12 computer security tips

The bad guys can try to break in using computers only or they can try to trick you into providing them with access. Or they can use a mixture of tactics. Let's consider two main types of attack:

* Technical – breaking in via computers only
* Human – tricking people into aiding the attack

For the technical attacks you might consider the following, in order of priority/effectiveness:

Password recovery with Elcomsoft System Recovery

(Part three of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password reset accessibility hack

(Part two of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password Reset Disk

(Part one of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Three ways to recover from a forgotten Windows password

You've forgotten your Windows password. What now?

I’ll show you three different ways to get back into your system:

1. The ‘right’ way
2. A free but dirty hack
3. An elegant but $50 hack

Update Windows, free from malware?

How effective is the standard security advice, "update Windows"?

This common advice is given in many articles about PC security, but rarely (if ever) do we see any claims as to how much protection we should expect.

We, at Dennis Technology Labs, wanted to find out how well Windows Updates adds to the protection provided by anti-malware software.

The testers in the lab ran a series of anti-malware tests using live, exploit-based web threats. They visited the malicious websites using systems that were running with no Windows Updates applied, with full updates applied and with a variety of popular anti-malware programs.

The end result (PDF) indicates that using Windows Updates protected against around one third of the 100 threats that we used.

Anti-malware software protected against from around two thirds to nearly one hundred per cent of the same threats.

We released this information at the RSA Conference USA 2014 last week and the response was interesting. Some analysts were surprised at how low the 32 per cent figure for 'Windows Updates only' was.

Others expected the protection level to be lower.

Ultimately we found that the best anti-malware products had most of the threats covered from the start, with and without updating Windows, while a couple of products (AVG and MSE) benefited significantly when the latest Windows updates were applied.

Feel free to download the full report and read PCMag.com's coverage from Neil Rubenking.

Anti-virus testing conspiracy theories

Every time an anti-virus tester publishes a report the WildersSecurity internet forum buzzes with a mixture of responses ranging from conspiracy theory to logical reasoning (via understandable suspicion, disappointment and useful questioning).

A recent line of discussion following the latest Dennis Technology Labs report is no exception and includes some pretty direct accusations of corruption, as well as an increasing number of sensible replies.

I have posted my response on the forum, but here is a copy of my statement:

Hello everyone.

As usual I have enjoyed the discussion and would like to provide some feedback.

I appreciate that some people reading this thread have preconceived ideas, or even conspiracy theories, that will never be changed by anything that I write here. However, for the record, I would like to answer some of the questions, concerns and both direct and implied accusations that appear above.

Prior associations with Symantec, “money talks”. Dennis is a Symantec affiliate. Mock surprise that Norton comes top.

We have associations with most vendors through our involvement in AMTSO. We have provided services to companies including, but not limited to, McAfee, Trend Micro, Kaspersky Lab, ESET, AVG and Symantec.

We pride ourselves on our transparency and the ethical way in which we conduct our business. We have no secret affiliations with any customer.

One of the reasons the vendors like working with us is because our testing can provide a number of benefits. For example, if a product performs very well then the vendor’s marketing team are happy. However, if we discover a problem then the engineers are able to use the very detailed information that we log to fix that problem.

It would be of very limited use to everyone if we fixed the results to favour one vendor. Such cheating would be fairly obvious to the other vendors, and the favoured vendors would be unaware of problems with their products.

Assumption that most tests used internet malware

Absolutely, and this fact was made clear throughout the report, starting with the introduction. We expose the products to live (internet) web-based threats. Products that block malicious URLs thoroughly will do well, whereas those that rely solely on signatures and heuristics face a greater chance of being compromised.

DTL tests are not on a par with the major test labs

All test labs have different methodologies. It would be fairly pointless if we all worked in exactly the same way as we would be duplicating each other’s work.

Some testers concentrate on running vast number of samples through AV engines. We focus on investigating cases in forensic detail. This means that our sample numbers are much smaller than those found in on-demand tests. The workload is heavy and manual. It takes us six weeks to run a 100-sample test with 20 or less products.

Having said that, when other testers perform ‘real-world’ testing such as we specialise in, they also use small sample sizes that are comparable with ours.

The note that the test is unsponsored was an attempt to knock Wilder’s argument up front. Also, unsponsored is a matter of definition.

Important though your opinions are to us, we don't word our reports to pre-empt predictable controversies on Wilders. And as you can see, it would not work anyway . We include such details to ensure that everyone knows when a test is and is not sponsored. We try to be as transparent as possible.

Sometimes a customer will ask us to perform a test. This often happens at certain times of the year, such as in the summer when new products are launched. If we agree that the products in the list are fairly comparable we will consider running such tests. These, which are commissioned by the customer, are what we call ‘sponsored’ tests.

The regular quarterly testing is financed by subscribers, which we refer to as partner vendors. These companies support the test by paying a quarterly subscription fee. In return they are allowed certain privileges.

For example, if their product performs well then they are able to use our logos to promote their success. They also have an opportunity to review our logs to discover where problems may lie with their products.

Finally they have an opportunity to challenge our findings (for their own products). This means that, should they wish to argue with our findings, they can do so before we publish the report. This is why you sometimes see comments from a vendor in the report itself – perhaps explaining why they believe the product suffered some issues.

Neutralisation definition is vague: “What constitutes a running threat ? A malicious script that is terminated/blocked as soon as it starts, or some malware that is already active on the computer (e.g. running trojan)?”

A neutralisation occurs when a threat runs on the system but is unable to effect a significant change. As we log every process that runs on the test systems we know if a malicious process ran or not.

A script or Trojan that executes, but which is terminated soon after it starts, sounds like a classic example of a neutralisation in our test.

There is also a further granularity to this type of result. We have the possibility of partial or full remediation.

So if a script ran, was terminated and no changes were made to the system then that would be a neutralisation with full remediation. This means extra points.

However, imagine that a Trojan runs and sets itself up to survive a reboot using a Registry Run entry. The AV product detects the Trojan and removes it, but leaves the Registry entry in place. Or removes the Registry entry but leaves the Trojan file on the disk. That would be a neutralisation without full remediation.

The testing platform is outdated (Win XP) and runs vulnerable software. Hopes that Dennis will switch to Windows 7.

As we noted in the report, there are a lot of people still running Windows XP. According to the research that we’ve seen, just less than half of all Windows users are using XP.

As XP’s life is coming to an end, and Windows 7 has recently become dominant, we will switch to Windows 7 before the end of this year. You can expect one more XP-based report (2013 Q2) before we upgrade.

Regarding the use of vulnerable software, we pre-install it to give the security software a chance to protect the system.

To use an analogy: if we were testing car tyre safety we would not do so in optimum conditions. We'd have windy, wet roads. Similarly we use systems that are vulnerable to attack so we can judge how well the security software protects them.

Who are the partner vendors?

As I mention above, we work with all of the main AV vendors but I am not going to name the specific companies that form the partner vendor line-up.

In some cases you can easily tell, because you’ll see our logos on their marketing material. But in other cases either they may choose not to show the logos or, more likely, they may not achieve an award at all.

Desire for paid AVG.

We have tested the paid version of AVG in two earlier tests. There was a strong desire from readers to see free products and, as the paid-for and free versions of AVG *should* receive similar results it seemed sensible to test the free version only.

Why do I think that the free and paid-for versions should receive similar results? Because we are not currently testing email threats or sending malware and exploits over IM. Ours is a web-based test.

Default settings used?

With consumer products default settings are used. However, we disable each product’s ability to report its statistics and other telemetry home to the vendor. Also, we may increase the logging level if that helps us discover issues with the product.

In some cases we may extend the number of TCP ports that the product is allowed to scan for HTTP-based threats. This is because we use a range of ports when replaying the threat sessions.

More programs should have been tested

This consumer test includes nine very well-known products. At the same time we ran a small business and enterprise test, bringing the total number of products to 19.

This involves a vast amount of work and, while we could possibly squeeze a few more products in, it’s not a trivial matter. We hope that as more vendors support the test we'll be able to extend the number of products tested.

Adjusted testing procedures to give benefit to skew the test in favour of one or more products/vendors
We do not adjust our methodology in favour of any vendor or product. We will make small configuration changes if a vendor notes that its product is behaving differently in our environment than it would in the real world.

Our test setup is very close to being the same as many home and business users, but there are always compromises we have to take in order to expose the products to the same threats in the same way. Malicious sites don’t like being tested!

So when we encounter issues we address them to remain fair to all.

DTL tests are on a par with basic magazine tests and are not comparable with AV test labs’ work

Dennis Technology Labs is a testing business that resides within the media company called Dennis Publishing Ltd. We provide test data to magazines within Dennis and to magazines published by other companies.

We test anti-malware products constantly, using state of the art techniques and equipment. I don’t know of any magazine that would be able to summon resources even vaguely resembling the way we work.

As I mentioned above, we are focussed on realistic testing and ensuring that all results are accurately verified and recorded. We don’t run on-demand scans on millions of files like some testers do. We simply take a different approach.

That said, our results are not that different in terms of rankings, to those produced by the other major testers. This is pretty interesting considering our different testing approaches.

No regulation of testing groups

There is no regulation of anti-malware testing, just as there is no regulation of many industries. There is the Anti-Malware Testing Standards Organization, though. AMTSO brings together vendors and testers into a forum for (usually very robust!) discussion.

Dennis Technology Labs is proud to be a member of AMTSO, alongside almost all of the other major testing groups.

From my own, personal point of view, one of AMTSO’s great strengths is that it enables discussion between vendors, testers and anyone else interested enough to engage. It’s not a regulator but it is very influential.

Change timezones fast

In Windows 7 it usually takes at least six clicks to change time zones.

If you need to switch between zones quickly, the following tip will help.

Why might you need to swap between time zones frequently and fast?

When I schedule meetings I like to see how things stack up in Outlook. Meetings abroad, and flight schedules, can make things tricky. Changing  time zones on the computer restores some sanity to the proceedings.

Outlook has a (well-buried) option for changing the time zone and it's just as easy (and tedious) as using the Windows Date and Time window.

Luckily there's an easier way.

Windows 7 includes a command-line tool called Tzutil. Here's how I've used it to make a handy toolbar-based time zone swapper.

1. Create a file for each time zone

Create at least two empty text files and name them according to the time zones between which you wish to switch.

In this example we'll move between GMT (GMT Standard Time) and PST (Pacific Standard Time), so the files are called GMT.txt and PST.txt.

In each file enter the following command, replacing the string in quotes with the one you need*:

tzutil /s "GMT Standard Time"

Now rename the files, replacing the .txt suffix with .bat.

You should have two files called GMT.bat and PST.bat.

2. Install the files

Move the new batch files to a folder on your computer. Let's create C:\TZ and move the files into that.

3. Create the toolbar

Right-click the Taskbar and hover over Toolbars. Click New toolbar and navigate to C:\. Choose the C:\TZ folder and click Select Folder.

You should now see the letters TZ on your Taskbar, next to a pair of tiny arrows. Click once on these to show the available time zones.

To set a new time zone click once on any of the visible icons.

The icons above are actually renamed Windows shortcut files that point to my batch files. I changed the icons by opening each file's Properties and using the Change Icon option.

* Time code list
To obtain a full list of valid time zone codes run Tzutil from the command line like this (the last character is a lower-case L, not the digit one):
C:\>tzutil /l

...

(UTC-09:00) Alaska
Alaskan Standard Time

(UTC-08:00) Baja California
Pacific Standard Time (Mexico)

(UTC-08:00) Pacific Time (US & Canada)
Pacific Standard Time

(UTC-07:00) Arizona
US Mountain Standard Time

(UTC-07:00) Chihuahua, La Paz, Mazatlan
Mountain Standard Time (Mexico)

...

So to make a PST file, you'd type the following into the file:

tzutil /s "Pacific Standard Time"

Security advice can expire

Mark Russinovich has drawn my attention to some security advice just published on USA Today. It seems a little dated and is probably more appropriate for someone operating a PC in 1999, not 2013.

There are five sections, the third (security-related) one being related to, "3. The zombie spyware plague".

This makes reference to fake anti-virus malware, which is certainly a current threat, although less so than a couple of years ago.

The solution?

"... running a real antivirus program probably won't help. To stop the pop-ups, you must run an anti-spyware program. There are a number of good ones — I'd start with Ad-Aware."

I'd be interested to see why author Kim Komando thinks that "real antivirus" software can't remove malware, while Ad-Aware can. Especially as Ad-Aware is a real anti-virus product.

It didn't used to be, though. Back in the late 1990s Ad-Aware was labelled as an anti-spyware tool. It was much more limited than fully-featured anti-malware suites. That said, it was often better than regular anti-virus software when handling certain types of threats, such as information-stealing malware like modem diallers.

It is now described by its developer Lavasoft as, "super fast anti-virus combined with our legendary anti-spyware".

The distinction between anti-virus and anti-spyware no longer exists, and has not done so for years.

Anti-malware vendors cannot afford to ignore certain specific types of internet threat, such as Trojans, diallers and so on. They use the umbrella term "anti-virus" just to keep things simple for normal users.

Ad-Aware looks like an effective anti-malware (anti-virus) tool. It's certainly scored well in AV-Test and Virus Bulletin tests in the past.

Registry backups

The initial section, which includes advice on using a tool to clean the Registry, contains the advice of:

"Just make sure you allow it to backup the registry before making changes."

It's a small point but I'd probably want to back up the Registry manually, rather than rely on the tool that could cause the corruption in the first place.

How do you do that on a PC running any version of Windows later than Windows 98?

The author does not tell you how, but the answer is usually to use System Restore. The Windows Backup tool does not make a copy of the Registry, so don't rely on that.

For more information on backing up the entire Registry for your version of Windows, use the following links:
Windows XP
Windows 7
Windows 8 (it appears to be the same as for Windows 7, above)

This Wikipedia entry examines some further Registry backup options.

Free encryption tools

Encrypting personal data is a sensible thing to do. If you computer is lost or stolen then at least your sensitive files are not at risk of being abused.

There are a number of common ways to do this:

1. Encrypt each file, one file at a time, manually.
2. Create a bundle of files in one archive and encrypt the archive.
3. Automatically encrypt all files placed into a specific folder/directory.
4. Automatically encrypt all files placed into a virtual hard disk.
5. Encrypt the entire hard disk, or portions of it.

Each of those options has its benefits and downsides. All can be achieved for free. Free encryption has been available for a long time but it is frequently hard to use.

PGP/GPG

Pretty Good Privacy (PGP) and GnuPG (GPG) aren't suitable for consumers simply because, even with the optional graphical interfaces, the very concepts that they rely on are not trivial to understand. They also usually involve both the sender of secrets and the receiver being equally competent.

Anyone can understand the idea that you can password-protect a file. Public key encryption is a little harder to understand and explaining it usually involves analogies involving Bob, Alice and Eve.

PGP/GPG are really useful tools. They just aren't that easy for regular users to handle.

PGPdisk

This fantastic tool allows you to create an encrypted archive that appears as an extra hard disk e.g. F:\

Any files placed into this disk are encrypted automatically and transparently. The user can act as if using a standard internal or USB drive. In fact you can place the archive on an external drive, which is quite a sensible thing to do.

Unmount the disk and the files are locked. Unlocking the files involves entering a password for the archive or for the private key (if you used it to create the archive).

You can also create self-decrypting archives. This means that the files are bundles into one Exe file. Send this to someone who knows the password and they can extract the files without owning a copy of PGPdisk. The downside to this is that you have to let them know the password in a secure way.

PGPdisk used to be free but this changed and you had to buy the commercial version of PGP to obtain it. Since Symantec bought PGP it's not clear to me whether or not it is still available at all. Free versions for Windows and Mac are still available from the PGPi website, but these are pretty ancient versions.

Windows EFS

Windows Encrypting File System, which is available on the more expensive versions of Windows XP, Vista, 7 and (soon) 8 is very easy to use but it has some significant problems too.

These include the ease with which users can lock themselves out of their computers and data, the complication of backing up an encryption certificate and the fact that the files are not protected while the user is logged in. This means that malware can steal data, even if the thief who stole your laptop cannot.

There is also some confusion over what happens when you copy encrypted files to other disks.

Here's an example of EFS going horribly wrong in a home environment. I encrypt some folders on my laptop. The laptop is shut down and the files are safe. I forget my password and boot the laptop using a password reset tool such as the Offline NT Password & Registry Editor. While I can access all of the unencrypted files, I have sadly lost access to the encrypted ones forever (unless I made a backup of my encryption certificate).

In a similar way, a vandal with access to the laptop could reset the password using the bootdisk mentioned above and then just walk away, having locked me out of my encrypted files.

Businesses and technical users will be aware of the need to backup the encryption certificate and should be able to cope with corrupted systems. They probably also have full, unencrypted backups. The same is unlikely of most home users.

TrueCrypt

The TrueCrypt software provides a relatively easy way to encrypt files, and has some very advanced features. However, it's interface is not as intuitive as some would like.

One really useful feature is its ability to fully encrypt the hard disk, including the boot partition. Anyone who does this will have some technical knowledge and interest, which is just as well because forgetting your password would be disastrous!

Sophos Free Encryption

Sophos Free Encryption provides a similar feature to to one that is provided in PGPdisk. This allows you to create self encrypted archives, a bit like password-protected Zip files.

Winzip, 7z and other password-protected archive tools

It is perfectly possible to store files in password-protected Zip files. This is the quick and easy way to achieve some level of privacy, although it is less convenient that using more transparent tools such as PGPdisk, TrueCrypt or EFS.

For example, finding files on your hard disk is easy when you can use Windows' search tools, Google Desktop or some other method. Searching inside encrypted Zip files, or creating catalogues of them, is a non-trivial task for regular home users.

Some older versions of Zip tools have a vulnerability that allows passwords to be recovered very easily using a variety of free or inexpensive tools.

Malware attacks both PC and Mac

This month security companies discovered a threat that attacks both Windows PCs and Macs running OS X.

The threat, called JAVA_RHINO.AE by Trend Micro, arrives via infected websites, which means that potential victims won't notice anything amiss unless their security software detects it. It exploits a vulnerability in Java*.

Java is commonly found on both types of computer, which is interesting in itself. Its presence reduces the difference between a PC and a Mac by some way. There are, of course, other very significant similarities that I've mentioned before.

Here is the really interesting part, though. When it runs the threat determines whether it is running on a Mac or a PC and behaves differently depending on what it finds.

In the words of Trend Micro:

"Once it successfully exploits the said vulnerability, it drops and executes the following file:

• On Windows: %User Temp%\file.tmp - detected as TROJ_RHINO.AE

• On Mac OS X: /tmp/file.tmp - detected as OSX_RHINO.AE"

-----
Related news: Security company AlienVault, which is investigating Mac malware at the moment, has found a new Trojan containing a relatively ancient Linux backdoor from 1999.
-----

* UPDATE: I have just noticed that this vulnerability has been included in the Metasploit Framework since November 2011.

Ranked as 'Excellent' (which means that it works very reliably), the exploit is described thus:

"This module exploits a vulnerability in the Rhino Script Engine that can be used by a Java Applet to run arbitrary Java code outside of the sandbox. The vulnerability affects version 7 and version 6 update 27 and earlier, and should work on any browser that supports Java (for example: IE, Firefox, Google Chrome, etc)"

Windows 7 hides file extensions

I've already discussed the issue of Windows hiding file extensions. Specifically, I've been disappointed that Microsoft has made this behaviour a default setting in Windows 7. There was a vague hope that the company would change this before releasing its new operating system but I can confirm that the final version of Windows 7 hides file extensions.

Suspicious.avi.exe

Last month I wrote about the fact that Windows (XP, Vista and 7) hides file extensions by default. In my view this poses a security problem. Let's illustrate this using a real-life example...

I received a malicious email yesterday that contained a link to a file called bestvideo.avi.exe.

If I was silly enough to download this file then my PC would show the file as being called:

bestvideo.avi.exe

If my default settings were in place (hiding the file extension), then the file would be called:

bestvideo.avi

In both cases, double-clicking the file would run the executable file. In the latter case, a user might expect Windows Media Player to run and to load and display a video file but that's not going to happen.

More than likely the real result would be that the program would run and would make some changes to the system, such as editing the hosts file or downloading further malicious software. Whatever it does, it won't be anything useful.

Windows 7 contains Trojan

A pre-release version of Windows 7 has been infected with malware and is currently being distributed on peer-to-peer networks.

The tainted version of the new operating system includes malware that downloads further files from the internet. Trend Micro has named the threat TROJ_AGENT.NICE.

Last month criminals attacked Mac PCs using a similar tactic. They added malware to pirated versions of Apple's iWork '09 suite and Adobe's Photoshop CS4 software.

Virtual Windows 7

It is possible to install Windows 7 Ultimate Edition into an instance of VMware Server 1.0.5 running on Windows Vista. It is not a trouble-free process, however.

If you want to do the same, know that I set up a custom profile based on 'Windows Vista (experimental)' and chose to use a virtual IDE hard disk. Windows 7 does not have drivers for VMware's network adapter so install VMware tools (VM - Install VMware Tools). I found that the Sync driver failed to install but fortunately the network driver worked fine.

This set up is going to be very handy for those who need to take screenshots of the new operating system, particularly when illustrating installation steps or demonstrating how User Account Control (UAC) looks and behaves (see below).

Windows 7 User Account Control (UAC) in action

Windows 7 will help hide viruses

The version of Explorer included in Windows 7 will hide file extensions by default. This is the same behaviour as Explorer in earlier versions of Windows, which had been abused by virus writers frequently to trick unsuspecting victims into running programs.

For example, on a default Windows XP PC Explorer would display a file called 'image.jpg' as simply 'image'. Thus users are not confronted by strange looking file names. However, here's the problem. Non-technical users don't know what's going on half the time and the bad guys know this, which is why they do things like renaming malicious files with a false extension just before the real one.

For example, rename file.exe to file.jpg.exe and it will will appear in Explorer as 'file.jpg', which looks pretty innocent if you forget that you shouldn't see any extension at all (and it's so subtle that most people won't notice this anomaly). Double-clicking this file will not open an image editor or viewer. It will run the program, which is going to be a bad thing. In this respect Windows helps the criminals disguise their Trojans.

Microsoft should balance the convenience of hiding file extensions with the danger that accompanies this as a default setting that only experts will change. I'm not even sure that hiding file extensions is any more convenient. It just makes the screen look fractionally less cluttered. There is still time for the company to change the default setting - Windows 7 is at least a few weeks away from a final release. I hope that it makes that change.

Regardless of which version of Windows you use, it is a sensible idea to change Explorer's default settings so that you can see all file extensions. In Windows XP you can do this by running Explorer, choosing Tools from the menu and clicking on Folder Options. Click the View tab and untick the option called 'Hide extensions for known file types'.

Security company F-Secure posted about this setting in Windows 7 earlier today.