Computer Learning Center
Internet Security
"(Computer) programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning."
- Rich Cook
From http://jersey.uoregon.edu/~mstrick/GeoMan_Quotes.html
Resources
Introduction. There are a number of security resources listed on the Computer Learning Center web page at http://lo-clc.org. From the main page, click on the Resources link in the menu bar on the left. In the Resources Index at the top of the page, select Internet Links. All of the web sites mentioned in this presentation are listed on the CLC Resources Page so it is not necessary to take notes on the links mentioned during the presentation.
Resources specifically covered below include:
Adaware (Pests and Ads)
Pest Patrol (under Pests and Ads)
Zone Alarm (under Pests and Ads)
CIAC HoaxBusters (Security)
PCPitstop (Security)
AVG Antivirus, AKA Grisoft (Security)
Symantec, AKA Norton (Security)
CAUCE Coalition Against Unsolicited Commercial Email (Security)
[top of document] [top of page]
Microsoft Settings
Microsoft’s attempts to offer protection to your computer are, as of now, limited and superficial. These include:.
A passive firewall (see Firewall discussion below)
Security settings in Outlook Express
Stick with the Defaults, except:
• uncheck the box next to “Do not allow attachments to be saved or opened that could potentially be a virus.
Leaving the box checked just stops you from receiving many legitimate attachments and is no substitute for an antivirus program.
Security and Privacy settings in Internet Explorer
Stick with the defaults. Changing to more restrictive settings may interfere with normal activity wihout providing the protection you need.
Pests and Ads
Pests and ads are files that sneak into your computer when you are browsing the internet. They are planted there by web sites that want to keep track of you and your browsing habits (at best) or want to extract information about you and your finances and passwords (at worst). In between are sites that plant ads on your computer and hijack and redirect your browser to their sites. These files often come in the form of “cookies.”
Cookies are a legitimate tool of many web sites. They are used to help the web site keep track of usage for reasons that can benefit you, the user. They are also used to keep track of some of your information to you do not have to re-identify yourself to a site you visit often and interact with. For example, if you do online banking, your bank’s web site places cookies on your computer to make your banking experience easier on subsequent visits.
However, cookies are also a tool used by websites to gather usage information to sell to advertisers, to suggest other sites to visit that they have decided fit with your browsing profile, as well as other less savory practices. Such web sites may also place other, non-cookie files on your computer to get information about you and control your web browsing experience.
There are many products available to control ads and pests, including those listed on the CLC web site. The most well know free program is called Adaware.
[top of document] [top of page]
Adaware
You can download Adaware free from the Adaware web site. As with other “Free” programs, Adaware also has a version for sale that includes many features not activated in the free version. Whether you choose to purchase this program, use the free version, or purchase another pest control program is up to you. However, you should have some type of pest control on your computer.
The important thing to know is that your anti-virus program does not detect or block these “bad” cookies, or other ad or pest files. They are not technically viruses. However, most antivirus vendors now offer additional protection (for a fee, or course) from these pests. For example, Norton (Symantec) offers an Internet Security package that includes pest protection, among other things.
What does the free version of Adaware do?
After installation, Adaware resides on your computer waiting to be executed by the user. Upon execution, it scans your computer for bad stuff, lists the bad files it finds, and deletes them, if you direct it to do so. Note that Adaware does not function in the background monitoring your internet activity. You have to run it to check for and delete pests. Adaware does not detect all cookies, but only notifies you about those that it determines do not have a legitimate purpose. This protects you from deleting legitimate cookies.
In addition, the Adaware site contains a lot of good information about pests: where they come from, what they do, and who is behind them.
[top of document] [top of page]
How do you download Adaware?
Go to the Adaware web site (from the link on the CLC web page), then select Software | Adaware
Read the information on the page, then click on the Download area on the right
Again, read the information on the page, then select Ad-aware6 from Download.com. (You may want to go back to this page and download any available plug-ins as well.)
Click on the Green Download Now button
Choose where to save the downloaded file (I recommend that you create a folder called “Downloads” in your “My Documents” folder.)
After the download is complete, double click on the file to install the program.
Demo
This presentation includes a demo of Adaware, including
download
scan
delete detected files
setup
Plug-ins
The Adaware site also mentions that there are plug-ins available that perform additional protective functions. Read the information and download and install those that are available to work with the version of the program you selected (free or paid).
[top of document] [top of page]
Cookies (Changing your security settings)
Ads and pests often get into your computer in the form of cookies. Your web browser allows you to change the way it responds to cookies. (See in Internet Explorer: Tools | Internet Options | Privacy. You can more the slider to change the level of protection.) However, I haven’t found this to be a particularly helpful way to protect against bad cookies while still allowing convenient browsing. However, it is worth a look.
The default setting is Medium.
You can Edit cookie handling defaults by adding a web site to the always blocked or allowed. (click the Edit button.)
The best way to find out if relying on this Privacy protection works for you is to pick the setting that works for you and doesn’t mess with the web sites you trust. After a few days of browsing, run Adaware to see how many advertising cookies got past the security.
Pest Patrol
Pest Patrol is an anti-pest program that requires a purchase. I mention it because I used it for a while before I bought the Norton Internet Security package and it worked quite well and was easy to install and use. The website contained an extensive library of pests and I learned quite a bit by using the program and checking for more information on detected pests.
[top of document] [top of page]
Conclusion
Once you start checking for ads and pests, you become much more aware of what is lurking inside the web sites you visit. This is particularly true of many of the “Free” programs and services you find on the internet.
Firewalls
Anti-pest and anti-virus programs alone do not provide full protection for your computer. Malicious programs can sneak into your computer through the gaping hole created by your internet connection. Firewalls are programs designed to monitor activity at that gap and only allow entrance to invited guests. WindowsXP includes a rudimentary Firewall. Most anti-virus programs also offer a firewall for an additional cost. If you are looking for a free program, one is available from Zone Alarm.
Windows Firewall
Although this function is included as part of WindowsXP, it is not automatically activated. You must turn it on. Instructions are available in Help and Support, and also on the CLC web site at Resources | Internet Links | Security.
The Windows firewall is better than nothing, but is passive and only protects one way, against incoming intrusions.
Zone Alarm
Zone Alarm provides much better protection, and is discussed here because it is free. It protects both ways, against incoming intrusions and outgoing leaks. (It also has a “Pro” version with more functions that you can purchase.)
[top of document] [top of page]
What does Zone Alarm do?
Zone Alarm operates in much the same way as your anti-virus program. You load the program and then immediately look on the web for updates. This adds any new information developed since the download file was created. Then, the program checks for updates when you go online so new intrusion methods or programs are added to its database.
Zone Alarm operates in the background, monitoring your internet connection. It refuses attempts at stealthy invasion, and asks your permission before allowing even straightforward attempts to make contact with your computer. In addition, it also monitors outgoing communications and asks permission before allowing the contact to be made. This prohibits a program that might have been planted earlier from harvesting personal information from your computer and broadcasting it to its programmer.
How do you download Zone Alarm?
Go to the Zone Labs web site (from the link on the CLC web page), then click on the Free Download button
For the free version, click on Download Free ZoneAlarm
Choose where to save the downloaded file (I recommend that you create a folder called “Downloads” in your “My Documents” folder.)
After the download is complete, double click on the file to install the program.
Demo
This presentation includes a demo of Zone Alarm, including
download
install
settings
Other Firewalls
Check your anti-virus program’s web site for information on its firewall (if one is available.) I use Norton Internet Security. It provides a firewall and protects against intrusions, spam, ads and pests.
These programs, and Zone Alarm require some additional attention from the user. You must read all the information and help the program learn your system by allowing or blocking attempts to communicate to and from the internet. This requires some effort at the beginning, but less as time goes on and the programs to allow communication with web sites you trust.
[top of document] [top of page]
Anti-Virus
Anti-virus programs were the first protection programs available for computers. Even before the internet was popular, viruses were a threat. They were transmitted in shared files, usually arriving in your computer from a floppy disk. Now, the most likely transmission mechanism is email. However, they can still sneak in other ways. This is why anti-virus protection from your email provided is not enough to protect your computer. You must still run an anti-virus program even if your email is already secure.
Several anti-virus programs are listed on the CLC web site, including two free programs. Grisoft (AVG) is used by many CLC members and is highly recommended by them. You can find a link to the AVG site on the CLC web page.
In general, most programs contain the same basic features and you should examine your program to confirm that these settings have been configured to operate as automatically as possible.
Definitions Update
Anti-virus programs can only catch the viruses they know about. The strength of an antivirus program is at least in part measurable according to the quality of its definitions. If the virus gets to you before the new definition is loaded into your antivirus program you are toast. Therefore, make sure your program searches for new definitions automatically whenever you connect to the internet.
Automatic Protection
Confirm that your program is always running in the background, monitoring email and other activity.
[top of document] [top of page]
Scan your System
You can set up your anti-virus program to automatically scan your computer: all drives and files. How often this is done depends on you work patterns. I set the scan to run every day, but will probably eventually tire of that and run it once a week. The important this is to schedule the program to run automatically and then make sure your computer is turned on at that time. Do not assume that you will remember to run a manual scan. See Checking Your Computer below for information on other methods of scanning your computer for viruses.
Script Blocking
Web pages can hide unwanted scripts that execute under specified circumstances, perhaps loading onto your computer and redirecting your browser to a specific site, or causing your computer to perform malicious activities itself. Make sure script blocking is activated, if available.
Email scanning
Set up your program to scan both incoming and outgoing email messages and attachments.
[top of document] [top of page]
Instant Messenger monitoring
Instant messenger programs allow real-time communications back and forth between computers. Your antivirus program should monitor these communications.
Program Updates
Look for a Live Update feature that finds and downloads any updates to your program. When asked if updates should be installed, respond in the affirmative.
Subscription Updates
If you paid for your program, or received a free trial, eventually you will receive a message from the provider telling you to update your subscription. In order to maintain protection of your computer, you must update the subscription, or load one of the free programs. Do not let your protection lapse.
Demo
The CLC computers are protected by Norton’s Corporate Edition so we will look at the settings on that program.
Checking your computer
Even if you have trustworthy software running it is a good idea to check on your system occasionally.
Virus Scan
Most antivirus program web sites will perform a virus scan on your system for free. Just make sure you are using a legitimate site. Confirm this with research or recommendations for people you trust. (us of course) Check the free scan links on the CLC web site.
[top of document] [top of page]
PCPitstop
PC Pitstop will perform comprehensive tests on your computer for free. This is not a violation of the rules cited in the conclusion. When you read the site you can understand what they are doing a how they are supported. In any event, run a pcpitstop test every six months or so, or more frequently if you are particularly active.
You can find the link to PCPitstop on the CLC Resources page
Demo
We will test the CLC teaching computer as part of the presentation.
Other information
Virus Hoaxes
As if we did not have enough problems already, you can’t even trust a notification about a new virus. Such notifications come in emails, usually from a friend who has forwarded a notification he or she received. These are almost always a hoax. Never trust an email notification about a virus without doing independent research. The best place to start with your research in the CIAC HoaxBusters web site. You can find a link on the CLC Resources page under Internet Links | Security. This site posts information about recent hoaxes and has a lot of good information.
You can also find information about hoaxes and new viruses on your anti-virus program’s web site. Links to sites are posted on the CLC Resources page under Security.
Spam
We do not have time to deal comprehensively with Spam. The best information on this topic is located at the CAUCE (Coalition Against Unsolicited Commercial Email) site. You will find a link on the CLC web page: Resources | Internet Links | Research/Resources.
Some things to watch out for:
messages from people you don’t know with subjects that don’t make sense
messages without subjects
messages offering something free
[top of document] [top of page]
Protect email addresses
Don’t forward
Think twice before taking any action that would publicize anyone’s email address, such as forwarding a message that includes many addresses from previous forwards. If you think the email is worth it, and your friends will want to receive another “humorous” or “informative” forward, cut and paste the content into a new message so you don’t multiply the exposure of previous senders and recipients to someone down the line who collects email addresses specifically for the purpose of sending spam.
Don’t post
Don’t post an email address in a forum or chat room. Spammers can “harvest” those posted emails.
Note: posting is different than submitting your address as part of a form for a legitimate site. That information does not sit on the web site. It goes to the server and is saved “behind” the site.
Read privacy policies
I know you do not want to, but if you are in doubt and really want to post, at least first read the sites privacy policy. What do they do with the info they receive. Do they sell it or give it to advertisers or web ad companies. See the mottos/quotes in the conclusion for reinforcement.
Disclaimer
These materials are intended for use in conjunction with a CLC Users’ Group presentation and not as a stand-alone resource.
Conclusion
The internet is a wonderful and dangerous place. As you enjoy all of the wonders, the best rule to follow is one I learned from my extensive science fiction reading:
TANSTAAFL (pronounced tanstaffel): There Ain’t No Such Thing As A Free Lunch.
Robert A Heinlein’s The Moon is a Harsh Mistress.
or, another favorite from Harry Potter and the Chamber of Secrets.
Never trust anything that can think for itself if you can't see where it keeps its brain.
Mr. Weasley to Ginny, after her experiences with the Heir of Slytherin
or, from Hill Street Blues
Be Careful Out There.
Sarge
[top of document] [top of page]
Update 1/24/2005
Links and information have been added to the CLC Resources web page, including the following from Resources | Internet Links | Security Info
Security has become a vital issue for computer users. The following links provide information about this issue from various sources. See Security Software below for links to specific programs designed to protect your system. At the very least, you should do the following to keep your Windows XP system secure.
1. Protect from pests and ads loaded onto your computer without your knowledge or consent: (see pests and ads above)
2. Install a third party firewall that provides two way protection. (see Security Software: Firewall below)
3. Install and automatically update an anti-virus program (see Security Software: Anti-virus below)
4. Keep your software updated by turning on the automatic update function.
Also note information about Service Pack 2, Spam, Free software, new additions to Pests and Ads, Windows Startup and Windows Update
[top of document] [top of page]
|
