 |
Adventures in Computer SecurityDave Helmer, CUGGMarch 2008 |
My first foray involved a home with 3 desktop systems
scattered about the house and two laptops that came and went at random,
all connected via a combination of Cat-5 cables and a wireless router.
Systems were running slow, some taking over 10 minutes to fully boot
up. Some would no longer run certain software that was needed, and some
were always leading their users to websites of a questionable nature.
This latter due in part to half the family being made up of underage
males, I have no doubt. A quick test of the network first determined
that the wireless router was un-secured, a major no-no. A not-so-quick
sweep of the affected systems then resulted in the removal of more than
2000 separate pieces of mal-ware from 2 of the desktops and both
laptops, and the complete hard-drive wipe and OS re-install of one
desktop system. The malware that was found included the usual suspects:
dialers, highjackers, Trojan loaders, spyware, adware and the
inevitable tracking cookies. This multi-system cleanup took the better
part of a weekend, and with the wipe and re-install of the one computer
actually extended out into the following week. This project was
atypical for me, in that I usually just get called upon to deal with
one system at a time, and in that I then spent the following weekend
subjecting the family in question to a 4 hour seminar on the subject of
computer security, and how to use the tools I had left behind,
installed on each and every system.
The most shocking part of that discussion for them though, was what
they discovered about their un-secured wireless network. I had
deliberately left the router unsecured that first weekend, and put in
place a logger program to track the connections being made through it.
This was done with the full knowledge and consent of one of the adults
in the home. Unsurprisingly to me, when I checked that log the
following weekend, the family in question had not been the only ones
making use of their wireless connection. Unsurprisingly again, the
family had no clue who any of the other connections were. After
resetting the wireless router to a secure mode, we then talked about
the possible ramifications of an unsecured wireless connection.
Unsecured wireless connections can be a godsend to those who use the
Internet for nefarious purposes, purposes that can range from simply
browsing adult websites anonymously, to international terrorists
communicating through a connection that can never be traced back to
them. Okay, I admit, that latter scenario seems unlikely in any of the
small towns surrounding Greeley, but it is a very real possibility, and
one more good reason to secure your wireless network if you have one.
Stretch your imagination a bit though, and I am sure you can think up
any number of reasons why someone might want to be able to connect to
the Internet in total anonymity, and your open wireless router can
provide that to them. Any connections that get traced back get traced
to your router, and that's where the trace ends. Leaving you the
suspect in whatever it is that caused that trace to happen. I have no
clue what your liabilities are with regards to someone making
unauthorized use of a wireless connection that you provided, but I'd
far rather secure my connection and not have to find out, wouldn't
you?
The system that I wound up formatting and reinstalling the OS on, was
simply so polluted with malware that none of my efforts to remove them
all were successful. Hence the wipe and re-install. This is what can
happen when you do not take care of your computer. The culprits in this
computer's demise were the children and the multitude of game sites
that they had been visiting online, and then downloading game software
from, in order to play those online games. Totally innocent, nothing
nefarious on this system at all, beyond the multitude of malware that
they installed along with those games.
My second foray into the muck involved a single lady who only used the
Internet for e-mail and to browse quilting websites. Pretty innocuous
use of a computer, and at first glance, not someone that you would
suspect of getting into too much trouble online. And her use of the
Internet was not what led to her computer having some 400-odd bits of
malware on it. The culprits in this case turned out to be all of the
cutesy, funny little e-mails that people kept sending her. You know the
ones, "Click here to see something funny", and the like. Her computer
responded very well to a routine cleanup, and she has promised to avoid
opening every single piece of e-mail she gets. I did leave my usual
compliment of freeware utilities installed, and she has promised to
keep them updated and in use periodically as well. Time will tell.
My final foray was just this past weekend, and involved the computer
belonging to a couple and their teenage son. My contact was through the
mother, who works for my father here, and who was appalled at what was
coming up on her screen when she accessed the Internet. I was slightly
appalled myself when I first brought up the system and started checking
it out, and it takes quite a bit to disturb me. I get a lot of grief
from certain quarters with regards to my sexual orientation, but at
least I stay within the bounds of my own species. I was pleasantly
surprised to find that this lady actually had AVG FREE Anti-virus
installed and the database was current on it. I was very pleased to
find that she also had AVG FREE AntiSpyware installed, since I was
unaware that AVG was even offering a freeware version of their
AntiSpyware program (it is now part of my regular freeware arsenal). Of
course the database for it was out of date, as the freeware version
requires manual updates and manual activation of the scan. Four hours
of cleanup work later, I return what I thought was a relatively cleaned
up system to it's owner, having removed over 600 bits of malware, and
26 pornographic videos in the process. A phone call just this morning
however, finds the system re-infected with over 30 malware items
according to the AVG FREE Spyware scan she ran, after noticing the
highjacker BHO in operation again. One of my suggestions to her after
the initial cleanup work, has now become my one and only suggestion,
and that is a total wipe and re-install of the operating system. Some
things just don't respond well
to anything else.
My mother asked me the other day while I was in the middle of this
last cleanup, why this kind of thing never happens to my computer, or
to hers. The answer, I told her, is pretty simple. She runs a
Macintosh, and I don't allow this stuff on my computer. Very little
malware is written for the Macintosh operating system, because it
comprises such a small percentage of the active computers on the net. A
hacker that writes malware for the Mac is not going to get much
notoriety from it, because so few people would ever catch it. I keep my
computer locked up with various utilities, and am very circumspect
about what I do while online. Years of self-acquired knowledge and
practice in this area makes my systems much more secure than the
average home, and even some business, users computers. There is an old
saying goes that "A little knowledge can be a dangerous thing", but I
would counter that a complete lack of knowledge is even more dangerous,
especially with regards to computer security. Don't get me wrong, I am
no Security Expert, I just happen to know a bit more than many about
the subject.
Now, to put things back in perspective, I do have to say that one of
the single most infected systems I have ever run across was in my own
home. My 19-year-old foster son's computer had over 1200 pieces
of malware on it recently. He too, likes to download and install games
from the Internet to play. He also prefers to cheat at those games as
often as possible, and therefore spends an inordinate amount of time
trolling for hacks, cracks, and cheat programs to enable him to play
the games in his preferred manner. Along with all those hacks, he
installed numerous dialers, Trojans, highjackers, spyware, adware, and
even virii (he even disabled the AVG program at the suggestion of one
site!).
For those of you that had the patience to read all the way through this
month's drivel, the software that I use when getting muddy includes:
AVG FREE Antivirus, AVG FREE AntiSpyware (newly added), Spybot Search
and Destroy (also freeware), SpyWare Blaster (freeware), A2FREE and
System Mechanic, a commercial program that does a variety of useful
things. I also like and use JKDefrag, a freeware HD defragging utility
that can be
configured in a number of ways.
That's it for now, have a great month! As usual, comments can be directed to dhelmer1@qwest.net, criticism to the nearest rubbish bin.