe and free encryption of your PC’s hard drive.

Change your Wireless network to WPA

Previous tip | Next tip

I have written in the past about how the old wireless WEP protocol is no longer safe. You need to upgrade your WiFi access point and the computers in your house that use WiFi from WEP to WPA. The WEP protocol that is still the default on most WiFi access points and routers can be easily broken by any clever computer user with a few simple tools.

Instructions: upgrade your router and computers from WEP to WPA.

Make a new year’s resolution: safe computing

I have an idea for a New Year’s resolution this year. You’ll still be able to eat what you want and walk by the bathroom scale with no pangs of guilt, and you can leave your mess in the garage and the junk drawer so full you can barely open it.

Make your computing safer in 2008. This is a lot easier than you think. You’ll be protecting yourself against potentially painful experiences such as credit card fraud and identity theft.

Follow these steps. In some cases, I’ll link you back to tips I’ve written in the past couple of years.

1. Protect your computers with a firewall. You might have a firewall already and not know it – your DSL or Cable modem may have a firewall built-in. Look on the label to see what kind of device you have. Log in to your Internet provider’s web site and check whether your modem has a built-in firewall. If it doesn’t, ask to be upgraded.

You can also install a personal firewall program on each PC in your house. If you have Windows XP or Vista, a firewall is provided with Windows but you need to activate it.

Instructions: Activate Windows XP firewall. Activate Windows Vista firewall.

Or, you can install Zone Alarm or Comodo firewall. Both are easy to install and use.

Zone Alarm: www.zonelabs.com
Comodo: www.personalfirewall.comodo.com

Test your firewall to see if it is working: Site 1: (www.auditmypc.com), Site 2: (www.grc.com/) (You can consider these to be trusted web sites).

2. Get the spyware out and keep it out. Spyware is used to snoop on your PC and Internet usage – most people find it offensive and a violation of their privacy. Install one or more of the following anti-spyware programs. Scan your computer now, then scan monthly after that.

Spybot: www.safer-networking.org
Spyware Blaster: www.javacoolsoftware.com
Microsoft Defender: www.microsoft.com

3. Keep your PC’s security patches up to date. Failure to install security patches is a major cause of computer break-ins, especially for home computers, most of which are not protected by firewalls. I recommend you take a look at your Windows Automatic Updates setting and change the settings so that security patches are downloaded and installed automatically (if you are more of a “hands on” computer user, then you should set Automatic Updates to automatically download security patches and then inform / ask you to install them).

Install patches now (www.update.microsoft.com) (you must use Microsoft Internet Explorer for this)

Instructions: Configure Automatic Updates for Windows XP. Automatic Updates for Windows Vista.

4. Make separate user accounts for shared computers. If any of your computers are shared among family members, make separate user accounts for each user. Put passwords on each account and do not share your passwords. Make only one account an “administrator” (you – since you are reading this!) and make all other users a “Limited account”. Turn off the Guest account.

When a family member is done with the computer (even for a minute), get everyone into the habit of locking the screen, which requires a password to unlock. Click here for instructions.

5. Change your Wireless network to WPA. I have written in the past about how the old wireless WEP protocol is no longer safe. You need to upgrade your WiFi access point and the computers in your house that use WiFi from WEP to WPA. The WEP protocol that is still the default on most WiFi access points and routers can be easily broken by any clever computer user with a few simple tools.

Instructions: upgrade your router and computers from WEP to WPA.

6. Clean out your old programs. Take some time to remove old programs that you no longer use, and upgrade the programs and plug-ins you do use to current versions. In Windows XP, go to My Computer > Control Panel > Add or Remove Programs (in Vista it’s slightly different) and remove each program you no longer need. Maybe you have old toolbars and other things you tried out but didn’t like. It’s a good idea to just get rid of them here.

Consider getting a copy of Secunia Personal Software Inspector (PSI). This nifty program will look at all of your installed programs and tell you which ones are old and unsecure. PSI will also tell you what patches are needed on your system.

Get PSI here: psi.secunia.com

7. Learn more about safe computing. Order a copy of Computer Viruses for Dummies – this is a smaller-format Dummies book that talks about Viruses and also spam, spyware, firewalls, and other steps you need to take to make your computer safer.

Purchase hardcopy from Amazon.com

Purchase e-book

Retailers not learning from the TJX breach

Submit:

By George Ou / ZDNet

When I blogged earlier this week about TJX‘s failure to secure their wireless LAN and how it may end up costing TJX a billion dollars, I knew that it was merely the tip of the iceberg with so many retailers still running WEP encryption. As if WEP wasn’t already broken enough, WEP is now about 20 times faster to crack than in mid-2005 when TJX’s WEP-based wireless LAN was broken and I knew from experience that most retailers were still running WEP. I decided to stroll through town and check on some of the largest retail stores in the country to see how they’re doing today. The reason I looked at the large retailers is because they’re the big juicy targets with millions of credit card transactions that the TJX hackers love. What I found was truly disturbing and I’m going to tell you what I found.

Lowes… Sears… J.C. Penney… Macy’s… Best Buy… PetSmart… Office Depot…

Most are doing poorly.

Entire article here:

http://blogs.zdnet.com/Ou/?p=487

How to upgrade your WiFi to WPA

Read this advisory if you are not sure why you would want to move from WEP to WPA.

To do this, you’ll need to change the configuration on your wireless access point (which may be the same device as your broadband router), as well as every computer that access the Internet – wirelessly – through that access point.

Find your brand of wireless access point below:

DLink

Linksys

NetGear

ActionTec

If you have a link or a procedure and you want it listed here, contact me. I’ll even give you credit! Or, put your link/procedure in the comment fields below.

Find your version of Windows below:

Microsoft Windows XP

Microsoft Windows Vista (sorry, I can’t find a decent page on Microsoft.com)

WEP cracked, time to move to WPA

Last week, some German researchers promised to demonstrate how they could crack WEP in under a minute.

They did it.

Using a 1.7GHz laptop, they cracked WEP in under a minute, 95% percent of the time.

Wow. And we thought WEPCrack was good.

By summer, I’m sure that there were be a nice selection of new WEP cracking tools available that can harvest WEP keys almost as fast as we can drive by them. Heck, there might even be a PDA version.

It’s time to switch to WPA. Now. Most newer access points support it. It’s not hard. Go to this page for links on popular access points and Windows.

Don’t wait.

(Update: the TJX intrusion was through WEP. Still not convinced?)

Sources:

http://www.darkreading.com/document.asp?doc_id=121412

http://www.darkreading.com/blog.asp?blog_sectionid=415

http://searchsecurity.techtarget.com/columnItem/0,294698,sid14_gci1250687,00.html

http://www.theregister.co.uk/2007/04/04/wireless_code_cracking/

Cell phones can be used as bugs

Many of today’s cell phones can be used as bugs, invading your privacy. The reasons for this can range from snooping and practical jokes to industrial and political espionage. This is usually accomplished in one of two ways:

1. Phones can be set to ‘silent ring’ and ‘auto answer’, and hidden in some specific location. Later, the perpetrator simply calls the hidden phone, which turns into an instant transmitter.
2. Phones’ embedded programming can be altered to turn them into receivers – effectively turning your own phone into a bug so that someone else can listen in on your conversations. This is theoretical today – I do not believe this has ever actually been done. But as cell phones become “smarter” (more like tiny Windows systems than phones), sooner or later the writers of malicious code may figure out a way to produce a cell phone “virus” that will turn a phone into an illicit transmitter in order to eavesdrop on people. This video, while somewhat humorous, makes a good point.

New article on this topic:

http://www.komotv.com/news/11847636.html

This is yet another example of technology with unintended consequences that is subject to abuse. More here.

Urgent security alert: home routers vulnerable to attack

Submit:

Urgent security alert: home routers vulnerable to attack

Security researchers have discovered an extremely serious vulnerability in virtually all brands of home routers that makes them vulnerable to the kind of hacking that can lead to fraud and financial losses by large numbers of persons.

I urge you to change the default password on your home router as soon as possible. Only routers with no password, or the default password, are vulnerable.

Instructions for changing passwords on the most popular routers here:

D-Link

Linksys

Netgear

I am sure that more than 90% of home routers are running full default settings, including administrative password. This is due to their success: routers today are virtually plug-and-go, with no need ever to log in to make changes. Well, this success could lead to their downfall.

Read articles here:

http://news.com.com/2100-7349_3-6159938.html?part=rss&tag=2547-1009_3-0-10&subj=news

http://www.pcmag.com/article2/0,1895,2095313,00.asp

http://www.symantec.com/enterprise/security_response/weblog/2007/02/driveby_pharming_how_clicking_1.html

http://computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9011339&taxonomyId=17&intsrc=kc_top

http://www.darkreading.com/blog.asp?blog_sectionid=342&WT.svl=blogger1_3

Many of Cisco’s routers are vulnerable to this attack. Story here:

http://www.networkworld.com/news/2007/022007-cisco-says-77-of-routers.html?nlhtbug=0219bug2&company=

Cisco advisory here:

http://www.cisco.com/en/US/products/products_security_response09186a00807e392f.html