12 computer security tips

The bad guys can try to break in using computers only or they can try to trick you into providing them with access. Or they can use a mixture of tactics. Let's consider two main types of attack:

* Technical – breaking in via computers only
* Human – tricking people into aiding the attack

For the technical attacks you might consider the following, in order of priority/effectiveness:

Retro: Windows 98 end-of-life

I wrote the following column for Computer Shopper magazine when Microsoft ceased providing security updates for Windows 98.

It seems appropriate to republish it now, as Windows XP is on the verge of the same fate.

October 2006

Computer Shopper magazine #224

Rants & Raves

WINDOWS 98 RIP

SIMON EDWARDS RANTS

So long, Windows 98. Rest in peace. When you were born you made getting online easier, you made using large hard disks possible and you were easier to install.

You had a new desktop system that not only allowed users to display web content live from slow and expensive dial-up connections, but regularly caused the system to crash.

You helped destroy Netscape’s business with your integrated web browser, simultaneously heralding the beginning of years of security problems for Windows users, and your integrated Media Player was judged anti-competitive, too.

So long, Windows 98. Rot In Pieces.

After eight years, Microsoft has pulled the plug on Windows 98. No longer will the company provide updates, even if (or rather, when) further security holes are found. The same goes for Windows Me. That’s OK, though, because no-one uses Windows 98/Me any more. No-one except the estimated remaining 70 million users.

98 TEARS

So who is using Windows 98 these days? My guess would be a mixture of people who are non-technical and those who can’t afford to buy a PC every few years. The original date for termination of Windows 98 support was 2003. It is thought that pleas from the developing world persuaded Microsoft to issue updates for a further three years. There will also be plenty of people who could afford a new computer but don’t see any reason to do so – if it still works, why worry?

If these people don’t use the internet, there is no real reason to upgrade. As long as they’re happy with their PC’s performance, don’t share files with anyone and don’t try anything clever with wireless networks then they should be reasonably safe to continue.

For now, you can still buy Windows 98-compatible firewalls and antivirus software, and the free Firefox web browser is also available from www.mozilla.org, so most internet risks can be reduced, even if you do want to browse the web and collect email safely using your old PC.

Radio 5 Live called me this month to find out if listeners should just buy a new Windows XP PC and have done with it. I wanted to say, “No, just keep your thirdparty security software up to date, install a different web browser and email client and it will be OK”. But buying a new PC is the easiest way forward. The fact that you can buy a reasonable Dell laptop for £399 makes the decision easier still.

HASTA LA VISTA

There is an argument that you should wait for Windows Vista to arrive before buying a new PC because, before you know it, Windows XP will be at the end of its life, too. But that means spending hours locking down your Windows 98 machine (and are you really sure you’ve done it right?) for just six months of operation before Vista supposedly arrives. Is it worth your time?

If you are very technically minded, you could install a Linux distribution on your old PC and breathe new life into it. You might even find it runs faster. You might also find you can’t get it working at all, but that’s all part of the fun.

The missus has a laptop that runs Windows 98. It’s a small, slim, silver machine that runs fast and performs the basic internet-based tasks for which it was bought. I am ashamed to admit that it doesn't even have a firewall or anti-virus software installed on it, although it does operate behind a hardware firewall.

It has never shown any symptom of viruses or spyware*, mainly because it is only used for about half an hour a week to check a Gmail account, which is scanned for viruses by Google. We discussed the options, including hardware upgrades and the Linux route.

This discussion was short, and I was made clearly aware that the way forward involved the minimum amount of time with the computer in pieces on the living room floor and the minimum number of late nights featuring me swearing at installation screens in the spare room.

We decided to buy a cheap £399 replacement laptop that will run Windows XP Home for the next few years. If you are one of the 70 million Windows 98 users out there, that is my advice to you, too.

* I am aware of how naive this sounds these days.

Secure your home network for £10

This wireless broadband router cost
less than a tenner

If you want to share your internet connection safely, separating guests' computers from your own, here's a very simple and cheap way to do it.

Essentially it involves adding a second router to your existing network and using that to create two networks - a guest zone and a private zone. Both provide wired and wireless internet connections, but guests are unable to connect to the private PCs, tablets or whatever.

I've found it increasingly common for friends and visiting family to ask to use my wireless broadband - as if it's an essential resource such as running water or access to a toilet.

While wanting to accommodate their needs, I don't want to expose my home network to the security issues that come when allowing connections from other people's systems.

These computers could be infected with malware, which in turn could capture network traffic, attempt to spread malware to other systems on the network and so on.

One answer is to create a second, secure network that only you will use. Everyone else will be restricted to a 'guest' network that is locked away from your own systems but that provides wired and wireless internet access.

Here's how you can do this for around £10.

Essentially what we're going to do is create a classic DMZ using two firewalls. Each firewall will also have its own wireless network. Those systems connecting to the 'outer' firewall can only see each other and the internet. Those connecting to the 'inner' firewall are invisible to those on the outer one.

Thus we have a guest network running on the outer firewall and an extra-secure network running on the inner one. For a basic diagram that 'explains' this idea, see far below.

In addition to your existing network you will need:

1. A wireless broadband router.
2. An Ethernet cable.

I recently picked up a new Dynamode broadband cable router for less than £9 from Amazon.co.uk.

Ensure that your new router is *not* an ADSL model. You want the internet (WAN) port to be an RJ45 Ethernet socket and not the RJ11 type that you find on ADSL modems and routers.

Before you start, check the following details from your existing systems and router:

1. What is the router's (gateway) IP address? (e.g. 192.168.1.1)
2. What is the netmask? (e.g. 255.255.255.0)
3. What are the DNS settings? (e.g. 8.8.8.8 and 8.8.4.4)
4. If you use DHCP, what is the range of addresses in the pool? (e.g. 192.168.1.2 - 254)

Decide what IP address you want to allocate to your second, private network. Let's say we'll use 192.168.1.200. You should remove this address from the DHCP pool or face potential (but unlikely) problems later.

Allow your existing broadband router (cable or ADSL) to run as usual, leaving the wireless network active. However, unplug all computers, switches and other devices from the router. We'll call this router the 'original' router.

Turn on the 'new' router and connect its WAN port to any one of the available Ethernet ports on the original router. Plug a computer into the new router using an Ethernet cable and configure it, turning on and securing the wireless network. You'll want to check the following, at least:

1. Check the router's LAN IP address. It should be in a different range to that of your original router.

(e.g. if your original router's IP address is 192.168.1.1 you could set your new router to use 192.168.0.1. Then your secure network will use the 192.168.0.x range, while your guest network will use the 192.168.1.x range. It's important that they use different ranges to each other.)

2. Change the default password. Use a strong password.

3. Disable remote management, if enabled by default. This is optional but recommended.

4. Set the WAN IP address to be 'static' and use the value you excluded from the DHCP pool earlier (e.g. 192.168.1.200).

5. Set the ISP address to match your original router's IP address (e.g. 192.168.1.1).

6. Set the DNS settings either to the IP address of the original router (e.g. 192.168.1.1) or just re-use the ones you discovered above (e.g. 8.8.8.8 and 8.8.4.4).

7. Enable the wireless network and use a strong password. Ensure that the SSID is different to the one you are using on the guest network.

8. Check that the firewall is enabled.

Additionally you'll probably want to enable DHCP on your new router.

You should now have something that, conceptually at least, looks like this (yes, the internet looks like a small cloud with an 'i' on it):

The guest network is above the red line. Its systems cannot
connect to anything in the 'private' zone beneath the red line.

What that basic diagram is trying to show is that the guest systems can access the internet freely but cannot connect to the systems in the private network, which is below the red line. Systems on the private network can connect to anything that they like.

If you really want to treat your guests you could provide a networked printer. This would have to go onto the guest network. Your private systems would still be able to use it, though.

In this example we've protected an internet-connected Personal Video Recorder (PVR) on the private network. It's only a matter of time before these types of devices are targeted by attackers. And I for one could not tolerate my telly viewing being interrupted.

OS X security (2002)

Ten years ago I wrote an article about OS X security for Mac User magazine.

The article noted that Mac users were now using a new operating system that was far more likely to face threats such as malware.

In light of the recent Flashback threat, and the resultant interest in Mac threats, I've pasted it below. Most of it is still relevant today.

[Note: If you are worried about the Flashback threat, you can check and clean your system using one or more of these tools.]

Securing Mac OS X

by Simon Edwards

Mac OS X opens more potential security holes to hackers. So how do you protect yourself?

Your Mac is at risk from hacker attacks, now more than ever. And if you don't take active steps to secure it you will be used as a Spam gateway, an unwitting accomplice of further hacker attacks or even a stooge in a bank robbery.

This isn't hype, it's reality. When Apple started shipping Macs loaded with OS X it was making a very powerful operating system available to thousands of users. But while people rejoiced in a new user interface and greater stability, many have not realised that by adopting a well-known operating system (UNIX) they have also opened themselves up to a raft of old and new security vulnerabilities.

The reason that Macs have been relatively free of remotely exploitable security holes is because the people who find and use such holes are only interested in the operating systems that they will commonly find on the Internet. Mac OS 9 is not common in comparison with Solaris, AIX, Windows NT and Linux operating systems, which is why the latter have been plagued by hackers for what feels like forever.

But OS X works in much the same way as Linux, Solaris and other UNIX-based systems. It can use the same software and, therefore, inherits the same benefits and vulnerabilities. The solution is not to revert to OS9, though. Instead, read this feature and you'll be able to lock down your Mac OS X machine against the most prevalent attacks.

First line of defence

OS X is a multi-user operating system, which means that many different people can use the computer at different times. Their application settings, e-mail and other files are kept separate so that one user cannot delete another's important data, or read his e-mail. While this means that the system is potentially more secure than a Mac OS 9 system, with regards to local users, the level of that security is only as good as the users' passwords. A recent survey found that 25 per cent of users believe that 'banana' is a strong password. This is incorrect for a number of reasons.

Firstly, banana is a real word that can easily be guessed by a password-cracking tool. Cracking tools work using dictionaries, and only resort to the very slow method of brute-forcing after all dictionary words have been tried. The brute force approach works like this: the cracker starts at 'a' and works through the alphabet, then adds another letter and continues through every permutation of letters, numbers and punctuation marks. This can take months, and it took our 700MHz system 28 days to crack the simple password 'rumble9'.

If you insist on using passwords of less than eight characters (not recommended), at least change them every month. That way you will foil this kind of attack most of the time. You should also use a mixture of capital and lower-case letters, numbers and punctuation marks. 'Mac_+Us3r01' is a good password but 'macuser' is not.

Service included

Programs such as a Web server, FTP server or a remote access utility are known as services. An Internet host is of little use unless if provides at least one service, but by doing so it is exposing itself to attack. A hacker needs something to hack at, and an old SMTP (mail), DNS, or Web server is sometimes all that is necessary. The trick is to run only those services that are really necessary.

Allowing remote access with older versions of Mac OS X meant enabling Telnet. This service lets you log in from a terminal on another computer, be it a Mac, PC or even PDA, and control the server as if using its own keyboard.

While this may seem like a very useful feature, Telnet is not a secure method of working. The problem is that when you log on using Telnet you have to enter your username and password, which is sent across the network (and maybe even the Internet, if you are logging in to a Web server installed in another building). Telnet sends these details in plain text, which can be intercepted by a hacker using a network sniffer. He will see 'user fred.bloggs' followed by 'password BaNa_na9'. Even though Fred has used a strong password, the hacker now knows it and can hack the system.

Mac OS X v.10.0.1 has replaced Telnet with SSH (Secure Shell), which is much better. It encrypts the connection so that instead of seeing the username and password, the hacker just sees digital garbage instead.

FTP also suffers from the same plaintext vulnerability as Telnet. You can replace FTP with the SSH equivalent, SFTP (Secure FTP) or SCP (Secure Copy). For details on setting up and using SSH, see the walkthrough below.

Updates

As we've already seen, updating your software can avoid some major problems. But even if you have a perfectly working Web server with SSH installed, things are not always as safe as they seem. New security holes emerge all the time and you'd be wise to subscribe to the main security mailing lists if you intend your Internet-connected Mac to survive. The best ones include the large selection at SecurityFocus (www.securityfocus.com).

For example, during the month in which this article was written, security updates were released to fix holes found in the Apache Web server, SSH, the Web scripting language PHP, the printing system, Internet Explorer 5.1, crontab, fetchmail, the firewall software ipfw, Telnet and a whole load of others. Failing to updates any of these packages could result in a hacker taking remote control of your computer, which is the ultimate goal for them and the ultimate nightmare for you.

The best way to update your software is to set the Software Update program to check for updates every day, or every week if you only connect to the Internet sporadically. To run this utility open the System Preferences and select Software Update option.

Buffer overflows

Security holes come in a number of shapes and sizes, and you can even create your own if you're not careful. The most common threat comes from buffer overflow attacks. The principle behind these is that a program installed on your system is written in such a way that when an attacker feeds it too much information it crashes.

In an analogy where the computer's memory is an empty glass and the incoming data is a flow of milk, a buffer overflow would occur if you tried to pour a pint of milk into a half-pint glass. Obviously some milk is going to spill onto the table, which results in a mess - or a crash, in the case of a computer system. But a clever hacker can cause the overflowing data to move into another part of the computer's memory, where it will be run. This is how they gain access to your system without even bothering about cracking your passwords.

Firewalls

One way to restrict a hacker's access to your system is by using a firewall. This program decides which information can flow out of and into your system. You can use a firewall to allow Internet users to access your Mac on port 80, which is the networking port used by most Web servers, but to deny access to any other port. SSH usually runs on port 22, so you'll probably want to allow external access to this port as well, if you want to administer the Web server from any Internet-connected location in the world.

But your file sharing ports, networked printer port and ports for other services that should only be available to the local network, not the Internet, need to be blocked off. Disallow all but the most necessary ports for outbound traffic too. That way you prevent malicious applications from sending important data out to an attacker on the Internet (see Viruses and backdoors below).

For a detailed description of setting up the firewall supplied with Mac OS X, see Configuring Mac OX X's firewall with BrickHouse, 19 April 2002, p79.

Wireless networks

While wireless networks are doubtless very cool and quite useful, remember that they increase the range of your network beyond your office. If you don't use encrypted networking (such as with SSH) you might as well stick a network port on the wall outside and wait for the hackers to jack in. There are plenty of tools that hackers can use to locate and crack your wireless network, but with a little care you can make it not worth their while to try.

If you're running a seriously expensive business over a wireless network consider setting up a virtual private network (VPN) to provide the encryption, and place dedicated firewalls between the wireless section of the network and other workstations. By treating the wireless part as an untrusted network, just as you would treat the Internet, you reduce the risk of a wireless attack massively.

Viruses and backdoors

While there are not many viruses that can affect UNIX operating systems directly, they are more than capable to moving through UNIX mail servers and onto the Mac and PC systems further down the chain. If your Mac is being used as an e-mail server you should consider installing an anti-virus program, which will strip out viruses intend on damaging your users' OS 9 Macs and Windows PCs. McAfee and Symantec have released Mac OS X anti-virus programs that will do the job.

The direct danger to Mac OS X systems is that once a hacker has compromised the security, using a buffer overflow attack or by exploiting some other weakness, he will install a backdoor that will allow him to return more easily. You can patch your system until you're blue in the face, but if you don't know about the backdoor you might as well give up.

When a hacker installs a backdoor he may replace some of your useful files with doctored versions that seem to behave properly but are actually helping to hide the hacker's files and activities. For example, he might have placed a stash of useful files in a directory called /hacks. The less command would display this directory, but a doctored version could be made that displayed every directory except this one.

We need a way to discover if files have been changed. CheckMate is a program that can scan essential files and create a special index of them, using checksums (see the Jargon box). If an important file is replaced the checksum will change and CheckMate will notify you that something is up. Knowing that your system has been compromised this heavily will help you save time when trying to work out what's wrong. If you find your basic files have been replaced there is only one thing to do - reinstall. Then install every possible update and run CheckMate again before connecting to the Internet.

File encryption

When you send an e-mail across the Internet it can be read by a large number of people, whether you know it or not. E-mail is created, sent and received in plain text, and passes through a number of systems on its journey to the intended recipient. Hackers with snuffer programs, mail system administrators and people with access to the computer used by your contact can all read the message, which is why sensitive information should always be encrypted.

Files stored on your hard disk should also be encrypted if they are sufficiently important. For example, if you've used CheckMate to generate an index of checksums you'll need to be sure that the hacker hasn't edited it to avoid an alert. Encrypt it and he's locked out. To encrypt e-mail and local files you'll need a good encryption package like PGP or GnuPG. The former is very easy to use and comes with a graphical installer, the latter is free but needs to be loaded from the Terminal command line.

To do this you'll need to download the GNU Privacy Guard file (GnuPGOSX1.0.6r6.dmg.gz) from http://macgpg.sourceforge.net, as well as the Darwin patch, which is called gnupg-1.0.6-darwin. Next, type:

tar -ax gnupg-1.0.6.tar.gz
To copy the Darwin patch into the folder that this creates, patch the software and install it type the following lines in order:

cp gnupg-1.0.6-darwin.diff gnupg-1.0.6/
cd gnupg-1.0.6/
patch -p 1 < gnupg-1.0.6-darwin.diff
./configure
make
sudo make install
You can now download the plethora of GUI helper tools from the same site. Or download the non-commercial version of PGP from pgpi.com.

Conclusion

If this article has started you worrying about Internet security, it has done its job. But while the Internet can be a hostile place, taking the simple steps listed here will make you almost invulnerable to the most common attacks. Just being aware of the risks puts you in a minority, and it's a good club to join.

Talk the talk

Buffer overflow A common but highly technical type of hacker attack, that is avoided by keeping software on the computer as up-to-date as possible. A successful attack allows the hacker to run commands on your system at the highest possible level of authority.

Checksum A checksum is a code that can be generated to represent a file. It is virtually impossible for two different files to have the same checksum, so it can be thought of as a fingerprint or DNA profile. This makes check summing an ideal technique for detecting if a file has been changed by a hacker.

Encryption The scrambling of a file or message so that it is readable only by the person for which it is intended. Encryption can be used for Internet traffic too (see SSH below), and is most commonly encountered when buying from a Web site - those yellow padlocks are indicative of an encrypted Web session.

Firewall A software program or hardware device that controls the type of network traffic able to pass through it. Usually used to protect computers or even whole networks from the Internet, they are now being installed by some to keep wireless networks safe.

Ports Different Internet services running on the same computer use different ports. This means that someone trying to connect to a system using FTP won't interfere with the Web server on the same machine. FTP uses port 21 whereas Web servers usually run on port 80. Services: A server is a computer that provides services to other users. Examples included POP3 mail, telnet or SSH remote access and Domain Name Services (DNS). Services are controlled by a file called /etc/inetd.conf.

SSH The Secure Shell creates an encrypted connection to your Mac, which means that hackers cannot see what you're up to, or what your password is. SSH can also be used to create virtual private networks (VPNs) across the very unprivate Internet.

Trojan A file that looks like something you want to run, but carries a less pleasant payload such as a computer virus or backdoor that creates a secret entry point for a hacker into your system.

UNIX These days UNIX is considered to mean a type of operating system, rather than a specific one. Solaris, Linux, FreeBSD and AIX are all types of UNIX, or are based on UNIX. Mac OS X is based on Darwin, which in turn is a version of BSD UNIX.

Using SSH

For security purposes, a server is any computer hooked up to the Internet that's capable of providing network services such as Web, FTP or mail. If you want to control your Mac OS X server remotely you'll need to use SSH, which has replaced the less secure Telnet originally shipped with the operating system. If you've never updated your installation you won't have SSH. You are strongly advised to download the very latest updates as soon as possible, particularly if your system spends any time at all connected to the Internet - even using a dial-up modem connection.

In this walkthrough we are assuming that your system is fully up to date and that you want to administer your computer from somewhere else on the local network. There is no real difference between doing this and coming in from the Internet. If you want to do connect from the Net you will need to ensure that any protective firewalls between you and the Internet will allow connections through port 22 or it won't work.

STEP ONE

Enabling remote access

Go to the Sharing System Preferences panel and choose the Sharing option from the Internet and Network section. Tick the Allow Remote Login box, which enables the Secure Shell (SSH) service. This operates on port 22, which is the default used by just about everybody. You absolutely must ensure that you are using Mac OS X version 10.0.1 or later, otherwise your remote access will be provided via Telnet, which is significantly less safe to use. We are using version 10.1.4 here.

STEP TWO

Establish a connection

Here we are assuming that you have two computers connected to the same network, one allowing remote access and that has an IP address of 10.0.0.1. You can determine the IP address of your remote server by going to System Preferences, choosing Network and viewing the settings for Built-in Ethernet. Start a terminal session on the non-remote access Mac (Terminal is available from the Utilities folder) Type: 'ssh username@10.0.0.1'. Use your own username and enter your password when prompted. Answer 'yes' when asked if you want to connect.

STEP THREE

Run commands

You can now administer your computer over the network, or even over the Internet. You'll need to have administrator rights to be able to change the system. These are provided in System Preferences from the Users option. Running 'top' will show you what processes (programs and background operations) are running. You can use the sudo command to run critical commands that require the ultimate level of authority. To reboot the Mac type 'sudo shutdown -r'.

STEP FOUR

Copying a file

Use the scp to copy a file from the server. Here we typed 'scp spge@10.1.22.23:backup backup', which has the effect of running scp, connecting to the server at 10.1.22.23, grabbing a file called backup and saving it as 'backup' on our system. The following line in the screenshot lists all files beginning with the letter 'b'. Using the list command (ls) with the -l switch shows more information, such as the file size, the date of its creation and who has permission to read or edit it.

Further information

Pretty Good Privacy (PGP) E-mail and general file encryption utility that can make your files unreadable to everyone but yourself
Free, for personal use
http://www.pgpi.com

GNU Privacy Guard Essentially a free version of PGP, you'll also need to download some other utilities to make it extra friendly to use.
Freeware, even for commercial use
http://macgpg.sourceforge.net

CheckMate Generate and compare checksums of essential files to discover if a hacker has altered your system.
Free, while in beta
http://personalpages.tds.net/~brian_hill/checkmate.html

Hints and tips

Watch your logs!

When a hacker takes over you system is won't be quietly, but unless you look through your log files you'll never know what's happened. It is necessary to know how a hacker broke in, even if you are going to reinstall your whole system, because that way you can fix the problem. Reinstalling will just reset your computer and the hacker can come back in the same way he did before. You'll find your logs in the directory called /var/log. Type 'last' from the terminal to see who's been logging in, and when.

Keep an eye on your users

If only you and a couple of other people are using the Mac there should only be a handful of names in the user list accessible from System Preferences - Users. If odd entries appear you can be sure that someone has administrator-level control of your system. If you want to know who's logged in at any one time type: w from the terminal command line to see a list. You should also check the /Users directory to see if any extra sub-directories have been created. This would indicate that someone has gained access to your system.

First Published in MacUser, Vol 18 No 13, 28 June 2002.

The above article is © Dennis Publishing Limited 2002. UK property of Dennis Publishing Ltd. This article may not be reproduced or transmitted in any form in whole or in part without the written consent of the publishers.

Anti-virus myths busted

Last week I gave the début presentation of my anti-virus myths talk at the London International Technology Show.

A few people have asked for access to the basic information that I used, so here it is. The talk lasted for around 40 minutes so this really is a bare-bones summary.

Myth #1: Anti-virus protects 100%

Real-world protection tests by Dennis Technology Labs (DTL) and other testers show that even well-known brands of security software can be compromised by malware.

Myth #2: Anti-virus slows PCs

In performance tests conducted by DTL, most popular anti-virus software makes virtually no impact on general system performance.

However, system startup (boot) times can be affected, as can shutdown times. These are important because they are very noticeable by users.

Myth #3: I don’t need it (I’ve never been infected)

Current threats tend not to make themselves known to the casual observer. Rootkits make it hard, even for experts. 

Myth #4: Viruses stay in the bad bits of the internet

While some areas of the internet are riskier than others, legitimate sites can be infected. We demonstrated a real, legitimate site infecting our test PC.

Myth #5: Protection costs a lot

Free products are OK, while commercial products often come with multiple licenses.

Myth #6: Avoid Internet Explorer

All popular browsers have security holes. Internet Explorer has fewer known issues than Opera and Firefox. Chrome and Safari are not immune*.

Myth #7: My ISP will save me

There is no business reason why it would, without raising subscription costs. We covered various options to reduce exposure to threats, including ISP-like techniques such as using special DNS services.

Myth #8: Salvation is a Mac, Linux or Android

Attackers go for popular systems. As Mac and Android users become more prevalent so will the threats to those systems. There are more known sets of vulnerabilities for OS X and Linux than there are for Windows*.

The following video clip was taken by one of the audience. Special thanks to PDTalkinTech for providing the photos and this video footage from part of the presentation:

* Data on software vulnerabilities was provided by Secunia.

Energizer Trojan keeps going

A Trojan has been found in software associated with a USB battery recharger made by Energizer. The Energizer Duo Charger charges batteries, "via a USB port or AC wall-outlet" and its progress can be monitored by software that is downloaded from the manufacturer's website during installation. According to a report on The Register this software contains a Trojan.

Energizer has taken the model off sale and claims to be investigating further into the matter.

US-CERT has published some technical information that notes how the standard Windows firewall will protect systems, assuming that the user does not click the Unblock button when prompted.

The Complete Internet Security Handbook 2009

If you want to keep your family safe and your data private then The Complete Internet Security Handbook 2009 is the book for you. It includes the following:

What do you want to protect?
Learn how to manage risk and provide the best protection you can for the people and things you care about the most.

Cyber-criminals
Why do viruses, hackers, spam and fake bank websites exist? Discover the criminal underworld of the internet and find out how the scammers and conmen operate.

Chapter 1: Basic Desktop Protection
Take advantage of Windows' built-in security features and protect your computer for free.

Chapter 2: Viruses
Learn how to avoid viruses, recognise them when they appear and remove infections from your computer.

Chapter 3: Hackers, spies and other criminals
Prevent the bad guys on the internet from gaining control of your computer, internet connection and personal details.

Chapter 4: Spam and how to avoid it
Is your email inbox overwhelmed with annoying messages? We'll show you how to regain control and banish spam forever.

Chapter 5: Protect your child
The internet is a great educational resource, but threats abound. Ensure your kids stay safe online with our comprehensive guide.

Chapter 6: Lost and stolen
Reduce the chances of computer theft and encrypt your files to keep them private, even if they are stolen.

Chapter 7: Accidents and malfunctions
Discover the easiest way to keep your files safe and find out how to recover them if the worst happens.

Chapter 8: Personal privacy
Learn how to prevent your personal data falling into the wrong hands.

Chapter 9: Scams, fraud and hoaxes
Learn how to protect yourself against identity theft, email hoaxes and fake websites designed to steal your money.

BONUS CHAPTER: Wireless networking
They are convenient, but how safe are wireless networks? We show you how to build and bullet-proof your network.

The Complete Internet Security Handbook 2009 is available now from Borders and costs £7.99. It will also be available in WHSmiths from 27/11/2008. Amazon is currently selling it for £6.39 (as of 23/11/2008).

ISBN: 1-906372-18-7
Cover price: £7.99
Edited and (mostly) written by Simon Edwards.

Powerful personal firewall dies

BlackICE PC Protection, the accurate and well-featured personal firewall, is to be discontinued.

Originally developed by Network ICE, BlackICE Defender (as it was then) was one of the first well-known desktop personal firewall programs, alongside Zone Alarm. In fact, at the start of its life it was not really a firewall but an intrusion detection system (IDS). This distinction was lost on some customers and reviewers, notably Steve Gibson of GRC.com fame. He criticised it and Network ICE responded, saying that he had missed the point and that it was not designed to stop outbound traffic.

When I took ISS' Ethical Hacking course in 2001, the instructor also expressed a dismissive view of the product. By the end of the week, after ISS had acquired Network ICE (and BlackICE Defender), he was singing its praises. I believe that some of Network ICE's technology was built into ISS' RealSecure IDS products.

Later it was renamed BlackICE PC Protection and application control was added to detect unauthorised outbound traffic. In fact, it had a pretty hardcore option that created checksums of all the systems applications and applied close control of what could run and access the network. This was fairly annoying to use because it was so restrictive.

The years passed and the desktop product appeared to be on the shelf, with no major updates and with only a fairly decent price drop to entice new users. Then, in August 2006, IBM bought ISS. Almost exactly a year later it canned BlackICE PC Protection.

IBM will continue to supply updates to current users until September 2009, after which there will be no further updates. The FAQ notes that perpetual licenses are for the use of the product and not for service and support. "Service and support may only be purchased up to September 19, 2007."

IBM/ISS does not produce a replacement product for consumer customers. However, Sunbelt Software is. It is offering a free copy of its Sunbelt Personal Firewall (previously Kerio Personal Firewall) to all BlackICE PC Protection users.

Windows Vista Firewall Myths

Windows Vista comes with a firewall. This is good news, because it means you don't have to install a third-party software program to stop hackers and automated network attacks connecting to your PC. This pre-installed firewall is more powerful than the one included with Windows XP, which was pretty basic (although effective). It is more powerful because it doesn't just block unwanted incoming connections - it can also control traffic flowing from your PC.

Sounds great, doesn't it? With Windows XP, the firewall only controlled incoming connections and you had to install a product like ZoneAlarm to monitor outgoing traffic. Now you can rely on the software included with Windows.

But wait one second...

While Windows Vista's firewall can control outgoing connections, it doesn't. That is to say, by default it allows all programs to make outgoing connections to the internet. If you have a piece of spyware, or some other bad program running on your computer, it can leak your personal data out to the internet and the firewall won't care. You can use a fairly advanced control panel to lock down the outgoing traffic, but it's not very easy to get a regular working system to run happily this way.

At this point it is only fair to point out that, if some malware attempts to run, the User Access Control system might prevent it from causing a disaster. This is, of course, assuming that you have not disabled UAC in a fit of frustrated fury.

When most of us think about personal firewalls controlling outgoing traffic, we assume that the firewall checks which programs are trying to make a connection to the internet and then allows or denies them by following some simple rules. Preferably it will ask us what it should do first, and then remember our preferences. That's how ZoneAlarm and just about every commercial personal firewall works. But not the one you get in Windows Vista.

Microsoft does produce a firewall that behaves in the way we'd expect. The problem is, you have to pay for it. It is only available with the underwhelming Microsoft Live OneCare product and, considering that the other parts of this package are so disappointing, it seems a bit rich to pay for what we consider to be a basic firewall.

So in the end, despite claiming that the enhanced, new Windows firewall "supports filtering for both incoming and outgoing traffic", sensible users will install better, free options such as ZoneAlarm or turn to the firewall components of their internet security packages.