Author: Jack Schofield
A lot of hacks depend on “social engineering,” which means manipulating people into handing over their passwords or other details.
It can be as easy as phoning up and pretending to be from head office or, apparently, trading passwords for bars of chocolate. Linux and Mac OS X are more secure than Windows, but PEBCAK is a problem with every operating system.
You could equally well ask, “How can I make my house completely secure?” Some simple precautions will protect you from casual theft in a nice neighbourhood, but not even bars and barbed wire will stop a gang equipped with explosives to blow your doors off. So, the real problem is to decide how much security you need. This will depend on who you are and where you live.
Who? In computing, you need a higher level of security if you are an obvious target or you have access to very valuable information. Obvious targets include celebrities, activists, and investigative journalists. You may also have valuable information if you work in finance, or at an important research establishment, or for some government agencies, etc.
Where? In computing, you create your own neighbourhood. If you visit sites that specialise in hacking, cracking or pirate software, then you’re at much more risk than if you only visit mainstream sites for shopping and social networking. Sites that offer free music, software or pornography are more likely to be dangerous than ones that offer the paid-for equivalents. Remember, if it’s free, somebody is probably making a buck somehow, even if it’s just by installing adware.
In protecting your home, the first rule is: don’t leave doors unlocked and windows open. In protecting your PC, it’s: don’t leave security holes open. Keep the operating system and all your software up to date. The vast majority of Windows hacks are based on exploiting holes that Microsoft closed months or even years ago. Yes, sometimes there are “zero day” exploits for which there is no patch, but these are worth a lot of money and mainly used on high-value targets.
To keep Windows up to date, turn on auto-updates: Microsoft will install patches on or shortly after the second Tuesday of each month. However, recent versions of Windows, if patched, are no longer the main target. As a priority, you must also make sure your browser (including IE), all Adobe and Apple programs for Windows, and Oracle’s Java are up to date. Uninstall Java if you don’t really need it. Indeed, uninstall everything you don’t need: it will reduce your attack surface.
Several programs can help. I use Secunia’s Personal Software Inspector, which checks for unpatched programs and helps update them. I also use SlimWare’sSlimCleaner, which checks and rates your software (it should all be Good), and lists programs that need updating. It also packs in lots of other useful tools including a cleaner, a disk analyser / defragger / wiper / shredder and duplicate file finder, and a Hijack log.
You should also run anti-virus software. Many people use the built-in Microsoft Security Essentials or Windows Defender. Those who need something heavier can install a free program such as Avast 2015 or AVG Free. If you require more complete security, install a paid-for suite such as Kaspersky or Bitdefender Total Security 2015. See my earlier answer, How can I protect my Windows PC against malware?, and check some recent tests before deciding.
Beyond anti-virus, it’s worth running the occasional check for hidden rootkits using Kaspersky’s TDSSKiller.
The web browser is your interface to the net, and therefore most likely to be attacked. Most leading browsers are reasonably safe, if kept updated, and Google Chrome may well be the safest. Although Chrome has the highest number of vulnerabilities, they get patched quickly, and it has a “sandbox” to help insulate it from the rest of your PC. Attackers therefore need two exploits: one for the Chrome browser and one for the sandbox. If you need more security, you can run any program in its own sandbox, using Sandboxie.
Gizmo’s Freeware also suggests usingDropMyRights to reduce the damage that malware can do while you are surfing.
Use Qualys BrowserCheck or a similar website to check that all your browser plug-ins are up to date.
For high-risk users, perhaps the ultimate protection is to sandbox all your computing by using a transitory or virtual machine. The simplest way to do this is to boot a new operating system from a Live CD or USB thumb drive – typically Linux but it could be Windows – and then dump the whole thing afterwards. WithReturnil SystemSafe, you can spawn a clone of your current operating environment and discard it when you’ve finished with it. Some people use “virtual PC” programs such as Oracle’s VirtualBox for the same purpose.
Any computer that’s online will find its ports being scanned from other computers, some of which will be worms (viruses), and some of which may be human attackers. It’s therefore important to have a firewall, and the one built into Windows 7 and 8 is good enough for most users. If you want more protection, there are plenty of alternatives, and you may already have bought one as part of a security suite. If not, read Gizmo’s guide to the Best Free Firewall Protection.
Your PC must have some ports open to connect to the net, but all your ports should be closed or “stealthed”. Run a firewall test at AuditMyPC or GRC (Shields UP) etc. NirSoft’s tiny CurrPorts will tell you which ports your PC is currently using, if you want to check for suspicious activity.
For very high-risk users, or corporate networks, the ultimate protection is to use a separate PC or server as a DMZ (demilitarized zone). However, your PC is probably behind a NAT router that does network address translation between the external internet and your internal network, and this protects against a lot of inbound traffic. Of course, it’s important to make sure your router is protected by a strong password, not any default it may have shipped with. Also, if it’s a wireless router, your Wi-Fi must be set up to use WPA2 (Wi-Fi Protected Access) encryption for security. The old WEP (Wired Equivalent Privacy) system can be cracked in minutes.
To sum up: most ordinary Windows users should be fine with Windows as shipped, if all its defences are turned on and all software is kept up to date. If you’re at risk, you can install programs that increase the level of security. After that, the biggest risk is social engineering, even if it’s just getting you to click something you know you shouldn’t.
People who need a high level of protection may find it worth following more of the tips outlined above, but if you’re being targeted by GCHQ or America’s three-letter agencies (or the Chinese or Russian equivalents), then you’ll need to take even more drastic steps.