Dark Side of the Net
See also CERT's Home Network Security and Home Computer Security
Malware
Generic term for malicious programs. See also Wikipedia
- Viruses
- Executable code which can incorporate itself stealthily into other executable
objects.
- Macro virus. A virus written in the macro language of another program (typically
Microsoft Office)
- Worms
- Programs which can propagate themselves over a network.
- Trojan
- A malicious program that masquerades as something else
- Back door
- A hole in the security of a system left in place by designers/maintainers
or introduced by other malware
- Spyware
- A trojan and/or back door program that tracks computer usage
- Adware
- A trojan program that displays advertising
Related terms:
- Social Engineering
- Tricking people into revealing information or performing acts that endanger
security (e.g. Anna Kornikova worm). FYI: Microsoft does not distribute patches through email. See also phishing
- Denial of Service
- Attack on a server via consuming resources (e.g. overloading a web server).
Recent attacks have employed large numbers of compromised systems to attack
a target (Distributed Denial of Service, DDOS).
Spam and Scams
- Spam
- aka UCE (Unsolicited Commercial Email).. This is more and more a fact of life
on the net. Most email systems have some filtering capabilities and addons
are available (see Snapfiles). You also may find it useful to use a service such as SpamGourmet
- One particularly troublesome problem is the email chain letter. Many of
these reference missing children or are scams. Before forwarding such messages
check out the story at Snopes or similar sites. Don't contribute to the problem!
- Scams
- There are no Nigerians, Liberians, or Iraqis trying to transfer millions
of dollars to the U.S. They wouldn't pick you if they did. There are people
who would like to transfer thousands of dollars from your bank account
to theirs. Be very careful about giving out information on the net.
Contributory Negligence
Several "features" of modern software packages have contributed
to the rise of malware. Specifically:
- Executable Documents
- Many computer documents may contain executable content (Macro's) as part
of the document. This unfortunate blurring of the line between document
and program has lead to enormous problems.
- Automatic Execution
- Email readers which automatically execute content are a major problem.
For example: Embedded JavaScript in HTML email messages should NEVER be automatically executed. Nor should attachments be executable by clicking
on them.
- Hiding Extensions
- Microsoft's default behavior is to hide extensions for known file types.
This behavior allowed
iloveyou.txt.vbs to be seen as a text file.
- Enabling Services Automatically
- This is common to both Microsoft and Linux (although recent versions of
both are more cautious). Many users do not realize that various internet
services are running by default.
- Lack of convenient upgrade
- Software upgrades should be simple and (nearly) automatic. They're not.
Windows Update ONLY updates the core OS and Internet explorer -- not applications
- Overprivileged users/OS security model
- Windows 9x in particular and XP in entirely too many cases. Any user can
infect the system itself. In other OS's normal users cannot infect executable files in the OS. XP does have the capability of separation
of privileges but many systems are set up with users as administrators.
Protecting Yourself
- Abstinence
- Why do you run software that gets viruses?
- Available Software
- http://www.Snapfiles.com/ has a good collection of links to tools.
- Virus protection software
- Get it, keep it up to date. A number of commercial antivirus software products
are available. Antivirus software from Avast, www.freeav.com or Free AVG Anti-Virus are free for personal use.
- Personal Firewalls
- I would also recommend a personal firewall for those with broadband connections.
See http://www.Snapfiles.com/Freeware/security/fwfirewall.shtml for a list.
- Keep up to date
- Subscribe to vendor (& other) bulletins. Apply updates religiously.
- Common Sense
- Be skeptical, don't open unsolicited attachments. Don't trust random email.