If you are like most computer users today, you've heard - or perhaps experienced firsthand - the damage that computer malware (viruses, bots, etc.) can wreak. You may already be taking measures to protect yourself with a firewall, anti-virus and and anti-spyware, which is a good place to start. But if you think these measures alone can protect your system, you're wrong. The truth is you probably have no idea where the next attack may be coming from, and unless your computer is disconnected from everything but electricity, there are always threats. Taking computer security seriously is hard without understanding a bit about it; my job is to help you understand some ways hackers and cyber criminals do their dirty deeds.
Your house may have local threats from local criminals, but you can rest assured the Russians aren't coming in for your TV. The Internet, however, brings multitudes of criminals from around the world into your living room. They have autonomous malware programs that work ceaselessly to inject themselves into insecure crevices on a computer. Malware delivered with "drive-by downloads" and Web site pop-ups is common, and here's a vivid example.
Recently, I helped a friend connect high-speed Internet service to a spanking-new computer. It wouldn't connect, and all signs pointed to their new firewall-enabled router. To check the router, I connected the computer straight to the modem (remember, I am a trained professional - do NOT try this at home), but with anti-virus, anti-spyware and other protections enabled. The second I connected, pop-up windows appeared so fast I couldn't click "Shut down."
Similar to programs that send e-mails to large lists are ones sending malware-loaded spam to lists created by hackers and cyber criminals. At times, as much as 80 percent of Internet traffic is spam, much of it loaded with malware looking everywhere for openings. Remotely run "zombie networks" send spam and spim (spam for instant messaging) from all over the world.
A zombie network is a group of individual computers (maybe yours) infected with malware and run remotely by criminals. Infections come from many places, like a favorite site you visit that was hacked into last night. The infection opens holes in your defenses, gets instructions and executes them. Your computer silently does things without your knowledge, like sending spam to hundreds of computers when the zombie master sends a tiny instruction program. Sound far-fetched to you?
A savvy local internet company owner told me his provider cut his access with no warning. He called them saying, "I paid my bill. What's up?" They replied by telling him his computer was sending over 1,000 e-mails every night between 2 a.m. and 3 a.m. He said it wasn't him, but they confirmed it was coming from his IP address. Turns out the babysitter visited a popular social networking site, and despite good defenses, he was infected. Another friend hadn't run a spyware sweep in several months, and when he did, he found over 100 pieces of active spyware. Vigilance is important.
Recently, 17 Canadians were arrested, and police said their zombie network had around one million computers in a hundred nations. A U.S. teenager was separately busted for his network that included U.S. military computers. If a teenager can crack military computers, how hard can yours be?
Before you say, "It won't happen to me," how can you be sure? If I had told you thousands of people would die on September 11, 2001, would you have believed me? This by no means compares to 9/11, other than the fact that criminal and terrorist threats are real, and they use the Internet as a tool and a weapon.
Folks going to buy a big, hi-def TV rarely wander in and plunk down $1,000; they research it first. Many spend more time looking for that TV than securing their PC. Often, people don't know their computer is a zombie (sluggish performance is a clue). Sometimes their attitude is, "So what? I don't keep sensitive information on my computer. What's the harm?"
If your information (like e-mail addresses) is pilfered, it could be used against your friends. Your computer could be the launch pad for an attack on a friend's computer that steals their sensitive information. Next could be identity theft, financial loss and a great deal of stress and distress. You'd feel bad if a tree you knew you should have trimmed lost a limb and damaged a friend's car or house. It's easy to ignore threats when the effects are not physical - for you. Likewise, a friend's careless actions can be the start of an attack on you, and your e-mail address is the key.
Am I saying be paranoid and avoid the Internet? No more than I'm saying that, since you can die in a car wreck, you shouldn't drive. You can do the security equivalent of wearing a seatbelt and installing air bags on your computer. Sure, it takes some time and effort, but it takes far less than cleaning up after your computer has been compromised. Sometimes the damage is nearly impossible to clean up. Can you totally escape malware? No, but the right tools catch it early and, with techniques we'll discuss in future columns, you'll be safe.
Frank Goad is an account executive with a local information technology services company. He has over 25 years experience with computers ("Shoot, I remember TRS-DOS and CP/M Ö") and can be reached at info-frank@thinkingonit.com.