dacs.doc electric: In Review... August General Meeting

Safe Computing is
Serious Business

*By Marlène Gaberel*
On August 3, 2004 DACS members and their guests had another good reminder coming from DACS virus expert, Jeff Setaro, on being careful when accessing the Internet. A few years ago the advice used to be simple: do not share any disk from a source in which you are not absolutely confident. If in doubt, check the disk with an anti-virus. With the Internet and the constant, instantaneous, exchange of files, it is a much more complex and potentially dangerous environment—one which requires serious anti-virus protection. Jeff went over his list of favorite anti-virus programs, which has not much changed over the years he has been giving presentations. The same companies that he used to trust then are still very much on the forefront of protecting your computers and are still very much reliable. The list of Jeff’s recommended anti-virus firms is in the table below and available from the DACS web site. I have used F-Prot, recommended by Jeff for the longest time; the price is reasonable and the software is easy to update. On the subject of malware and spyware, Jeff advised the audience to use the following defenses routinely: download patches for Internet Explorer and run utilities such as Ad-Aware from Lavasoft or Spybot Search & Destroy from safernetworking.org. Jeff gave a few examples of hoaxes. A common one is an e-mail that requests you to send a warning to all in your e-mail list or to remove a genuine file from your computer. Jeff also discussed the “zombie problem”. “Zombies” are networks of compromised computers that can used for relaying spam, conducting distributed denial of service attacks, or as web servers for objectionable material. The primary solution to these problems is to practice Safe Hex: Install and use quality anti-virus software and a personal firewall. Keep your system updated. Visit the Windows Update and Office Update sites periodically, roughly once a month and install the available patches and/or service packs. Use care when reading e-mail with attachments. Never, ever open e-mail attachments from someone you don’t know Do not open e-mail attachments forwarded to you, even if they’re from someone you know Do not open unsolicited or unexpected e-mail attachments until you’ve confirmed the sender Make backups of important files and folders Use strong passwords Use care when downloading and installing programs Disable file and printer sharing in your computer, particularly when accessing the Internet using cable modems, digital subscriber lines (DSL), or other high-speed connections. Do not select the option on web browsers for storing or retaining user name and password. Do not disclose personal, financial or credit card information to little-known or suspect web sites. Delete spam and chain e-mails; do not forward these and do not use the unsubscribe feature. Log off the online session and turn off your computer when it is not in use. Do not use a computer or a device that cannot be fully trusted. Do not use public or Internet café computers to access online financial services accounts or perform financial transactions. Ensure your browser supports strong encryption (at least 128-bit). Most browsers now provide this by default. Install and use PGP to encrypt confidential files and to digitally sign e-mail messages. Broadband users: install and use a hardware firewall/router. In case of disaster, step away from the computer. Think of what to do next. A write protected bootable start up disk or a bootable CD should be available just in case. If I have a problem with my computer, as now with my CD which does not work, I leave it alone for a day and make a list of options of what might be wrong and what I can do to resolve it. In the latest problem, after going through all the options, I concluded that my CD driver needs to be replaced. For Windows XP users, Jeff recommended using: ERD Commander from Winternals Software or PE Builder from Nu2 Productions to create a bootable CD-ROM that can mount NTFS partitions. The discussion wound down on the subject of spyware. It was widely agreed that Ad-Aware from Lavasoft (www.lavasoft.de) was the software of choice to use against spyware. Jeff even advised to stick to the free version, as long as it is updated regularly. SpyBot Search & Destroy (www.safernetworking. org) was deemed a distant second among participants of the meeting. When using Ad-Aware of Lavasoft, Jeff explained that the tracking cookies listed at the end of checking for spyware are the results of what web sites were visited and are then reported to other web pages. The sites owned by similar companies track the path of visitors. The meeting ended only after a long discussion on spam and the constant battle that Internet users face with their e-mails being bombarded with spam. Jeff mentioned, SecuritySpace. com, a web site that can be used to check the security of you computer or network by scanning for open TCP/IP ports and reporting what it finds. I went to the web site, but did not get a chance to register to give it a try. Many of the resources from the meeting are available from the DACS web site.

On August 3, 2004 DACS members and their guests had another good reminder coming from DACS virus expert, Jeff Setaro, on being careful when accessing the Internet.

A few years ago the advice used to be simple: do not share any disk from a source in which you are not absolutely confident. If in doubt, check the disk with an anti-virus. With the Internet and the constant, instantaneous, exchange of files, it is a much more complex and potentially dangerous environment—one which requires serious anti-virus protection. Jeff went over his list of favorite anti-virus programs, which has not much changed over the years he has been giving presentations. The same companies that he used to trust then are still very much on the forefront of protecting your computers and are still very much reliable.

The list of Jeff’s recommended anti-virus firms is in the table below and available from the DACS web site. I have used F-Prot, recommended by Jeff for the longest time; the price is reasonable and the software is easy to update. On the subject of malware and spyware, Jeff advised the audience to use the following defenses routinely: download patches for Internet Explorer and run utilities such as Ad-Aware from Lavasoft or Spybot Search & Destroy from safernetworking.org.

Jeff gave a few examples of hoaxes. A common one is an e-mail that requests you to send a warning to all in your e-mail list or to remove a genuine file from your computer.

Jeff also discussed the “zombie problem”. “Zombies” are networks of compromised computers that can used for relaying spam, conducting distributed denial of service attacks, or as web servers for objectionable material.

Install and use quality anti-virus software and a personal firewall.
Keep your system updated. Visit the Windows Update and Office Update sites periodically, roughly once a month and install the available patches and/or service packs.
Use care when reading e-mail with attachments.
- Never, ever open e-mail attachments from someone you don’t know
- Do not open e-mail attachments forwarded to you, even if they’re from someone you know
- Do not open unsolicited or unexpected e-mail attachments until you’ve confirmed the sender
Make backups of important files and folders
Use strong passwords
Use care when downloading and installing programs
Disable file and printer sharing in your computer, particularly when accessing the Internet using cable modems, digital subscriber lines (DSL), or other high-speed connections.
Do not select the option on web browsers for storing or retaining user name and password.
Do not disclose personal, financial or credit card information to little-known or suspect web sites.
Delete spam and chain e-mails; do not forward these and do not use the unsubscribe feature.
Log off the online session and turn off your computer when it is not in use.
Do not use a computer or a device that cannot be fully trusted.
Do not use public or Internet café computers to access online financial services accounts or perform financial transactions.
Ensure your browser supports strong encryption (at least 128-bit). Most browsers now provide this by default.
Install and use PGP to encrypt confidential files and to digitally sign e-mail messages.
Broadband users: install and use a hardware firewall/router.

In case of disaster, step away from the computer. Think of what to do next. A write protected bootable start up disk or a bootable CD should be available just in case. If I have a problem with my computer, as now with my CD which does not work, I leave it alone for a day and make a list of options of what might be wrong and what I can do to resolve it. In the latest problem, after going through all the options, I concluded that my CD driver needs to be replaced.

For Windows XP users, Jeff recommended using: ERD Commander from Winternals Software or PE Builder from Nu2 Productions to create a bootable CD-ROM that can mount NTFS partitions.

The discussion wound down on the subject of spyware. It was widely agreed that Ad-Aware from Lavasoft (www.lavasoft.de) was the software of choice to use against spyware. Jeff even advised to stick to the free version, as long as it is updated regularly. SpyBot Search & Destroy (www.safernetworking. org) was deemed a distant second among participants of the meeting. When using Ad-Aware of Lavasoft, Jeff explained that the tracking cookies listed at the end of checking for spyware are the results of what web sites were visited and are then reported to other web pages. The sites owned by similar companies track the path of visitors.

The meeting ended only after a long discussion on spam and the constant battle that Internet users face with their e-mails being bombarded with spam.

Jeff mentioned, SecuritySpace. com, a web site that can be used to check the security of you computer or network by scanning for open TCP/IP ports and reporting what it finds. I went to the web site, but did not get a chance to register to give it a try.

dacs.doc electric

Safe Computing is Serious Business

Safe Computing is
Serious Business