Internet Security Annoyances

Editor's note: The internet is an "equal opportunity annoyer"--no matter who you are or what you're doing online, eventually its many quirks may leave you feeling a bit disenchanted with the whole Net experience. When that happens, pick up a copy of Internet Annoyances, Preston Gralla's latest book for O'Reilly, which is chock-full of numerous fixes to what ails the internet, just like the samples you'll find here.

Related Reading Internet Annoyances How to Fix the Most Annoying Things about Going Online By Preston Gralla

Chapter 9: Security Annoyances

Ask people what concerns them the most about the internet, and security will most likely top the list. Spyware, worms, Trojans, and viruses have all become accepted hazards of using the internet, as have "phishing" expeditions, which route you to a phony web site that steals your personal information and passwords.

But there's no reason you should be bedeviled by these annoyances. This chapter gives you the tools and techniques to prevent or do away with them—it delves into special software solutions, shows you how to configure your home router for maximum security, tells you how to construct your own personal firewall, and more.

General Security Annoyances

Get free security checkups

The Annoyance:

I installed a firewall on my kid's PC, but being the paranoid parent that I am, I want to make sure I've locked out the bad guys. How can I give it a simple checkup?

The Fix:

For the most comprehensive check of your online security, head to Gibson Research (http://ww.grc.com) and perform the ShieldsUp test, which scans your PC for browser vulnerabilities, open network ports, and similar security flaws (see Figure 9-1). Also perform the Leak test, which checks your PC's vulnerability to Trojans. The Symantec web site (http://www.symantec.com) also offers a free online security test and a free online virus scanner. Click the Symantec Security Check link on the Downloads section of the main page to run their security scan. However, be wary when following the Security Check's advice—if it detects an older version of Norton AntiVirus on your system, for example, it will say you're at risk for getting a virus, even if your virus definitions are up-to-date.

Figure 9-1. ShieldsUp performs a comprehensive test of your online security. Here, it checks for open ports.

Microsoft's free security tool uses a different approach. The Microsoft Baseline Security Analyzer checks to see whether you've installed the most up-to-date Microsoft security patches and service packs, and looks for improperly configured security settings. To download it, go to http://www.microsoft.com/downloads and search for "Microsoft Baseline Security Analyzer."

Browse in perfect anonymity

The Annoyance:

Wherever I go online, I get the feeling someone is watching, tracking what I do and the pages I visit. The Attorney General is enough of a Big Brother; I don't want to have to worry about who's watching me on the Web as well.

The Fix:

You're right; web sites can gather an astonishing amount of information about you. They can track your online travels, tell what operating system and browser you're running, find out your machine name, peer into your clipboard, uncover the sites you've visited, examine your History list, and delve into your cache. They can also examine your IP address to learn basic information about you, such as your geographic location. To get a sense of the kind of information web sites can find out about you, head to the Anonymizer web site (http://www.anonymizer.com) and click the Free Privacy Test link. It will display your IP address, your current geographic location, the contents of your Windows Clipboard, and more (see Figure 9-2). It's pretty sobering stuff.

Figure 9-2. Go ahead—scare yourself. Head to this site and see just how much of your personal information can be exposed.

The best way to make sure that web sites can't gather personal information about you and your computer is to surf anonymously—that is, use an anonymous proxy server that sits between you and the web sites you visit. When you use an anonymous proxy server, your browser doesn't contact a web site directly. Instead, it tells a proxy server which web site you want to visit. The web site sees the IP address of the proxy server, not your PC's IP address. It can't read your cookies, see your History list, or examine your clipboard and cache because your PC is never in direct contact with it. You can surf anonymously, without a trace.

To use an anonymous proxy server in concert with your browser, follow these steps:

1. Find an anonymous proxy server. Hundreds of free, public proxy servers are available at http://www.atomintersoft.com/products/alive-proxy/proxy-list. The web site lists information about each server, including its uptime percentage and the last time the server was checked to see if it was online.

2. Find the server with the highest percentage of uptime. Write down the server's IP address and the port it uses. For example, in the listing 24.236.148.15:80, the IP address is 24.236.148.15 and the port number is 80.

3. In Internet Explorer, select Tools → Internet Options, click the Connections tab, and click the LAN Settings button.

4. Click OK and then OK again to close the dialog boxes.

   
   Figure 9-3. Set up Internet Explorer to surf the Web anonymously.

Now when you surf the Web, the proxy server will protect your privacy. Keep in mind that proxy servers can make surfing the Web much slower,.

You may also want to use a web-based, anonymous surfing service. For example, Anonymizer, Inc. (http://www.anonymizer.com) offers free and fee-based services. Each service installs a toolbar within Internet Explorer, which you can use to turn on anonymous browsing. The fee-based service costs $29.95 per year and offers benefits beyond those of the free service. For example, it shields your IP address and lets you set custom anonymity levels for different web sites. It also lets you completely block certain web sites.

Another solution is to download software that will automatically configure your browser to use anonymous proxy servers. It will also automatically find the fastest one, without any setup on your part. For example, GhostSurf (http://www.tenebril.com/products/ghostsurf) uses multiple anonymous proxy servers and always checks for the fastest one. The software costs $29.95, but you can download a free 15-day trial version if you want to check it out.

Beware of phishing expeditions

The Annoyance:

I received an email from eBay the other day, asking me to validate my user ID and password. When I clicked the link, I was sent to what looked like the normal eBay web site and entered the information. A few days later, I found out that someone was using my eBay ID to scam people. This slimeball even got my credit card information! How can I prevent this from happening in the future?

The Fix:

You've been the victim of a so-called "phishing" expedition, in which an email is sent claiming to be from a legitimate web site or business (such as eBay, PayPal, or Citibank). In the body of the message, you're asked to click a link to a web site so you can verify your account information. The return address appears to be from the company (for example, accounts@eBay.com), and the web site looks legitimate—the design, layout, and even the address bar look like the real web site. But when you type in the information, it goes to the scam artist running the phishing expedition, and he's off to the races with your credit card or web site account information.

To make sure this never happens to you in the future, follow these tips:

• Never respond directly to an email message asking you for your username, password, or other information. Sites like eBay will never send out a request for this type of information.

• If you're not sure whether the email is legitimate, don't click any links within the body of the message. Instead, go directly to the web site from your browser, log in, and see if you have any messages. You can also contact or email the company directly and ask whether they requested any information from you.

• Forward potentially spoofed email to the business that supposedly sent it. They will attempt to track down the source of the spoofed email and cut down on future phishing expeditions. You can also forward the email to assorted groups that fight phishing, such as reportphishing@antiphishing.com and uce@ftc.gov.

• Keep Windows XP updated. Some phishing expeditions exploit browser vulnerabilities, and Microsoft constantly releases patches to fix those vulnerabilities. Use Windows Update or visit http://windowsupdate.microsoft.com to keep your system updated with the latest patches.

  TIP: According to the research firm Gartner, an estimated 57 million people have received email from phishers. Gartner estimates that identity theft fraud caused by phishing attacks cost U.S. banks and credit card companies $1.2 billion in 2003 alone. Despite these staggering statistics, officials rarely find and prosecute phishers.
  
  

Guaranteed, foolproof way to uncover spoof sites

The Annoyance:

Many companies use weird web addresses and URLs to hide their true identity. Is there a simple, foolproof way to reveal the real name of the site I'm visiting?

The Fix:

Go to the address bar of your browser, type in the following JavaScript command, and press Enter:

    javascript:alert("Actual URL address: " +
    location.protocol + "//" + location.hostname +
    "/");

A small window will pop up in the middle of your browser, telling you the actual web site you're visiting (see Figure 9-4). Check the URL to see if you're really visiting the site you think you're visiting. That way, you can always protect yourself against spoofs.

Microsoft has a useful knowledge base article that explains how to protect yourself against spoofed sites. To read it, go to http://support.microsoft.com and search for article 833786.

Figure 9-4. Yes, the site looks like eBay, but if you enter your personal information, your credit card details and identity will be stolen. The JavaScript command exposes this fake eBay web site as a phishing expedition.

Block snooping neighbors

The Annoyance:

A friend of mine used to easily spy on the hard drives of neighbors who, like him, had cable internet access. Why was it so easy? And how can I make sure like-minded snoops can't get into my PC?

The Fix:

Cable setups are not unlike local area networks, and you and your neighbors are essentially "nodes" on that network. (It's one reason your access slows to a crawl when Johnny next door decides to download a movie.) If you have file sharing enabled on your PC, your cable-connected neighbors can spy on your PC. One way to solve the problem is to use a firewall, such as ZoneAlarm (http://www.zonealarm.com) or the built-in Windows Firewall. Both firewalls will stop outsiders from snooping on your PC.

To be absolutely safe, you can also turn off file sharing on your system for your cable connection:

1. Right-click My Network Places and choose Properties.

2. Right-click your cable internet connection and choose Properties.

3. Uncheck the "File and Printer Sharing for Microsoft Networks" box and click OK.

4. Restart your computer. File sharing is now disabled.

TIP: If you spend a lot of time on the internet, you'll come across the term malware sooner or later. What does it mean? Malware is any kind of software--viruses, worms, Trojans, or spyware--designed to do harm in some way.

My kids keep downloading malware

The Annoyance:

My kids keep downloading some piece of malware that damages my PC. How can I make sure they can't connect to the internet when I'm not around, short of locking the cable modem—or them—in a closet?

The Fix:

You can disable your internet connection when you leave your PC. Right-click My Network Places and select Properties. Right-click the Local Area Connection for your network card and choose Disable. If you have a network icon running in the Notification area (or System Tray), you can also right-click the icon and select Disable. To re-establish the connection, right-click the Local Area Connection or network icon and choose Enable.

Beware of spoofed emails

The Annoyance:

I own my own domain, and I got an email the other day from someone claiming to be my domain's mail administrator. The message asked me to confirm my password and username. But I'm the domain administrator, and I didn't send the message to myself! Odder still, the email seems to have come from an address in my domain. What's going on here?

The Fix:

Your email has been spoofed—someone has managed to forge the sender's address and make it appear as if the email came from you. If you respond to the email with your password and username, the message will go to the person who spoofed your email, and the sender will have complete access to your domain—so don't do it! Email requests for your username and password details are sure to be spoofs, not legitimate requests. Exercise caution, and don't give that information away.

Preston Gralla is the author of Windows Vista in a Nutshell, the Windows Vista Pocket Reference, and is the editor of WindowsDevCenter.com. He is also the author of Internet Annoyances, PC Pest Control, Windows XP Power Hound, and Windows XP Hacks, Second Edition, and co-author of Windows XP Cookbook. He has written more than 30 other books.

View catalog information for Internet Annoyances.

Return to the Windows DevCenter.

Copyright © 2009 O'Reilly Media, Inc.