A real, practical guide to protect yourself from real world on-line threats -- For Free

OK folks, this will be a long one, but believe me, it WILL protect you from on-line threats.

I'll get to the point, screw introductions.

The first order of business is to identify the most common on-line threats:

  1. Malware
  2. Scams
  3. Direct Hacking Attempts (rare)
  4. Corrupted Friendly Sites
  5. Browser Hijacking (clickjacking, etc.)
The risk of all of this can be easily mitigated, if you only put some time in to it!

Malware

The first step is to understand where malware comes from

There are a few primary sources of malware:

  1. Browser exploits causing automatic instillation of malware without prompting*
  2. Malicious software posing as credible software*
  3. Piggybacked onto real software**
  4. Included in downloads from a non-credible source (torrents, P2P, back alley sites, etc.)**

* Usually delivered to credible sites via advertisements
** Usually caused by a malicious site, or corrupted friendly site

Mitigation of Risk:

There are a few things to do to reduce or eliminate this risk (for free):

  1. Install antiviral software
  2. Install FireFox or Opera as your primary browser and set it correctly

First thing to know is that not all antiviral software is created equal. And, you don't need to pay for good antiviral software

Norton, McCafee, Kapersky. They all suck.

You need something alternative, something free, something with a regularly updated database, something with a heuristic scan, something with a lower memory overhead... you need something like ClamWin, AVG Free, or Avast! Antivirus. All are free, all have very high detection rates, all have massively lower memory overhead than the industry leaders.

Set them to update the virus database at least once a day, and scan at least once a day, I personally have all three on my Windows Vista© box, and have then update then scan at four hour intervals.

Next, and equally importantly, STOP USING INTERNET EXPLORER

Why, you ask? Number one, ActiveX objects. This is the most commonly exploited system to install malware. Number two, the poorly coded IE system has almost no peer review, leading to a massive number of bugs, many of which cause massive security holes. Number three is unrelated to security, but is important none the less, IE butchers Internet standards for no apparent reason, mostly due to poor coding and the proprietary nature of the browser.

My recommendation: FireFox 3. It is faster than IE, much more standards compliant, and has extensions that can massively improve security

To Install And Configure FireFox

  1. Download and install firefox from http://www.mozilla.com/en-US/firefox/?from=getfirefox
  2. Import everything you like from IE, passwords, bookmarks, cookies, etc. (You will be prompted for this when installing)
  3. Set FireFox as your default browser (Again, you should be automatically prompted for this)

FireFox is now installed! Never use Internet Explorer again!

Configuring FireFox for maximum security

  1. Install AdBlock Plus (https://addons.mozilla.org/en-US/firefox/addon/1865)
  2. Install FilterSet.G (https://addons.mozilla.org/en-US/firefox/addon/1136)
  3. In FireFox, click Tools>Options (OR Edit>Preferences for other OS's) and to the right of the "Enable JavaScript" check, it has an "Advanced" button, click it, and uncheck all of the options. Click OK.
  4. Go to the Privacy tab and uncheck the "Accept third-party cookies" checkbox. Click Close.

Bonus Security for the paranoid!

Install NoScript, this removes active content from pages unless you allow it personally. (https://addons.mozilla.org/en-US/firefox/search?q=script&cat=1%2C12)

Scams!

Scams can vary from the most simplistic email fraud, to an entire software that is intended to look real, but in reality will steal your money and private information. Sometimes, there is no way to automatically prevent scams, but with a few tools, and a bit of knowledge, you can beat them all.

Mitigation of Risk

As usual, someone, somewhere has noticed the risk and created a FireFox extension to help. This time, its called Web Of Trust (WOT)

I will let them explain what it does and how it does it themselves: http://www.mywot.com/
(Direct Download: https://addons.mozilla.org/en-US/firefox/addon/3456)

However, sometimes, something somewhere will slip though the cracks, and a scam will appear. I will try to boil all of this down to simple steps to try and identify a scam:

  1. Is there a box telling you you just won something, and its time to collect a prize? SCAM!
  2. Is there a website telling you that you are infected with a virus or something and wants you to download software, try free on-line scan? SCAM!
  3. Is there some Nigerian prince/Iraqi soldier/anyone else asking help to transfer money to your country? SCAM!
  4. Is someone offering you something that is too good to be true? SCAM!
  5. Is your bank/ebay/paypal/myspace/anyone else telling you that your password needs to be reset, blah, blah, blah? SCAM!
  6. Talking advertisement promising free iPod, emoticons, smilies, or anything else for that matter? SCAM!

As a general rule, anything advertised through unsolicited email or website advertisements should be taken with a grain of salt. Personally, I refuse to buy anything from anyone that uses an annoying flash advertisement or email spam, just as a punitive measure

REMEMBER: Fake user interfaces can easily mimic a virus scan, and say whatever they want, as well as look EXACTLY like a login form from paypal, any bank, any website, anywhere. Those "Hacker Proof," "Trustee," or any other badge of security are easily faked and literally mean nothing.

Direct Hacking Attempts

Here is where the bad news is, you can not stop a skilled hacker if he decides to hack you. There is no possible way to stop him, IF he is determined enough. Sorry, that is the sad truth. However, there are things you can do to make it more difficult and not worth his time. Remember, hackers usually have better things to do than attack a random personal computer, you are usually only at risk if you have valuable information, or you somehow pissed off a hacker.

Mitigation of risk

Well, there is not a lot you can really do here, assuming you installed the antivirals I mentioned, as they have pretty good firewalls. Also, using a strong password on your WIFI and on-line accounts helps a lot. And, generally not giving your password to anyone, ever. Also, never write it down, thats a huge way people get it.

Corrupted Friendly Sites

Sorry to report more bad news here. If a trusted site is hacked, you are essentially screwed. Some will tell you that you can help this, you really cant. If, say, amazon.com has their database hacked, your personal information WILL be stolen. Sorry, thats the truth. Good news is, amazon.com probably WONT have their database hacked.

So, just try and keep your E-Commerce to trusted sites, ebay, amazon.com, buy.com, etc. Any of the big names should be safe. I'd pay with PayPal where ever possible, as it is just one more layer of security.

Browser Hijacking

This one is pretty much taken care of at this point, assuming you have done as I've told you. However, there is still one small thing lingering: clickjacking.

I wont go in to details as to how this works, as it is a very complicated issue, so I will just tell you how to fix it.
1) Install GreaseMonkey: https://addons.mozilla.org/en-US/firefox/addon/748
2) Install this script: http://bagelscripts.blackapplehost.com/critical/securitysuite.user.js

How it works:
It makes all frames and objects visible on a page, and places a border around them. Green means the source is on the same website, red means the source is on a remote website, and blue means that the connection to the frame is encrypted. To see the source of the frame or object, double click the solid border on the left hand side of the frame.

Note that the huge majority of these frames or objects are harmless, and the script should render any real attacks harmless.