Home Computer Security Advice

Tom Van Vleck

Date: 01/16/10; Version 11

Here is a short list of things to do about security for your home computer:

Briefly:

Back up daily.
Be suspicious.
Use a Mac.

  1. Back up your data to removable media. Copy your data so that everything you care about is stored in at least two places. This isn't just about security from bad guys: your hard disk might crash, or your computer might be damaged or stolen. Hard drives are made to last only a few years. If you have a CD or DVD burner, burn a backup disc often. If you have a Macintosh, hook up an external drive and turn on Time Machine, and your data will be backed up hourly. (I also back my files up over the Internet to offsite storage.) (Seagate has a new product for Windows, Replica, that supposedly works like Time Machine. I haven't tried it.)

    Of all the bad things that could happen to your computer, a disk crash is the most likely. A friend had a lot of great Photoshop pictures on her hard drive, and then one day the disk was dead. She was lucky and got her files back. The same thing happened to me in October 2008; my 10 month old computer made a funny noise and wouldn't boot. All my files were lost! I got a new drive, restored from backup, and didn't lose a thing. If you have any important data that's stored on just one computer, you should feel nervous.

  2. Understand that electronic mail and web pages can be forged and snooped easily. Don't assume that a mail message was sent by the person named in the From field. If you get mail that appears to be from a bank, or eBay, or the traffic court, or Paypal, asking you to go to a website and fill in your personal info,  it's probably a scam. Your electronic mail travels across the Internet unprotected; strangers can read and change it, so don't send personal details, valuable passwords, or credit card numbers in regular e-mail. Rich Mogull wrote a  nice article about this. Some viruses infect a target machine, read its Address Book, and send fake mail to everyone listed, hoping to get them to open an infected document or go to an infected website.

    Web pages may not be what they seem. There are a lot of crooks out there trying to get your credit card and bank account numbers. Consider  this 2008 report of a Windows financial-data-stealing Trojan horse program that was undetected for three years. People viewed a web page that secretly installed this program on their computer; the program waited till they used their online banking website, and modified the user's view of the bank's web page to ask for extra info that got sent to the bad guys. Surf carefully. Undestand the meaning of your web browser's "lock" indicator and that bad guys may try to counterfeit it.

    When I worked from home for a company that was serious about security, they provided me with a CheckPoint firewall that supported a Virtual Private Network connection to the company's resources. This meant that file access and company mail were protected by encryption.

  3. Don't run or install programs from strangers. You'd think this is obvious, but many people are too trusting, or don't understand that clicking on an email attachment often runs something. People get an email message claiming to be a picture, or whatever, and click on it, and  their computer gets all messed up. Be careful about clicking on email attachments, even if they appear to be from someone you know, because email can be forged easily (see above). Don't install programs sent to you in email or instant messages or from web pages. You may be installing "spyware" or "adware" or programs that silently steal your bank account details, or use your machine to mail spam to others.

    Malware can be concealed in files you might think are "data files" rather than programs. For example, there have been macro viruses in Microsoft Word, Excel, and PowerPoint files for many years. If you get a suspicious message from someone asking you to open an attached document, be cautious.

    Another tactic that bad guys use is to send a pointer to a "video" or a data file that asks you to install software so you can see it. If you install the software your machine is infected.

  4. Don't read email with Outlook or browse with Internet Explorer. Windows users should avoid using Microsoft Outlook. It has had many documented security holes where a bad guy sends a message that takes advantage of a bug in Outlook to install a virus on your machine, even if you don't open the message. There are plenty of other good free mail-reading programs such as  Thunderbird; use one.

    Internet Explorer on Windows has also shown a large number of exploitable security weaknesses. Just visiting a web page can infect your computer. I use  Firefox instead (it's free). Here's a  story by Aman Gupta, who got mail saying he had one of those electronic greeting cards: he clicked on the message and found that the website code tried five different ways to install a program on his machine that would steal his electronic banking passwords. (If you are an AOL or Earthlink user on a PC, you are probably using a re-branded Internet Explorer. You can use Firefox instead.)

  5. Use a firewall if you have a cable or DSL line. Get a combination NAT and firewall box, which should cost less than $50. I use an Apple AirPort Express; used to use a Linksys box. Even if you have only one computer, a router/firewall helps isolate your machine from the bad guys on the outside, kind of like a surge protector. (You can use software on your computer to act as a firewall, but a separate box is better: if a virus gets on your computer it can disable the software protection silently.)

  6. Use passwords sensibly. Use strong passwords to protect valuable assets. Don't use the same login ID and password for lots of different services, especially if they have a credit card attached. If your access to one service gets cracked, or shoulder surfed, or eavesdropped, you don't want the attacker to be able to get into all your other accounts.

    Some social media websites ask you for your mail user name and password, so they can read in your address book. I decided this is too risky for me, and I don't join services that require it.

  7. Install a virus checker and keep its definitions up-to-date, especially if you are using Windows. You should have a virus checker program, even though fast spreading viruses can hit you before you update. Windows users also need to obtain and use "adware" and "spyware" checkers. On a Mac, a virus checker can protect you from viruses in Microsoft Word, Excel, and PowerPoint files.

  8. Install security patches from your software providers regularly. This is important, because many machines get infected by viruses that exploit holes for which patches have been available for months. Once again, though, you can't count solely on these patches for security, because the patches come out after the holes are found.

  9. Use a Mac if you can. Macintoshes have fewer security problems. According to a 2001 UK government report by  Satchell and Peeling, "There are about 60,000 viruses known for Windows, 40 or so for the Macintosh, about 5 for commercial Unix versions, and perhaps 40 for Linux." That was in 2001; since then there have been thousands more Windows viruses, and only a few Mac viruses.

    For Macintosh security advice, see  Security: For My Friends With Macs.

    (Frankly, I am not really enthusiastic about any of the popular operating system choices. The Mac is better, but by no means perfect. Windows, Mac OS, Linux, and other Unix descendants are all written in the C language using ad hoc processes. Brilliant programmers have failed to produce secure systems using this approach in many years of trying. We should do better: there is a worked example now of a  secure verified microkernel.)

Further Reading

CMU CERT has a nice tutorial article about  Home Computer Security.

For more information on security, see this article about the  Top 20 Security Vulnerabilities.

Here's a good, but depressing, article about the situation by Scott Granneman:  Joe Average User is in Big Trouble. He also wrote  A Home User's Security Checklist for Windows.

If you insist on using Windows, Terry Gleidt wrote a nice how-to article on  Coping With Windows, and Gina Trapani wrote up how she  disinfected her mom's Windows box (took 3 days). Gina wrote another article in 2010 about  how to get rid of fake XP Anti-Spyware.

You may also be interested in how I filter spam.

Wireless

It's cool, it's convenient, and it's also risky: a neighbor can download a program that will crack your WEP key in about an hour, and you'll never know... till you get your bank statement! I have used wireless connections while traveling, but at home I stick to wire. If you really want to go wireless, you have to take responsibility for security. Nobody else will.

There are two issues: securing your network so strangers can't connect to it, and securing your communication so that strangers can't intercept it.

Securing your network

If outsiders can connect to your network and use your bandwidth, they could

You can deal with strangers attempting to use your network by

You can detect outsider use by noticing that the lights are blinking even when your machines are idle. Interception is very hard to detect. The WPA-2 encryption standard fixes a lot of problems. At home, use only WPA-2, choose a long random passphrase, and change it occasionally. Remember that even if the connection from your computer to the access point is encrypted, electronic mail will then pass over the Internet unprotected.

Using Others' Networks Safely

Using "free" wireless is tempting. You may be traveling and find a free (or paid) access point that requires no password -- but that access point may be set up by someone who wants to observe your credit card numbers and banking passwords. Sometimes you will encounter a fake hotspot, or "Evil Twin," set up with an attractive name in an airport or hotel district. It is also possible that a hotel or company wireless system could be tapped. The person running a network can observe what addresses you connect to, and see what you send and receive unless it is securely encrypted.

People have been arrested for using other's wireless without permission, even if that wireless router had no access control.

If you are using a wireless access point run by someone else,

(If you don't know what this means, maybe you shouldn't use wireless.)

Copyright (c) 2003-2010 by Tom Van Vleck

Home | SE Stories | Tools | Java | Resume | Multics | Stories | Personal
Mulvaney | Mushrooms | Photoshop | Feijoada | Security | CTSS | Borges