Personal Internet Security

Posted by Larry on Sep 8, 2015 in Insights | Comments Off on Personal Internet Security

This is a follow-on article to Security on the Internet.

Though the fears of the Los Alamos scientists was not experienced by the creators on September 2, 1969 when at UCLA two computers sent test data through a 15 foot cable. They had no idea about the far reaching impact their discovery would have.

Yesterday, the television news had an article about the hacking of baby monitors. I started thinking about personal security on the Internet.

Historically there have been three goals of hackers:

1. Damaging the users PC.
2. Placing malware on the PC to show advertisements or to use the PC as a Bot.
3. Obtain sensitive information.

There are four ways that this can be done:

1. Utilizing security holes in the Operating System (OS), Applications (Apps) or Internet Services (IS).I am reminded of a song I heard once (to the tune of 100 bottle of beer) 100 critical bugs in the code/100 critical bug/check one out/debug it out/101 critical bugs in the code (repeat until 0f bugs).Every time Microsoft patches a bug in windows, more appear. Windows is a complex operating system. It is the target of hackers for these reasons and the popularity of Windows.  Greater gain for the work but security breaches have been found in MacOS and Linux. The applications that you install may also provide holes for hackers to get through.The greater problem are web services such as clouds and photo sharing services. You place private photos, data or backups on the Internet and the hackers will attempt to get at them. Just ask Jennifer Lawrence.There is also a hybrid, Distributed Applications (DA) like Microsoft Office 360 and Adobe Creative Suite. The applications are hosted on the providers sites and you run them from the web.What can be done?
   • Keep your PCs and Applications updated.
   • Be careful of what you store on the Internet, only put things up that you don’t mind the world seeing. I strongly suggest that you don’t use a cloud backup service. Buy an external drive to back your PC up and get a good backup utility that allows you to restore from a boot-able CD or DVD. When using a DA, insure that anything you create is stored on your PC and not on the Internet.
   • Install protection. I use Microsoft Security Essentials but AVG is also good. I also run Glary Utilities and Spybot and schedule periodic scans. These are available for free on the Internet but get them from a reliable site.
2. Hacking web sites to cause the downloading of malware to the users PC.Google is your friend and will display a caution if it detects an infected site. Don’t go through to the site if you are not prepared to repair the infection. Even if Google hasn’t flagged the site, it may be infected, even well known sites.What can be done?What can be done?
   • Buy an external drive to back your PC up and get a good backup utility that allows you to restore from a boot-able CD or DVD. When using a DA, insure that anything you create is stored on your PC and not on the Internet. Schedule periodic backups
   • Install protection. I use Microsoft Security Essentials but AVG is also good. I also run Glary Utilities and Spybot. These are available for free on the Internet but get them from a reliable site.
3. Piggy backing malware on downloaded software.Be careful with that you only download from reputable sources and run your antivirus software on the downloaded file. I also strongly recommend that you not disable your virus scanner during install even if the installation recommends it. The downloaded installation may download the infected pieces during installation.If you get infected and your security software can’t clean it out, you can go on the Internet and google the virus but be wary. On some sites, people will recommend fixes. Don’t download those unless they are from a trusted source such as Microsoft, Norton, Symantec, McAfee. The fix is likely infected.
4. Infected email.The goal of infected email is to get you to an infected site or carries a infection, usually in the attachment. Another thing that should be known, sometimes hackers will break into an email account. They will do things like copy the contacts from this account as email from a trusted user is more likely to be trusted. Sometimes, they don’t bother breaking in but will use someones email address. Note, just because the email says it is from a person, it can be sent from anyone. Many times the hackers will use their Bots to send out many, many emails. In rare cases, they will use an account they have broken into to send malicious emails. If this happens you will find a bunch of postmaster emails in your inbox. If this happens, change the password of your email account.What else can be done? Use an email client such as Thunderbird or Apple Mail. There are others but insure that they are well reviewed. Do not open attachments if they are not from a trusted source. If the content of the email doesn’t ‘sound’ like the sender, delete it. Check to make sure links go where expected by hovering the mouse over the link. The referenced URL will be displayed near the link or in a status box at the bottom of the display.

Now let’s get back to the baby monitor. This is part of the Internet of Things (IoT). This includes any thing that is accessible through the Internet. In the case of the baby monitor, it allows you to check in on your child while at work or from the coffee shop. This class of devices includes thermostats, light switches, refrigerators and many other appliances. Also included are automobiles. These give a hacker the ability to possibly gain control of the device. It seems nice to be able to adjust your thermostat before you leave work but a hacker could do the same. It also enables the hackers to access your work network. It is really convenient to call On*Star and have them unlock you car if you should lock your keys in the car but hackers can do the same but they can do much more as has been demonstrated in lab environments. Taking control of modern commercial planes has also been demonstrated. The hackers may not of demonstrated their ability to hack the IoT but you can be assured that they are working on it.

What is to be done? Don’t enable Internet access on your appliances. Disable On*Star on your car. Unfortunately, transportation manufacturers aren’t required to isolate the Internet from the control systems.  Urge the Federal Government to require that control systems in cars and planes be isolated from any systems that allow access to the internet.