Basic Pc Security Everyone Should Know

Blooper008 · Sep 10, 2006 at 3:05 PM

PC Security 101
--------------------------------------------------------------------------------

Welcome to PC Security 101!

This article will guide you through the most important system configuration aspect of your PC - security.

Step 1 - Firewall

Obvious really, but regularly misunderstood or not implemented correctly. A firewall sits between your PC and the outside world. Its intent is to screen all incoming and outgoing traffic to either your local network and/or the Internet.

There are many firewalls available and Windows XP even has its own built in. Here at SC Towers we generally advise against the Windows XP firewall, it's protection is limited at best. It won't "hurt" to enable the Windows firewall but we do not see it as a "solution"... you need something else.

You have choices, many choices... Zone Labs, Norton, Kaspersky, Black Ice and many, many more. Our personal recommendation to you is Kerio Personal Firewall. Here's why...

Kerio is something of a noisy firewall. While this may seem like an annoyance in the first instance it is actually beneficial. Kerio will alert you to many things that other firewalls do not.
Kerio will alert you if an application is REPLACED. A common intrusion tactic is to hide a malicious program within a trusted program.
Kerio will alert you if an application launches another application - another common tactic hackers emplore is to launch internet explorer "hidden" in the background and use IE as the means to connect them to you. As 99% of people simply allow Internet Explorer to access the internet without question, this is a danger.
Kerio provides outbound and inbound protection. It will alert you if ANY application that has not previously been screened attempts to access the Internet. Likewise, it will alert you if ANY connection from the outside is attempted that has not previously been screened.
Here's a very important note for those using Broadband Routers. Most modern routers have a firewall built in to their hardware. We have heard people time and time again say that they do not need a software firewall (such as Kerio) because their router already has a firewall.

WRONG! Broadband Router firewalls generally provide excellent inbound protection - that is, they do successfully block attacks from the outside. However, they generally provide little or no outbound protection. At first, that might not seem to be a problem. But, any hacker worth their salt is familiar with the notion of a reverse connection. That is - they get their vitcim to run a program by whatever means they can. The program runs on the victims machine and then connects back to the hacker. Most often, the attacker will use a trusted protocol such as HTTP. The result? It will walk straight past your router firewall. As far as the router can tell you are making a request for a web page "somewhere" and all is well. You have been warned. Remember, even if you have a hardware firewall we still strongly recommend a software firewall to run alongside.

(Quick note: if you already have a software firewall installed and are planning to change to Kerio or any other we recommend you UNINSTALL the old firewall first - firewalls do not generally work together very well)

Ok, firewall is installed and ready. It's time to test it!

Our first stop is a free online service called Shield's Up ( https://grc.com/x/ne.dll?bh0bkyd2 ). By running the online test at Shield's Up every port on your system will be scanned and assessed. What's a port? Think of it this way - between you and the Internet there's a brick wall. There are holes in the wall for specific purposes - for example, port 80 is used for HTTP (web pages), port 110 for POP (email) and so on. Naturally, some ports must be open for you to even have an online presence. However, it is the duty of your firewall to present the open ports only when applicable. In all other instances they should appear to be closed - the brick wall should be solid and for all intents and purposes your machine should not even exist as far as the outside world is concerned.

Ran shield's up? Got a good result? Congratulations! You're most of the way to step-one completion. Having said that, we also recommend a few last steps. First of all perform a firewall leak test using the Firewall Leakage Tester from GRC ( http://grc.com/lt/leaktest.htm ). A firewall leak test is exactly that - it tests to see if your firewall can be bypassed from the inside (remember our reverse connection scenario earlier? You are now testing outbound protection while shield's up tested inbound protection).

Our final step is a visit to the online Symantec Security Scan ( http://scan.sygatetech.com/ ). Similar in principle to Shield's Up but different in its inner workings. You might also want to pay a visit to the Free Tools over at Hacker Whacker ( http://www.hackerwhacker.com/freetools.php ). Again, similar in principle but different in its exact testing methodology.

Step 2 - Anti-Virus

Again, somewhat obvious at this stage. But anti-virus protection is a must. Once again, you have many options - including free anti-virus, paid anti-virus and a multitude of vendor options.

Our recommendation? AVG Anti-Virus. Once again, here's why...

It's simple to install and use.
It runs all the time in the background but does not impair system performance.
Every file opened, saved or executed is scanned automatically.
It includes support to automatically scan emails from most clients (Outlook, Eudora etc.).
It updates automatically and regularly to cater for the latest threats.
It can automatically scan files sent via instant messengers (such as MSN Messenger).
It's pretty smart. AVG attempts to intercept "potentially" unwanted programs or files. We tested this by writing our OWN, never released, reverse connection trojan. AVG stopped it in its tracks. We were quite impressed!
Step 3 - Spyware, Malware and All the Rest

We live in an ever changing world. Once upon a time, we simply needed Anti-Virus. Then came the Internet and the Firewall. Then came the evolution of Internet technology. As with everything, if it can be used for good it can be used for bad. We now find ourselves dealing with spyware (sends sensitive information back to the point of origin), malware (malicious software), adware (advertises products and services to you whether you want to see them or not) and more. Time to add some additional protection.

Our first stop and recommendation is Spybot Search and Destroy ( http://www.safer-networking.org/ ). This program will scan your system for spyware/malware/adware and remove it without trace. Moreover, it has an "immunize" feature that will automatically block known threats if you are using the Internet Explorer browser.

Finally, it includes a resident shield. Much like an anti-virus program this sits in the background running all the time. When important system settings are changed - or rather when attempts are made to change such settings - Spybot S&D will alert you and ask for your confirmation. We've lost count of the amount of times a program, webpage or other has attempted to modify our system registry. Thankfully S&D does a fine job of interception.

Next up, we recommend Lavasoft Ad-Aware ( http://www.lavasoft.de/ ). Very similar to Spybot but more focussed on malicious "tracking cookies" (essentially, when you visit a site and a tracking cookie is issued the site will then track where you go thereafter on the Internet; Building a profile of you allows the adware vendors to target their advertising).

Similarly to S&D, Ad-aware includes a resident shield - though we advise turning it off. It interferes with the S&D resident and is far more "noisy" when noise/alerts are not necessary. Perhaps if you're overly paranoid this is a good thing, but we ultimately found it to be an annoyance.

Our last consideration here is the dreaded pop-up. Quite often a site will pop-up an advertisement or similar. Though sometimes the pop-up is intended and you need it. This one really comes down to playing it smart in terms of what you do / do not allow. Generally speaking, pop-ups are more of an annoyance than a threat so we will not spend much time with them. However, it is worth inspecting and tweaking your browser configuration - most modern browsers do come with built in protection for this kind of thing.

Step 4 - Protecting your Configuration from Modification

We briefly covered this above with Spybot. But, there's one more thing we'd like to throw at this issue - User Accounts.

Do not, ever, ever, use your Windows Administrator account (or ANY account with Administrator privilages) for Internet Access. Consider this - if your system IS compromised, one lucky hacker has Administrator access to your machine - because you were the Administrator at the point of compromise.

Use the administrator account for it's intended purpose - configuring and maintaining your system. For all other purposes use a regular User account that does not have administrator privilages.

Step 5 - Windows Services

Within Windows are many components, applications and processes. A "service" is a process that runs in the background providing Windows with additional functionality. There are many services shipped with Windows - many enabled by default, and several that are of concern. To access your service list go via Start, Control Panel, Administrative Tools, Services. We recommend you disable the following services:

Windows Messenger Service - This was intended to allow messages to be sent between machines on a network. The spammers quickly moved in and abused the functionality of this service.

Universal Plug and Play Service - Again, the intentions were good. The idea was to allow for the discovery and usage of Plug and Play devices beyond your PC (i.e., on the network). The hackers managed to exploit this one, disable it.

Remote Desktop Help Session Manager Service - Disabling this will stop remote assistance. The idea was that in times of need you could invite a friend to assist you by giving them access to your machine over a network. Bad idea. Very bad idea.

Remote Registry Service - As above; This one allowed for system configuration changes.

Routing and Remote Access Service - As above.

TCP/IP NetBIOS Helper Service - Back in the day of NetBIOS and WINS this might have served a purpose. Now it's just a problem.

Terminal Services Service - Used by Remote Assistance, Fast User Switching, Remote Desktop and Terminal Server. Not using any of those? Disable this service.

NetMeeting Remote Desktop Sharing Service - Again, remote access is just bad, bad bad!

Print Spooler - You only need this if you are running a server that provides a printer to the network. Otherwise, leaving it running can put you in the firing line for a "Denial of Service" attack or DoS for short. A DoS attack is exactly that; It's the hacker's last resort, if they can't break in they may as well blow up the building.

(yes, we skipped automatic updates, worry not, we're coming to that in step 7!).

Step 6 - Windows Configuration

We're now moving down into the weeds. Windows configuration is a large subject area and it's almost impossible to come up with a "generic" solution that works for everyone. We all do different things with our PC and require different functionality. What we will do here, however, is give you the best general advice we can.

Use NTFS. Back in the days of Windows 95/98/ME the Windows file system used a technology called FAT32. FAT32 has been superceeded by NTFS. NTFS is far more secure because it supports file permissions. The chances are, your drives are already NTFS unless you installed Windows XP on top of an older version of Windows. To check and change open My Computer, right click on a drive and select "Properties".
Assign a password to every account from Administrator through to Guest. Windows will happily let you have a blank password and that, in our opinion, is a terrible thing. We will be discussing passwords and password policies in more depth in a forthcoming article.
As discussed earlier, use the Administrator account only for Administration.
Disable services as described earlier.
Disable the Guest Account. Leaving it enabled is dangerous. This only applies to XP Professional, the Home edition does not allow you to disable the guest account. For the home edition - assign a good long password to the guest account (again, coming up in a forthcoming article).
Rename the Administrator account. This won't stop a hardcore hacker but will certainly deter opportunists. Accounts can be configured via the Control Panel-->User Accounts.
Disable AutoRun for the CD-ROM. Do you trust every CD you ever put into your PC? If not, why allow a CD to autorun? You can do this by right clicking on the drive and selecting properties in My Computer.
Next we'll bring some automation into the picture. Check out Belarc Advisor ( http://www.belarc.com/free_download.html ) - it is free to download and use and will audit your PC. What comes back is a well presented report telling you where and how your configuration is weak. Very nice.
As a prelude to Step 7 we would like you to note that Belarc Advisor is not a static piece of software. It is updated regularly to check for new found problems/solutions and patches. We recommend you regularly update Belarc Advisor to stay ahead of the game.

Step 7 - MAINTAIN and UPDATE

We cannot emphasise this enough.

New problems are found every day. New solutions quickly follow. It is vital that you stay upto date and maintain your machine. Thankfully as a SC subscriber we'll prompt you to do exactly that. For now, take the following pointers into consideration...

Make sure you have the latest Windows Service Pack installed
Make sure Spybot, Ad-Aware, Belarc, AVG and any other program you use for protection is updated as regularly as the vendor allows. If the vendor provides an update, take it.
Windows Automatic Updates. Microsoft added this into Windows as far back as Windows ME. By default, Automatic Updates will be enabled on your PC. When there are patches and updates to Windows components the updater will automatically download and update your system.
There are times and instances when you might not want Automatic Updates enabled (and if you wish to disable them, head into the Services section as described earlier in this article). It does take some resources and bandwidth though this is probably only a concern for network administrators (imagine 1000 PCs all trying to download the same updates at the same time). If you do disable automatic updates we recommend you regularly run windows update manually or use a third part solution such as AutoPatcher ( http://www.autopatcher.com/ ).

Step 8 - Browser Configuration

Once again, we stumble onto a large issue. The correct thing to do here depends on which browser you use. We'll provide some advice here using the most popular browser - Internet Explorer. While the application you are using might be different the ideas and notions are the same.

Hit Tools, Internet Options. Review the Security, Privacy and Content tabs. These areas are relatively self-explanatory. Once you have reviewed and set your basic security settings hit the "Advanced" tab and follow the settings below:

Automatic prompting for ActiveX controls: Disable or Prompt
Binary and script behaviors: Disable or Prompt
Download signed ActiveX controls: Disable or Prompt
Download unsigned ActiveX controls: Disable or Prompt
Initialize and script ActiveX controls not marked as safe: Disable or Prompt
Run ActiveX controls and plug-ins: Disable or Prompt
Script ActiveX controls marked safe for scripting: Disable or Prompt
Automatic prompting for file downloads: Enable
Downloads: Enable
Font Download: Prompt
Access data sources across domains: Disable or Prompt
Allow META REFRESH: Disable
Display mixed content: Disable or Prompt
Don't prompt for client certificate selection: Disable
Drag and drop or copy and paste files: Prompt
Installation of desktop items: Disable or Prompt
Allow cookies that are stored on your computer: Disable
Allow per-session cookies (not stored): Enable
Java permissions: High safety
Launching programs and files in an IFRAME: Disable or Prompt
Navigate sub-frames across different domains: Disable or Prompt
Software channel permissions: High safety
Submit non-encrypted form data: Disable or Prompt
Userdata persistence: Disable
Active scripting: Disable or Prompt
Allow paste operations via script: Disable or Prompt
Scripting of Java applets: Disable or Prompt
Logon: Automatic logon only in Intranet zone
Enable Third Party Browser Extensions: Disable

The last entry here is important. While it will prevent you from using software such as the Google Toolbar, Browser "Helper Objects" are hacking gold. If an attacker can hijack your browser you may as well give them your passwords.

Some of the other settings such as Active Scripting may cause some of your favourite sites to not function correctly or annoy you repeatedly with prompts to confirm actions. The bottom line here is simple - go with what makes you comfortable. The guidelines above, while borderline paranoia, are our recommendations. Changes to the settings beyond the above really depends on you the individual and what you are happy with.

Step 9 - Wireless Advice

Our final topic is geared toward the Wireless User but some of what we will discuss below applies to anyone with a Broadband Router or ADSL Modem.

Most modern broadband routers have a web interface. That is, you login and configure your router via a web browser. The two most vital recommendations here are as follows:

Ensure that Remote Administration is Disabled. Many routers will allow you to access them from anywhere. That is, anyone can enter your IP address into their browser and be presented with the login screen for your router. Not a good idea.
Make sure you change the default password and if possible the login name. We'll be dealing with "strong" passwords in a forthcoming article but, for now, the key is to not leave the settings at their default. There are sites all over the Internet documenting default passwords. Hackers love those sites. Here's an example. http://www.phenoelit.de/dpl/dpl.html
Finally we move to the Wireless User. Many routers, by default, will not use a WEP (Wireless Equivalent Protocol) Key or will ship with default WEP keys (and as such, everyone in your neighbourhood with the same router will be using the same key). In either case this is bad news for you and good news for hackers.

Hackers use a technique called Wardriving. Sounds quite elaborate but it's actually a simple technique. One hacker with a laptop and a wireless network card hits the road in his or her car. Driving around, the hacker searches for signals. If the hacker finds your wireless router and you do not have a WEP key or have a known default key the hacker can now use your router for Internet Access.

Doesn't sound too bad does it? It is bad. Aside from the obvious fact that they're stealing your bandwidth and using Internet Access you paid for they also get the added bonus of being anonymous. They can do whatever they like, hack whoever they want and if the vitcims trace them it appears to be YOU that was the hacker. Expect a knock from the police.

The solution. Log into your router via its web interface. Go to the wireless configuration. You should find you can generate your own key based on a passphrase you enter. Don't make it obvious, a 500Mhz PC can guess 60,000 passwords per second. If a hacker has time and your passphrase is obvious you can expect a break-in. Once you have your new key, reconfigure your wireless stations to use it (or else they'll lose their connectivity, obviously) and sit back knowing you have made your connection more secure.

You should also stop your router from broadcasting its SSID (service set identifier). The SSID is essentially the network "name". Chances are, by default, your router will be broadcasting its SSID. This means potential wardrivers can "see" your network. If you prevent the broadcast - wardrivers do not even know your network exists. Coupled with the WEP changes above, this is about as secure as you can hope for.

Likewise, you should change the SSID name itself - as with passwords, the default SSID values are widely known for various routers and modems. Both SSID name and SSID Broadcast options should be present in your router configuration.

The obvious question from this is "how do I connect to the network then? we've just reconfigured things so it's invisible!". Well, YOU know the SSID, YOU chose it... and you can configure your connections by entering the correct SSID value in each of your clients. Put another way, the network is invisible unless you know the SSID.

Closing Thoughts and Musings

If a password is important don't let an application save it for convenience. This applies to your email client, your web browser or any other application that offers to "remember" your password. Such passwords are generally stored in what is termed the "Protected Storage" area of the system registry. If you try to view the protected storage area you can't - it is protected and hidden even if you are the System Administrator.

So why are we saying not to save passwords? Because they can be viewed even if Windows won't let you. A simple application that you can download here - http://www.nirsoft.net/utils/pspv.html - will show you the content of your protected storage area, you might be suprised at what you see.

Next up, monitor. Bring up your firewall from time to time (and particularly in times of suspicion). Look at all the current connections - incoming and outgoing - anything wrong with the picture? Investigate and act on what you can see. Likewise, in Windows you have an Event Viewer under administrative tools. Take the time to read what events have been recorded, if something is amiss there's a good chance it will turn up in the Event Log.

If you are concerned or think you may have been compromised, do something about it. Aside from the obvious (viruses, spyware etc.) we will be investigating more advanced techniques in a forthcoming article. Watch out for it, we'll be demystifying rootkits, browser helper objects and all that's inbetween.

Use the process viewer (hit ctrl-alt-del). What's running? If you see iexplore.exe and Internet Explorer is not running - be concerned. Are there any other unexplained or suspicious programs running? You should periodically check your services too. Hackers do write malicious services and services do not appear in the task/process list. Check what you've got from time to time. We have seen many malicious services on systems in the past.

Systems and processes aside, we advise you to look out for Hidden Processes. Yes, you read correct, processes can be running that do not appear in the task list. We recommend the SysInternals Process Explorer ( http://www.sysinternals.com/Utilities/ProcessExplorer.html ). It clearly shows exactly what is running, including hidden processes.

The End
Click to expand...

Private source.

GuitarGuru · Sep 10, 2006 at 4:00 PM

some of those things are retarded lol, like dont use an admin account to access the internet...... why would you not do that....

Blooper008 · Sep 15, 2006 at 1:39 PM

You seriously don't understand anything about real pc security, do you?

http://www.microsoft.com/athome/security/o...in_account.mspx

I really think this should be pinned...

XMasterX · Sep 15, 2006 at 2:49 PM

great one Dev! I didn't read it all, but in time I will. most of this I already know from college and personal experience..

REDCELL1 · Sep 16, 2006 at 12:42 AM

really all my knowledge has come from tiral and error,asking for help and looking up the soultions

xlink · Sep 16, 2006 at 4:16 AM

can't i just never do anything involving critical numbers like my social or credit card number and pop in a windows disc once a month and forget all the crap about PC security?

Blooper008 · Sep 16, 2006 at 11:36 AM

Ofcourse you can, but it's not 99% safe. You only have to have one keylogger on your pc and they'll have everything ^^

Log in or Sign up

Basic Pc Security Everyone Should Know

Blooper008 Well-Known Member

GuitarGuru Well-Known Member

Blooper008 Well-Known Member

XMasterX Well-Known Member

REDCELL1 Well-Known Member

xlink GR's Tech Enthusiast

Blooper008 Well-Known Member

Share This Page

Log in or Sign up

Basic Pc Security Everyone Should Know

Blooper008 Well-Known Member

GuitarGuru Well-Known Member

Blooper008 Well-Known Member

XMasterX Well-Known Member

REDCELL1 Well-Known Member

xlink GR's Tech Enthusiast

Blooper008 Well-Known Member

Share This Page

Useful Searches