Legal Research

Botnets, Zombies, Malware, Trojans, Spam, Phishing … Oy!

There’s an interesting article in today’s NY Times about botnets — networks of “zombie” PCs that have been compromised by malware such as Trojan Horses — that are being used by criminals worldwide to distribute spam and carry our phishing attacks.  Here are some highlights:

• For an unprotected PC connected to the Internet, the mean time to infection is less than 5 minutes.

• The largest botnet may control several million PCs.

• The best security software detected only about 20% of all possible vulnerabilities.

This last bullet point leads me to a book I just received in the mail, Crimeware: Understanding New Attacks and Defenses, from Symantec Press.  Chapter 13, which I happened to read yesterday, is entitled “The Educational Aspect of Security”.  In it, the authors state why security software isn’t a magic bullet:

“The problem is neither entirely technical nor entirely social in nature, but rather a combination of the two, and numerous security vulnerabilities are associated with this combination.”

In other words, the best security technology can fail because people can be gamed.  Why?  Security info is often aimed at the technically-savvy user, yet at the same time dumbed-down so that the general population doesn’t tune it out.  Example: “Always enable encryption for your home wifi network.”  This is useless advice unless it covers (a) how to do it, (b) why you want to use it, (c) its limitations, and (d) other, related issues, such as the need to create a strong password for your home router.

So in this spirit, let me give you 7 computer security tips to live by:

• No matter which operating system you use — Windows (XP / Vista), Mac OS X (Tiger / Leopard), or Linux — you should turn on the firewall that comes with the operating system, especially if you often connect to wifi networks in public places.  Firewalls keep computer intruders out.  Windows users should also install a virus checker and adware remover.  Keep the software current by applying updates or it will not be able to spot new threats.  Mac/Linux users don’t need to worry about virus/adware threats for now.

• Keep your operating system up-to-date.  It will alert you when “patches” are available.  Install these asap, otherwise bad guys will exploit known vulnerabilities.

• Don’t leave your laptop unattended in a public place, such as a Starbucks or the airport.  Ever.  It’ll walk, trust me.

• Create a strong password for your laptop and each online account you have.  It should be at least 15 characters in length, contain upper- and lower-case letters plus a number or two, and should not be a common phrase such as “Beam me up Scotty”.  A strong password will resist a “dictionary attack”, in which a hacker literally tries all of the known words, names, and popular phrases in response to the password prompt.  Don’t reuse passwords — once one of them is compromised, the attacker will try them everywhere else.

• Unless you’ve done some research on how phishers camouflage their Web addresses, do not click on links in email messages.  The only exception to this is if a trusted source has told you that he/she/it will send you a particular useful link and you get the email immediately thereafter.  What does “trusted source” mean?  Someone who is known to you, and whose technical competence is such that he/she/it wouldn’t send you to a bad Web site.

• When checking your email on the road, consider using an encrypted connection so that someone can’t snoop on your passionate love letters important business communications.  Google’s Gmail service lets you use https, which is a secure connection.

• And, yes, you should encrypt your home wifi network.  It will keep strangers out of your network unless they know the password.  WPA is stronger than WEP, but WEP is better than nothing.  Your router’s manual will tell you which you can use.  And you should change the router’s password — the default passwords for most routers are well-known and hackers can use them to try to gain access to your system.

Full post as published by Jenkins Webblits on October 21, 2008 (boomark / email).