The Internet is no longer what it used to be back when I started using it (roughly 1995). While this is good in some ways (more information that is easier to find), there's list of bad things so long it would make Al Gore wish he never invented the Internet. I frequently get emails asking me what the best way is to safely use the Internet, and most importantly, surf the web (yes, the WWW is actually a subsection of the Internet).
There are loads of entry points into a common Windows system that could allow a hacker to take control of your system, crash or reboot the system, or steal data. However, these can mostly be divided into a these groups:
- Vulnerabilities in Windows or its components
- Vulnerabilities in Internet-enabled programs
- Default or bad configurations
- User error or ignorance
I will discuss each of these to the best of my knowledge below.
Vulnerabilities in Windows or its componentsPretty often, vulnerabilities are discovered in Windows that can allow an attacker to do pretty much everything to your system, while it varies from simple things as stealing cookies to complete remote control. While tempting, this is not purely caused by bad programming on Microsoft's part: Windows is simply used by so many consumers, businesses and even governments that hackers just go for the largest common denominator. After all, the more you use a program, the faster you'll find errors in it. Microsoft has monthly patch security bulletins, in which they release any hotfixes for vulnerabilities of that month. The best way to stay on top of these is to simply on Automatic Updates, which is available natively for Windows 2000 and newer, and available seperately for Windows 98 and newer.
Solution: install security patches, turn on Automatic UpdatesVulnerabilities in Internet-enabled programsBesides the basic flaws, there are also vulnerabilities in other programs. The most common one is probably Internet Explorer, which has several standing vulnerabilities which can cause your system to be infected with adware, spyware or worse by simply visiting a website. Due to the model Microsoft uses for its software, security may not come in first! Best is to use a different browser for your surfing habits:
Mozilla FireFox and
Opera are very good browsers that may not have won the browser wars, but make very good alternatives. While Internet Explorer is a major point of attack, file sharing (P2P) programs, email clients and instant messaging programs are the most commonly targeted. For servers, any web services are also frequently targeted. To counter this, always make sure you have the latest version of any programs that use the Internet or act as a server, and shutdown any that you don't use or need. Don't accept or run files from people you don't know over P2P, email or IM, and always have an antivirus program running that scans all files you download or receive. More importantly, if you use antivirus and/or antispyware, make sure they have the latest definitions so they'll be able to detect and delete any threats. Run weekly or monthly full-system scans with both to make sure your system stays clean. Run a firewall so you'll be able to block Internet access to a program that is partially vulnerable or outdated.
Solution: Don't use Internet Explorer. Update old programs, use a firewall, up-to-date antivirus and antispyware Default or bad configurationsEarly on in their rise, Microsoft decided to put user-friendlyness before security, sometimes setting up default configurations for programs like IIS that were insecure. While this does not happen that often, it is something to look out for. Like mentioned before, shutdown any services or programs that you do not need or use. Make sure you properly configure any Internet-enabled programs when you install them, and look up information on the web about securing such programs if you are not sure.
Solution: Properly customize programs, ask for help or search the web for helpUser error or ignoranceAfter all the above, which mostly involves things you can't do anything about, there's always yourself or the people around you. I can't count the amount of emails I have received that started off with 'my son installed something on the computer last week...' and end up in a horrible spyware infestation. Make sure you and your peers know what is right and wrong online, look up information on a program before using it to see if it bundles any programs and functions properly. Don't trust everyone out there, as it is fairly simple for people to try and trick you into running a file, visiting a website or giving them private information. Phishing scams are on the rise and are very dangerous: someone will portray himself as a bank and ask for your account password, for example. Don't be fooled!
Solution: Don't trust everyone, use common sense, educate yourself and othersThat's it for now. I'll add stuff later on when I think of anything I could have forgotten.
