Stamp Column Archives

Glassine Surfer October 2004

Prevention and Online Security

Online security and prevention is a major area of concern for you, the federal government, your bank, and your employer. So much communication, sensitive and otherwise, flows over the internet, that it's nearly impossible for some businesses and services to function without them, though just ten years ago the 'Net was just something new.

The problems of online security and prevention can be traced back to the nature of the 'Net itself, which was originally set up for the U.S. military and research institutions to share information. The grandpappy of the 'Net, the Advanced Research Projects Agency Network (ARPANET) of the U.S. Department of Defense, operated in a secure, closed enviroment, where everyone had a security clearance and no one operated in anonymity.

Free and clear, redundant multi-channeled communication was the goal and task, and it could work in a high-level secure enviroment. Then things changed as more and more access was given to more and more researchers and college departments, and more and more material became accessible online. Today, the 'Net essentially operates on the same technical foundations that were devised in the 1970's, but let's just say that everything else has changed.

Today, it's up to each user to preserve, protect and defend their own piece of the internet from viruses, spyware, hijackings, and spam. In this case, you're your own internet cop. It's not hard. It's not expensive, but it potentially will save you countless hours of exasperation, worry, and perhaps cash.

The basic strategy for online security is to install the essential software to prevent unwanted intrusions before the intrusion and keep abreast of the latest troubles, so let's start with the basic intrusions.

Viruses

The most common intrusions are computer viruses. They're just programs that copy themselves onto computers. Though some are only pranks, some destroy files, disable systems, or search for sensitive personal and financial information. Melissa was a virus that spread at the speed of light, or so it seemed, and there have been countless thousands of others like the "I Love You" and NIMDA viruses.

Trojan horses are associated with viruses, but Trojans describe a virus delivery system, where the virus masquerades as another desirable program to impliment installation.

Parasites

Sticking with the disease and malady comparisons, the next large class of intrusions is parasites. These are unwanted, usually unsolicited, programs that perform a variety of stealthy, perhaps underhanded, commercial functions. They're typically stuffed into free 'Net downloads and other applications.

Parasites have many subclasses, headed by spyware which when attached to a computer collects and sends data about the user's Web browsing back to the parent firm. There's adware, which delivers ads, popups, or sends your browser to certain sites associated with the adware's parent. Scumware adds the parent's advertising links to web pages the user visits.

Hijackers change homepage or search settings to send users to sites associated to the parents. Some go so far as to prevent users from correcting the hijack. Keyloggers record your keyboard inputs and sent them to the parent. That'll reveal your logon's and passwords if they're in that log. Diallers use your modem to call pay-per-call phone numbers to generate money for the parent at the users expense. They're all parasites.

Besides the obvious intrusion effects, parasites can have bad side effects. They can leave your machine open to further attacks and security lapses, or slow down your system and programs. They're a bad cornucopia.

Annoyances

Somewhat related but in a generally less harmful class are spam and pop-ups. Pop-ups open an unannounced browser window loaded with an ad on top of your original browser window. The derivitive is the pop-under, which sneaks a new window under. Both can be killed by clicking the "X" in the upper-right corner. On the other hand, they could have been spawned by a parasite (adware) program.

Spam is Unsolicited Commercial E-mail (UCE) or junk e-mail. It's just like the junk USPS calls bulk mail, though the content of spam tends to be a bit more on the nefarious side. The name for UCE derives from a skit in an episode of Monty Python's TV show in which a Viking cafe features "egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam; spam bacon sausage and spam; spam spam spam egg and spam; spam spam spam spam spam spam baked beans spam spam spam..."

Prevention of Viruses

Anti-virus (AV) software is essential. Without it you're a sitting duck. There are now several top-rate companies running up-to-date anti-virus programs and services that constantly monitor, test, and update their software services. Most new computers come with some sort of pre-installed AV software that will run for the trial period, but many people allow their AV to lapse. And when it does, they usually are very less well protected for viruses are a moving, mutating target.

Just a few days after the I LOVE YOU virus pandemic broke out several variants were spotted, but the scariest thought of all was that this juvenile Halloween prank ripped through the internet much faster than the techs in the white hats could catch up with it. The speed that viruses spread and mutate used to be a matter of days. Today, it's more like a question of hours. Update your AV software twice a week and keep an eye on news alerts about fast-moving AV threats.

Beyond good AV software habits, there's two things you can do on your end. First, don't open any e-mail attachments that aren't clearly marked as unique to you and described to you in the e-mail from a known source, and if you're not sure about the workings of your PC, request plain text versions of .doc files rather than run the risk of a Word macro virus. (And naturally, you've set your AV software to scan all your incoming mail.)

An infection tactic of many viruses is to replicate itself and use the infected user's e-mail address book to send copies to the user's friends, family, and business associates, and good ole Tom in accounting has no idea what's happening.

Your second exercise in self-control is not to click on spam. Yes, it may look good, but is it good for you? No, it's not, so don't be tempted. The temptation is generally part of the spammers tactic and viruses are often delivered in otherwise meaningless spam. That old I LOVE YOU virus was so named because that was the e-mail subject line, which everyone fell for. Hopefully, your AV software caught the infection, but the AV might be 12 hours behind the latest virus festering in the new spam.

Network Associates, AV software
http://www.nai.com/

Symantec, AV software
http://www.symantec.com

F-Secure
http://www.f-secure.com/

CERT, Net security
http://www.cert.org

Trend Micro's free on-line virus scanner
http://housecall.antivirus.com/

spamlaws
http://www.spamlaws.com/

Prevention of Parasites

In the beginning, there were viruses, and on the second day hackers created parasites. Combatting parasites is an equally important part of your daily online diet because they can potentially cause as much harm to you as a virus. Luckily, there are many good companies providing anti-parasite (AP) software, though like AP software, it has to be regularly updated to be as good as it should.

The most well-know AP company is Lavasoft and their Ad-Aware software. Easy to download, update, and install. It's straighforward and no nonsense. It scans your memory, registry and hard drives for known spyware. If you want some basic protection and want to get comfortable with AP matters, this is a good place to start.

A more robust AP program is Spybot Search and Destroy. It does the same job, but Spybot seems to be more severe about what it classifies as a parasite. I ran Ad-Aware before I first ran Spybot, and Spybot reported more parasites to remove. Spybot likes to look at your Windows operating system registry, where many parasites like to hide. This AP is one that you shouldn't use lightly. Read and be familiar with how it works.    

Both the free Ad-Aware (as opposed to Ad-Aware pro) and Spybot clean up parasites on your machine. One or both of them are good to have at hand. On the other hand, Spyware Blaster tries to stop parasites from getting onto your machine in the first place, which is the tactic most AV software uses.

Spyware Blaster works by watching your browser (IE and Mozilla/Firefox). When an intruder tries to enter the system, it stops it, and like the others, it should be updated regularly.

If you don't have any AP software on your machine and are curious, you can visit the doxdesk website. You could have parasites and not know it. That's the parent's intent. Otherwise, you'd already have eliminated them.

The doxdesk webmaster has written a simple script that can report parasites on your browser when you visit his site. If it detects a parasite, it will tell you it did. It won't try to remove it, or sell you a service that does. If you don't have any parasites running on your system, you'll get a simple message: "Your browser has been checked for parasites. None were found."

If you're not interested in the free scan, the site is loaded with data on the source of and solution to these stealthy programs that may be working on your machine.

Spybot Search and Destroy
http://www.safer-networking.org/en/index.html

Unsolicited Commercial Software detector
http://and.doxdesk.com/parasite/

Ad-Aware
http://www.lavasoftusa.com/

Spyware Blaster
http://www.javacoolsoftware.com/index.html

Firewalls

We guard against viruses and parasites, but there are intrustions that do not come to your machine through e-mail or your browser. For them, you have to have firewall protection for your computers ports.

When you connect to your internet service provider your computer accesses and is accessed on the Net via its ports. They are operating system software addresses necessary for various input/output. There are thousands of them, and the only way to stop inappropriate access to your computer is to protect it with a firewall.

When a computer logs on to the 'Net it gets an IP number so that Websites can send data to the right machine address. Hackers can trace addresses and try to get in through the open port. Once in, the problems they can create depends on the intent and talent of the hacker.  

Firewalls block or close open ports against unwarranted access. Every business and institution and many private users have firewalls, and you need one too.

Like AP software, you can get free firewalls, pro-level ones, or sophisticated suites that bundle AV, AP with a firewall, but if you're in the dark, don't wait. Get a free firewall for some basic peace of mind. Later, you can see if you need something beefier.

Black Ice Defender, ZoneAlarm, Freedom, and Sygate Personal Firewall are some firewalls. They monitor the ports you use to send and receive on the 'Net, block access to unused ports and only allow user-determined levels of activity to occur over the internet.  

ZoneAlarm is free for personal home use and is very easy to work with, while some other programs require more understanding of internet connectivity. When set up a firewall hides your ports from the rest of the 'Net. You'll be able to access and send data you want, but all other intrusions will be stopped before they occur. Remembe to update as needed.

ZoneAlarm
http://www.zonealarm.com/

Black Ice Defender
http://www.networkice.com/

Sygate Personal Firewall
http://www.sygate.com/products/shield_ov.htm

Freedom
http://www.freedom.net/

One note to new firewall users: if an internet program of yours isn't reaching the 'Net, your firewall probably needs to be told to allow it port access.

Updating Applications

By now, we've gotten our innoculations and closed the door against intruders. Now, we have to turn our attention to our trusty browser and e-mail programs because they're sometimes not so trusty and hackers target the vulnerabilities within these programs, as an easier means of access and infection.

All browsers, e-mail applications, and other software are liable to have latent security holes within them. Some are more porous than others, and some are much more intensely hacked than others. The more popular: the more they are hacked.

Microsoft's success in intergrating its PC operating system, Office suite, and other applications, such as its e-mail program Outlook, along with its ubiquitious browser have made it a prime target for hackers. Essentially, all are linked to each other, so that an opening in one can lead the hacker into the other programs. This is the reason not to open Word formatted e-mail attachments without explicitly knowing their source, or the reason why Outlook needs as much patching as Internet Explorer.

Every internet application should be updated on a regular basis. If there's a patch, there's a good reason for it. Lately, some applications have undergone regular patching in a never-ending game of hacker catch-up. The popular IE update is located on the toolbar under Tools | Windows Update.

Some users have taken a contrarian approach to application popularity, and have switched to a hodge-podge of other unassociated applications from different and disparate companies. Though no program is ever totally secure, non-intergration can help isolate security breaches and limit damage. It's like closing water-tight doors after you've been torpedoed, and it might help save your ship.

Some excellent alternative browsers are Mozilla's Firefox and Opera. E-mail programs, such as Mozilla's Thunderbird, Eudora, and Pegasus, are excellent.

Mozilla's Firefox
http://www.mozilla.org/products/firefox/

Opera
http://www.opera.com/

Mozilla's Thunderbird
http://www.mozilla.org/products/thunderbird/

Eudora
http://www.eudora.com/

Pegasus
http://www.pmail.com/

Browser Settings

Currently, Internet Explorer by Microsoft is the browser used by an overwhelming majority of the world, and IE is really old in terms of security. Microsoft was going to unveil a new browser when it releases its new operation system, but in light of the year's stack of security patches, the company may bring out a significant upgrade to IE before the new OS.

Before then, if you use IE, you should know something about the security settings located at Tools | Internet Settings | Security (tab) | Custom Level (button). There are six main groups: Active X, Downloads, Microsoft VM (virtual machine), Miscellaneous, Scripting, and Logon.

Active X is a Microsoft Web programming script that acts something like Java. The best setting for this is either disable or prompt all the buttons under Active X. If you set to "prompt," every time a website tries to load an Active X component to your browser, you'll be asked if you'd like to accept it. If you set to "disable," it won't be loaded and you won't be prompted.

One of the hazards of Active X is the "driveby download," whereby a website installs some parasite without you knowing it. “Disable" at “download signed ActiveX controls” and “download unsigned ActiveX controls” will stop the download. "Prompt" at the same buttons will let you see what sites try to foist a parasite on you.

Microsoft VM, Java Permissions, should be at high safety. As for matters regarding "Scripting," it's a moving target, and you'd best go to a search engine like Google and type in "scripting in explorer" (no quotes). There are holes in this area of the browser, and many active users have disabled scripting.

This page, "Disabling Active Scripting in Internet Explorer," will get you started, and hopefully you can read some of the linked resources on the page.

Disabling Active Scripting in Internet Explorer
http://acd.ucar.edu/~fredrick/win2k/active_scripting/

Lastly

You should mark your calender to remind yourself to update your security programs at least once a week. Some programs have automatic update settings, so be sure that they are set to run.

Questions?

If you have a question about matters mentioned above, be sure to consult the software's website first. Most have discussion forum bulletin boards to post questions, as well as frequently asked questions lists. They're the best source for answers. If you're not getting what you need then use a site like Google.

Next time around, we'll cover some of the newer stamp websites. I do think we have a back log.

Glassine Surfer

The Glassine Surfer archive is online along with other stories, help, and links to stamp collecting sites. We also host the Sociable Stamp Society chats online on Sunday evenings at eight o’clock eastern. Just click on “chat.”

The Glassine Surfer
http://www.glassinesurfer.com

Thanks for reading the “Glassine Surfer” and support your local club. See you online.