Home Computer Security Advice

Tom Van Vleck

Date: 03/09/17; Version 15

Here is a list of things to do about security for your home computer:

Briefly:

Be suspicious.
Back up daily.
Don't reuse passwords.
Use a Mac.
  1. Links in mail and web pages can infect your computer. Of all the bad things that could happen to your computer, a malware infection is the most likely. If you get mail with a link in it, DON'T CLICK unless you are sure the link goes to a safe page. (In most browsers and mail clients, you can hover over the link to see where it points; but it takes some skill to interpret Web addresses.)

    Understand that electronic mail, web pages, and text messages can be forged. Don't assume that a mail message was sent by the person named in the From field. If you get mail that appears to be from a bank, or eBay, or the traffic court, or Paypal, asking you to click on a link or supply personal information, it's probably a scam. Some viruses infect a target computer, read its Address Book, and send fake mail to everyone listed, hoping to get them to open an infected document or go to an infected website.

    Forged mail or text messages may try to get you to click a link. For example, I got a fake message claiming to be from Apple that said "the password for your AppleID has been reset. If this wasn't you, go to this link and set it back." Of course, the link didn't go to Apple. There are lots of messages saying "your (whatever) account needs to be verified: go to this web page and log in." Don't.

    Because lots of spam messages are actually scams trying to get you to click a link, it's a good idea to filter out as much spam as you can. Some mail providers, like Gmail, do this for you. Or you can sign up for third party spam filtering services. Or you can build your own spam filters. (How I filter spam.)

    Web pages may not be what they seem. There are a lot of crooks out there trying to get your credit card and bank account numbers. Consider this 2008 report of a Windows financial-data-stealing Trojan horse program that was undetected for three years. People viewed a web page that secretly installed a malware program on their computer; the program waited till they used their online banking website, and modified the user's view of the bank's web page to ask for extra info that got sent to the bad guys. Surf carefully. Understand the meaning of your web browser's "lock" indicator and that bad guys may try to counterfeit it. Never click through a certificate mis-match warning.

    There have been many attacks via the Facebook web site, using Facebook Apps or postings with a link to a malicious web page, ostensibly posted by a friend. The malware can attack computers running Windows, Mac, and Linux, steal confidential information, and install a back door that lets the bad guys take over your computer.

    An extremely bad thing that could happen when you click a link is that your computer gets infected with Ransomware. This software encrypts all the files on your computer, and then demands money to decrypt them. A friend got infected this way: he ended up paying lots of money to get his files back. (He had been backing up his files, but not all of them.) Sometimes the ransom demand is a fake, and your files are not actually encrypted. Sometimes the files are encrypted, and you send the payment, but then you never get the decryption key.

    If you get an alarming pop-up window in your web browser that tells you "viruses have been detected," or asks for your ID and pasword, this is a scam, sometimes called Scareware. Don't click anything. Close the window, if it will let you. Restart your browser.

    Many web sites include advertising and graphic features from many sources. If one of these internal pieces gets infected, visiting a page may infect you even though the site you think you're visiting is not damanged. For example, banner ads on some web pages are put up by advertising networks; these networks can be tricked into sending out ads that infect visitors. Installing an ad blocker in your browser might reduce this danger.

    Some attacks exploit holes in Flash and Java in web pages. Disable the Java plugin in your web browser, except for trusted web sites. Adobe Flash is widely used: set up your computer to install patches to it automatically. (These patches come out every few weeks.) Keep your browser up-to-date.

    Electronic mail can be snooped. Your electronic mail travels across the Internet unprotected; strangers can read and change it, so don't send personal details, valuable passwords, or credit card numbers in regular e-mail. Rich Mogull wrote a nice article about this.

    If you get mail that appears to be from a friend who is stranded in a foreign country, be very suspicious. I got one a while back, but I knew my next-door neighbor wasn't in London.

    (Phone calls can be forged too, including Caller ID. Some people have been tricked by bad guys who called them on the telephone and said they "detected viruses on your computer." Sometimes the scammers claimed they worked for Microsoft or the FBI. Just hang up.)

  2. Back up your data to removable media. Copy your data so that everything you care about is stored in at least two places. This isn't just about security from bad guys: your hard disk might crash, or your computer might be damaged or stolen. Hard drives are made to last only a few years. If you have a CD or DVD burner, burn a backup disc often; or attach an external drive and back up your hard disk files to it. If you have a Macintosh, attach an external drive and turn on Time Machine, and your data will be backed up hourly. (I also back my files up over the Internet to offsite storage in the cloud.) (Seagate has a product for Windows, Replica, that supposedly works like Time Machine. I haven't tried it.)

    In October 2008, my 10 month old computer made a funny noise and wouldn't boot. All my files were lost! I got a new drive, restored from backup, and didn't lose a thing. If you have any important data that's stored on just one computer, you should feel nervous.

    Your computer could be damaged, lost, or stolen. (This has happened to people I know.) If you have a backup, then at least you can get your data back. And if you have a login password on your computer, a thief won't be able to get at your private information.

  3. Install security patches from your software providers regularly. Keep your operating system and applications up to date. Recent bugs in phones, computer operating systems, browsers, and applications make this really important. This is important, because many computers are infected by viruses that exploit old weaknesses for which patches have been available for months. (You can't count solely on these patches for security, because the patches come out after the holes are found.)

    You have to keep your hardware devices up to date too. Install updates to computers, smartphones, Internet routers, and devices connected to the Internet such as printers and "smart home" devices. Check your manufacturers' websites to make sure that you have the latest firmware.

    (2014) Some Internet routers can be "hijacked" by attackers. Check the support website for your router to see if there are security issues, and install updates if they are available. Make sure your router has a strong non-default password and cannot be administered from outside your house. Set your DNS servers for both Ethernet and WiFi to Google Public DNS (8.8.8.8, 8.8.4.4) or OpenDNS (208.67.222.222, 208.67.220.220), so that an infected router cannot redirect your communication.

  4. Don't run or install programs from strangers. You'd think this is obvious, but many people are too trusting, or don't understand that clicking on an email attachment often runs something. People get an email message claiming to be a picture, or whatever, and click on it, and their computer gets all messed up. Be careful about opening email attachments, even if they appear to be from someone you know, because email can be forged easily (see above). Don't install programs sent to you in email, instant messages, social networks, or web pages. You may be installing "spyware" or "adware" or programs that silently steal your bank account details, or use your computer to mail spam to others. Forged mail from UPS, banks, etc with ZIP attachments have infected many users recently; don't open such attachments.

    (Jan 2014) Some users of the Chrome browser who installed third-party extensions are being flooded with spam, which might include ads that send the user to infection sources. This happens when spammers buy the rights to a formerly-trusted extension from its developer, and post an update adding the spamming to the Android store so that it is automatically installed on the user's browser.

    There are Facebook apps that try to steal your data, raid your address book to spam your friends, post messages in your name, or take over your web browser and computer.

    Malware can be concealed in files you might think are "data files" rather than programs. For example, there have been macro viruses in Microsoft Word, Excel, and PowerPoint files for many years. PDF files may also contain malware: just opening a malicious PDF can run a virus program that can take over your computer. If you get a suspicious message from someone asking you to open an attached document, be cautious.

    Another tactic that bad guys use is to send a pointer to a "video" or a data file that asks you to install software so you can see it. If you install the software, your computer gets infected.

    There have been a number of attacks concealed in supposed pirated versions of commercial software, including games, graphics programs, and anti-virus software. If you download and install such an item, your computer gets infected.

    Some software download sites, such as CNet, provide convenient access to dowload free software, but they also hijack your browser's search engine, and install adware that pops up ads and tracks what pages you view.

    Hotel business center computers have been infected with software that copies everything you do and sends it to bad guys. Don't use machines you don't trust for any private information.

    Here is a nice article by Brian Krebs about many bad things a hacker can do with your computer.

  5. Use a firewall if you have a cable or DSL line. Get a combination NAT and firewall box, or router, which should cost about $50. I use an Apple AirPort Express; I used to use a Linksys box. Even if you have only one computer, a router/firewall helps isolate your computer from the bad guys on the outside, kind of like a surge protector. (You can also enable software on your computer to act as a firewall, but a separate device gives more protection: if a virus gets on your computer it can disable the software protection silently.)

  6. Use passwords sensibly. Use strong passwords to protect valuable assets. Don't use the same login ID or password for multiple services, especially if any have a credit card attached. If your access to one service gets cracked, or shoulder surfed, or eavesdropped, or intercepted over wireless, you don't want the attacker to be able to get into your other accounts. The password databases of some large web sites were hacked in the past year or two, and attackers then tried these passwords on other services and were able to hijack mail accounts.

    Don't input any password to a hotel PC or other machine you don't trust, or send it over an insecure wireless connection.

    Some social media websites ask you for your mail user name and password, so they can read your address book. This is too risky for me. I don't join services that require it.

  7. Don't run as administrator for everyday use. Set up a non-administrator account on your computer, and use it for your normal mail reading, web browsing, and so on. When you need to install software, switch to the administrator account. You'll have to take a few extra steps once in a while, but if a sneaky piece of malware gets into your computer, it won't be able to take over your system as easily.

  8. Install a virus checker and keep its definitions up-to-date, especially if you are using Windows. You should have a virus checker program, even though fast spreading viruses can hit you before you update. Windows users also need to obtain and use "adware" and "spyware" checkers. On a Mac, a virus checker can detect viruses in Microsoft Word, Excel, and PowerPoint files.

  9. If you have a laptop, install tracking software that will locate it if it is lost or stolen. I use Find My Mac on Macintosh machines.

  10. Use encryption wisely. Enable full disk encryption if your system supports it. (I enbale FileVault on Macs.) Keep sensitive data in an encrypted container.

  11. Use a Mac if you can. Macintoshes have fewer security problems. According to a report on Mac security for 2011, Macs had "only 58 new malware variants (according to F-secure) when compared to more than a million new variants per year for the rest of the PC industry." (Numbers of attacks are probably not very useful: what's important to you is how likely you are to encounter one that will infect your computer, and by this measure, Macs are currently safer.) As Macs become more popular, and Windows holes are closed, attackers will look for holes in the Mac.

    In April 2012, many Macs were infected with the Flashback malware before a fix was released. This attack used a weakness in Oracle Java. Other recent attacks have employed holes in the Adobe Flash plugin. For Macintosh-specific security advice, see Security: For My Friends With Macs.

    (Frankly, I am not really enthusiastic about any of the popular operating system choices. The Mac is a good choice, but by no means perfect. I used to warn folks not to use Microsoft Outlook and Internet Explorer, based on their history of exploits, but there have been many fewer vulnerabilities found in these products recently. Windows, Mac OS, Linux, and other Unix descendants are all written in the C language using ad hoc processes. Brilliant programmers have failed to produce secure systems using this approach in many years of trying. We should do better: there is a worked example now of a secure verified microkernel.)

Further Reading

Brian Krebs wrote a nice article in October 2012: Tools for a Safer PC.

The Digital Defenders Project has published a lengthy site describing what to do if you get hacked.

James Fallows wrote a nice article in 2011 for The Atlantic titled "Hacked," which describes his wife's experience of having her Gmail account password stolen, and all her messages and photos lost. It describes what Google did to help her recover her mail. Probably this breach occurred because she had used the same password on Gmail as on other sites, one of which was hacked.

Older Stuff

Here's a good, but depressing, article from 2003 about the situation by Scott Granneman: Joe Average User is in Big Trouble. He also wrote A Home User's Security Checklist for Windows.

If you insist on using Windows, Terry Gleidt wrote a nice how-to article on Coping With Windows, and Gina Trapani wrote an article in 2010 about how to get rid of fake XP Anti-Spyware.

Wireless

Wireless is cool, it's convenient, and it's also risky: a neighbor can download a program that will crack your WEP key in about an hour, and you'll never know... till you get your bank statement! I sometimes use wireless connections while traveling, but at home I stick to wire. If you really want to use wireless, you have to take responsibility for security. Nobody else will.

There are two issues: securing your network so strangers can't connect to it, and securing your communication so that strangers can't intercept it.

Securing your network

If outsiders can connect to your WiFi network and use your bandwidth, they could:

You can deal with strangers attempting to use your network by;

(By the way, do not configure your router to hide the network ID (SSID). This actually decreases security.)

You may detect outsider use by noticing that the modem lights are blinking even when your computers are idle. (But some legitimate software checks periodically for new versions, don't panic.)

Preventing Interception

Interception is undetectable, until someone uses the intercepted information. The WPA-2 encryption standard fixes a lot of problems with earlier protocols. At home, use only WPA-2, choose a long random passphrase, and change it occasionally. Turn wireless off on your computer unless you are using it. Use a wired connection whenever possible. Remember that even if the connection from your computer to the access point is encrypted, electronic mail will then pass over the Internet unprotected. You should still use application security, like SSL, whenever possible.

Using Others' Networks Safely

Using "free" wireless is tempting. You may be traveling and find a free access point that requires no password -- but that access point may be set up by someone who wants to observe your credit card numbers and banking passwords. Your hotel may provide wireless access that requires a password, but a malicious person with access to the hotel's setup could still tap your communications. I have seen fake hotspots, or "Evil Twins," set up with an attractive name, in an airport or hotel district. Company wireless systems can also be tapped by people with inside access. The person running a network can observe what addresses you connect to, and see the packets you send and receive. Wireless routers can be hijacked by malicious firmware that silently redirects, copies, or alters communication. Only use wireless access points that you trust.

If you are using an untrusted internet connection, and get a popup suggesting you update some software, this may be an attempt to infect your computer. The FBI has warned of faked update services on hotel WiFi servers. Wait until you get to a connection you trust to update software.

If you are using a wireless access point run by someone else,

(If you don't know what this means, maybe you shouldn't use wireless.)

A well-recommended book on wireless is Tyler Wrightson's Wireless Network Security A Beginner's Guide.