DISCLAIMER: This guide is provided as an informational aid only. I take no responsibility for the use of the information herein. If you are uncomfortable with this information, but still are concerned about computer security, you should consult a professional. It is possible that misusing this information could cause data loss, hardware destruction, or other consequences. I am by no means an expert on security and furthermore like all humans, I do make mistakes. In short, no one is responsible for the use of this information but you.
Last updated: September 17, 2006
Most of this information is based on the PC architecture running Windows. Some of the information (such as spam, wireless security, instant messaging, peer to peer safety) is platform independent. If you are running a Mac or Linux, it doesn't mean you are completely secure. Security by obscurity is not assurance that you won't become infected. I don't know how many Mac and Linux viruses there are, but if there is even one and you aren't protected, you're at risk. I don't have a Mac and I'm pretty new to Linux (and oblivious to other UNIX flavors) so I generally won't be offering advice on those systems. If someone has a Mac or a Linux box, and knows a lot about security, feel free to PM me and I can incorporate your information into this guide (crediting you, of course).
Finally, this guide is going to be written in such a way as the solutions it provides will be free of cost. I.E. The applications I recommend will not cost you anything. Sure, there are commercial alternatives, and if you want to use something like that, that's fine. There are good free security tools available though, and that is what I will be focusing on.
The internet can be a dangerous place. Viruses, spyware, hackers, identity thieves, spammers and more. Because of this, and because I'm bored I am going to attempt to write a simple guide to computer security. This will by no means be all encompassing. Some of this I have learned from personal experience, some I have learned by reading. The information is easily available out there, but I am going to compile it all here in one place.
Let's begin by asking a simple question. Do you need to be concerned about computer security? Yes, you do. You don't have to be completely paranoid but a little foresight goes a long way. Most people learn about computer security because they didn't have any to begin with. For instance, an acquaintance of mine recently asked me to help her fix her computer. She said her ISP had called her and told her someone was running a DDOS (Distributed Denial of Service) attack using her PC. They said if she didn't remedy it they were going to cut off her internet service. After taking a look at it and confirming that was indeed what was going on, I managed to fix it with a little effort.
So what do you need to do to protect yourself? It's really pretty simple. That's why it's so unbelievable that so many people don't protect themselves at all. I am going to divide this guide into parts. You don't have to read any part you don't want to, so just skip where you wanna go, or read the whole thing.
General Internet Security
Usually this goes without saying but the following is a list of do's and don'ts if you want to be safe on the internet.
DO NOT post personal information (Name, address, age, birthdate, social security number, credit card number, a list of your fears, etc) on message boards or on your personal website. Name, age and birthdate is kind of open really, as there isn't too much people can do with just your name. Basically anything you wouldn't be comfortable telling a total stranger, don't post it on the internet.
DO NOT fall for the trick "dialog box" ads. Like the ones that appear on a webpage, look just like Windows dialog boxes and say "Your computer may be unsecure. Click to scan now". Don't click it AT ALL. Since in most cases it's an ad, it doesn't matter if you click yes, no, cancel, go away, etc. If it comes in a pop-up(more on pop-up blockers later) and you are going to close it, make sure you use the REAL close button, not a fake one that's part of the ad.
DO NOT install software from untrusted sources.
DO NOT use peer to peer file sharing applications. (If you REALLY insist on it, see the section later in this guide.
DO NOT open email attachments from people you don't know. DO NOT open unexpected email attachments from people you do know. Scan all email attachments before using them.
DO be very careful when typing addresses into the address bar. A typo of one letter can lead to an entirely different site, or worse a spoof site attempting to steal your information.
DO run a good firewall. (See the section later in this guide)
DO run anti-virus software BUT NOT MORE THAN ONE (See the section later in this guide)
DO keep your operating system up to date (See the section later in this guide)
DO use an adware scanning application (See the section later in this guide)
SPAM
We'll start of with something simple. Spam. Nobody likes spam, but most people have it. Now there are filters to catch spam, and they are getting better and better everyday. What we are going to focus on, however, is how not to get any spam in the first place. I have had my current email address for almost two years, and I get no spam. The way to achieve this is pretty easy. First and foremost, be careful who you trust your email address to. That is, don't put your email in every time a new site asks for it. A lot of times when websites are offering "free software" and they just need your e-mail address, in reality they are going to sell your email address to make a profit. How can you be sure that a particular site isn't going to sell your address? Well you can read their Privacy Policy. You know that thing that all decent websites have and nobody ever reads? They are required to disclose what they will do with your information in there. If a site doesn't have a privacy policy, then it's likely they are going to sell your information (or worse). Another neat tool that has recently come about is by McAfee. It's called site advisor. You can find it here. If you go there and plug in the name of a website you are wondering about, they will give you a report on it. They give you an overall rating, a list of user comments, and even a sample of the emails they received after providing the site with their email address. McAfee also provides a tool that integrates into the browser and does the same thing, but I can't speak of it because I've not used it. Lastly, if you REALLY need a piece of software, and you are fairly sure they are going to sell your email address, what you can do is open a second email address (E.G. Hotmail, Yahoo, etc) and use that email address for occasions where a website's trustworthiness can't be easily determined. Another way spammers can get your email address is by bots that scour the web looking for things like [email protected] If you have a public profile on a message board, or post your email in a post (or anywhere else publicly viewable on the web) then bots can collect that and spam you. You have two choices in this case. As above you can use an email address that's "unsecure" I.E. that you don't mind if the spammers get. The other option is tricking the e-mail gathering bots. It's really pretty simple. Let's say your email is [email protected] (hopefully that's not a valid address, someone tell me if it is and I'll change it). Let's then say you wanted to have that email publicly in your profile. You could post it as JaneDoe_at_dreamviews_dot_com or JaneDoe@dreamviews_no_spam_.com. This has the effect of confusing some email collection bots. It also has the unfortunate side effect of confusing people who can't see through the "mask" so to speak. These two simple steps are why I am spam free.
If you get a spam
OK you've already got spam. Well if you've got a lot of spam(like more than once a week) it's likely too late. Either use a good quality spam filter, or get a new email address and protect it from the start. But let's say you've been following my instructions and you get a spam. Don't panic. First of all, we need to define spam. For the purpose of this guide we are going to assume Spam is any promotional or marketing email that you don't want. That's not a valid definition of spam, but it will serve our purposes. First thing to determine is if the email is from a reputable site. You can check that at SiteAdvisor. If it's a well known company (GameSpot, K-Mart, real companies you have heard of etc.) then the best thing to do is unsubscribe. HOWEVER! And this is very important. If you get an email that's not from any known company, possibly has a lot of misspellings, and is offering Viagra for cheap, or free gifts, or that you have won a contest you never entered etc; the best course of action is to do NOTHING. Why? It's simple. In situations like this clicking "unsubscribe" or replying saying to unsubscribe usually only serves the purpose of confirming to the spammer that your email is real and in use. If you don't reply or unsubscribe and continue to get spams, then really you're shot. Your best bet is to get a spam filter or a new email address. Now you see why it's better not to get spam in the first place.
Updating your operating system
Updating your operating system is a simple but quite effective procedure you can do to make sure the base operating system is as secure as possible. It's really very simple and I'm not going to go into how it works and all that. I'm just going to tell you how to do it.
Microsoft Windows
Windows Update
That's the website if you want to do it manually. That's how I do it because I like to know what I'm installing and what's going on. Note that you must be using Internet Explorer 5.0 or later. If you are using Firefox or another browser and it's set as your default and you don't know how to open Internet Explorer, you can usually find it in Start > All Programs > Internet Explorer. Alternatively you can use Start > Run and type in "iexplore" without quotation marks. This is slightly less secure because a lot of trojans masquerade as iexplore.exe. If they've messed with the path environment variable then you could inadvertantly launch another instance of the virus. It's normally a pretty safe way to launch Internet Explorer though, so don't spaz about doing it. If this is the first time you've been to the Windows Update site it will likely want you to update your Active X control for the updates a few times. This is normal, don't spaz. Once you do that then it should scan your computer to see what updates you need. If you are a true layman and don't wanna mess with the specifics, once it has scanned you should see two buttons. "Express" and "Custom" just pick Express and be on your way. It's pretty self explanatory and you shouldn't have any problems. Once it's done youll probably have to reboot your machine. Once you reboot go right back to the Windows Update site. Since some updates require other updates to be installed first before they can be installed, it's likely there will be more updates to install. Keep checking after each update until there are no more in the "Express" category. One final note: If you have a slow internet connection, the download will probably take forever. Back when I had dialup, after a reformat of my PC and a fresh install, all updates had to be done. On dialup this took close to 24 hours, and even more updates have been released since then. I think they've streamlined the update process a bit though. They also used to offer the updates free on CD for those with slower internet connections. I don't know if they do that any more. Anyway, If you are going to do it over dialup prepare for it to take a while. Finally, if you are gonna do it manually like this it's a good idea to check at least once every two weeks. The other way to update Windows is with automatic updates. This, as it's name implies, automates the update process. Windows will automatically download critical updates and prompt you to install them when they are ready. If you wanna turn this on, there is a button at the Windows Update site above that will guide you through it. This makes it a lot more transparent if you don't want to have to remember to update every few weeks. One last thing to note is that not all versions of Windows are updated anymore. Windows XP still is since it's Microsoft's flagship Product. I think Windows 2000 and Windows Server 2003 still are as well. Windows ME might be, though if they haven't stopped updating it yet I know they are going to soon. If you've never updated before and you have one of these versions(or older), you still should update to the latest version. Just understand that no NEW updates are being made. It's time to upgrade to a newer version of Windows :)
Windows Genuine Advantage
An important thing to note as far as Windows Update goes is the recently added Windows Genuine Advantage tool. Basically its a program that Windows Update wants(possible makes) you download to check to see if your copy of Windows is legit. Microsoft got sued over this because the application was "phoning home" without having notified end users it was going to do so. If you download the app via Windows Update and are running a pirated version of Windows(whether you yourself pirated it or the person who sold you the PC did) it will notify you as such. If you pirated it yourself then you're probably spazzing about now eh? I'm not gonna give you a big talk on software piracy. You didn't come here to hear that, you came here to get secure. I realize (as does Microsoft) that even pirated software should be updated. Why? Well if Microsoft refused updates to pirated versions of their operating systems, more of those systems would be infected. This would facilitate the spread of said infections to legitimate copies of Windows as well. So it's better for everyone if they allow pirated versions to update as well. I don't know if Microsoft collects the names of the people running pirated versions or not. Maybe your in the other group though. Maybe you bought a PC with Windows pre-installed and it says your running an illegitimate copy. That would be a shock too. There are two possibilities. One is it could be a false positive. The other is the vendor you obtained your PC from may have pirated Windows. Microsoft provides support if this is the case.
The following is from Microsoft's website, and as such is copyright to Microsoft:
Q: What are the details of the genuine Windows offer?
A:
To help customers who unknowingly purchased a counterfeit version of Windows XP, Microsoft has created two genuine Windows offers for those who qualify:
* Complimentary offer: Microsoft will make a complimentary copy of Windows XP available to customers who have been sold counterfeit Windows. Customers will be required to submit a proof of purchase, the counterfeit CD, and a counterfeit report with details of their purchase. Only high-quality counterfeit Windows will qualify for the complimentary offer.
* Electronic License Key Offer: Microsoft will offer an alternative for customers who find out via the WGA validation process that they are not running genuine Windows, but do not qualify for, or choose not to take advantage of, the complimentary offer. These customers will be able to license a Windows Genuine Advantage Kit for Windows XP online for a price of $99 for Windows XP Home edition or $149 for Windows XP Professional. The Windows Genuine Advantage Kit for Windows XP will include a new 25-character Product Key and a Windows Product Key Update tool that will allow customers to convert their counterfeit copy to genuine Windows XP electronically.
If you purposefully pirated your copy of Windows then I would strongly suggest you get a legitimate version. Piracy is unethical and illegal. If you get notified that you are running pirated Windows and didn't do it yourself, you should contact Microsoft for support. If you want to read more about Windows Genuine Advantage (like what info it collects, the controversy surrounding it, etc) then you can here: Wikipedia - Windows Genuine Advantage
Anti-Virus
Anti-Virus programs are just like they sound. They are applications designed to protect you from viruses. The one we will be focusing on is AVG Free edition. You can obtain it here. AVG Free edition is a version of Grisoft's professional, pay to use anti-virus software. The main differences in the free and paid versions are:
Free version has no technical support.
Free version is given lower priority when connecting to the update server.
Free version is only available in one language, you don't get super advanced settings, and you can't use it in a commercial setting (like for your business).
Those limitations being noted, it is a really good free application. Besides being a standard anti-virus program in that it lets you scan for viruses, it also has a what it calls Resident Shield. What that does is scan files as they are run (or attempt to run). The feature is not fool proof but it does a pretty good job of catching malicious things before they happen. Also it can integrate into email applications such as Outlook, Thunderbird etc. Then it will scan all your incoming emails for viruses. Now, even with a feature like Resident Shield, you need to SCAN for viruses from time to time. Perform a full scan of your entire system. I know it can take a while, sometimes a few hours. In such a case you can do it at night. Start the scan before you go to bed. Another important thing to do is everytime you download a file, scan it. AVG integrates into the Windows operating system so it's really quite easy. Let's say you downloaded the installer for a new application. Before you EVER run the downloaded file, right click on it and select "Scan with AVG Free" (most other antivirus software integrates in this way as well) It'll only take a few seconds. This also applies to peer to peer filesharing. ANYTHING that you download from a Peer to Peer network using an app like Limewire or Kazaa needs to be scanned before it is used. Peer to Peer filesharing is really a security nightmare, which is why I don't recommend using it in the first place, but if you must then it's important to take steps to protect yourself (see the section about it later in this guide). Note that if you buy software from a reputable source (like a real store, such as Wal-Mart, Target, Best Buy, ETC) You don't really need to scan it. You can if you are super paranoid but retail software is pretty safe. Of course if you buy it from a place that also sells bootleg DVDs you might wanna be a little more cautious. :? Next, and this is important to note: Do NOT run more than one anti-virus application. The reason is simple, they can conflict and this can cause them not to function properly, or even worse can cause damage. One is enough. Lastly, anti-virus programs are not fool-proof. AVG Free does a good job but sometimes a new virus, trojan or worm etc(or variation of an old one) can infect people before the virus databases have been updated to protect against said viruses. Getting rid of a virus to which there is not yet an antidote can be really frustrating. I know because I've had to do it. See the section below on what to do if you become infected for more information.
Anti-virus checklist:
DO run ONE good Anti-virus Application
DO scan your entire system for viruses on a regular basis (I do a full scan about every two weeks)
DO scan EVERY file you download from the internet, ESPECIALLY from Peer to Peer networks.
DO understand that Anti-virus programs are not fool proof, and they are not a substitute for good common sense
The scope of this guide is quite large, and I really don't feel like writing it all in one sitting. It will be kind of an ongoing project, and I will try my best to add one new section a day. Comments, questions, and suggestions are always welcome. If your question is unrelated to internet security, please don't post it here. I want this thread to stay clean. For other questions there is currently an "Unofficial Software Help" thread. You can also PM me with any computer related questions. I'll try my best to help you, and if I can't I'll point you to someone who can.
Approximate days left until completion: On hold until people express interest. If you want more information please post as such and if enough people do I'll consider finishing. It's too much work to do if no one wants it.
To be added:
Instant Messaging Safety
Firewalls
Pop-Up blockers
Adware scanning applications
What to do if you become infected
Wireless security.
Peer to Peer safety
Browser Wars (E.G. Should I use Internet Explorer, Firefox, Opera etc)
