about
Personal Computer Security
11/26/2022

Personal Computer Security

basics for computer users

These notes provide simple descriptions of common attacks on internet connected computers and things you can do to avoid or deflect them.

  • Computer Vulnerabilities

    Here's a list of a few common security attacks - there are many.
    Attacks List - click me  Click on each item below for brief discussions.
    1. Malware
      Software downloaded to your computer when you click link to malevolent site
      • Keylogger:
        attempts to steal your credentials when you use them.
      • DDoS:
        Enlist your machine into bot army for Distributed Denial of Service attacks on other sites.
      • Local denial of service:
        Pop-up many windows and send hundreds of notifications. Offers "service link" to ask for money or install more malevolent code.
      • Ransomeware:
        Encrypts your files and asks for payment to unencrypt.
    2. Phishing Emails and text messages that use "Social Engineering" to get sensitive information and money.
      • Email that attempts to get you to click on malevolent links or disclose your identity information.
    3. Token Theft Steal authorization tokens intended for use in session with banking or shopping site.
      • Authorization tokens allow you to access multiple pages with only a single login.
      • Sites you visit can download tokens from your machine. That may include authorization tokens from banks or shopping sites.
      • If you visit malevolent site after online banking, and you didn't logout (which destroys the authorization token), the malevolent site may use it to get access to your accounts.
    4. Remote Access Exploit operating system or network vulnerabilities to gain administrator access to your machine.
      • Steal sensitive information like Turbo Tax files.
      • Enlist your machine in malevolent bot army for spamming or DDoS attacks.
    Operating systems and browsers are frequently updated to remove vulnerabilities. That helps, but exploits still happen, so you need to take reasonable precautions.

  • Securing Computers

    Relatively simple things you can do to improve your computer's security.
    Protections - click me  Click on each item below for brief discussions.
    1. Install Antivirus
      • Install free versions: Avast, AVG, MalewareBytes, ...
        - malware removal, but may not provide blocking
        - frequent notifications about upgrading
      • Install paid versions: Norton, McAfee, Avast, AVG, MalewareBytes, ...
        - malware removal and blocking and ...
      • When downloading beware of malevolent sites with very similar names.
      • Avast , MalwareBytes, PCMag AV Reviews, PCMag AV for Macs
    2. Perform backups occasionally
      • Most modern operating systems provide means to backup selected files to their cloud storage, e.g., Microsoft's OneDrive.
      • You can buy an external usb drive for about $100 with the capacity to store everything you care about. I use a utility called Robocopy on my Windows machines, and backup about once a month.
      Robocopy backup batch file
      Most user's will use a much simpler script, perhaps with only the single statement:
      robocopy c:\users\<user>  %1\<machine>\users\<user> /XO /XX /S /NDL /R:2
    3. Use Strong Passwords
      • Eight or more characters - mix of alphbetic, numerical, and punctuation.
      • Password managers make that easier.
    4. Use 2 Factor Authentication (2FA)
      • Uses two levels of authentication for a secured connection, e.g., bank account.
      • First level is the usual id and password.
      • Second level is an additional step that may send you a message to your phone or ask you to respond to a security question or use a hardware key.
      • So even if your password is compromised, an attacker cannot easily get access to your account.
      • The account's website has to enable 2FA and allow you to opt in or require you to use it.
    5. Log out of banking and shopping sites
      • Secured sites - ones that use a secure connection and require login - use authorization tokens to allow you to visit multiple pages with only one login.
      • When you logout of the site, the authorization token is destroyed.
      • If you do not logout before visiting another site and that site turns out to be malicious, it can download the authorization token and gain access to the secured site under your identity. If that is your bank, they can withdraw money from your account.
      • An extra precaution for the paranoid - clear browser data
      Firefox: Settings > Privacy & Security
    6. Use secured connections
      • A secured connection - one with an address that starts with "https://" - encrypts messages before sending them.
      • Unsecured connections - using "http://" (no trailing s) - send messages in plain text.
      • When you are using a public site - no login - anyone using the site at the same time can use a network analyzer to read your messages.
      • Even for sites with login, anyone with the password can read your plain text messages.
      • I've set my browser to warn me if I link through an unsecured connection.
    7. Don't click on unknown links
      • Check link's real address by hovering over link and checking bottom left corner of the browser window.
      • Don't click the link unless the link goes somewhere you trust. For the screenshot below I hovered over the MalwareBytes link.
      • Note that the advertised destination is just an alias for a real address, and could be something very different.
      Browser shows real address when hovering over link
      • It is easy to copy a site's source code and present a page to a user that looks almost the same as a bank or shopping site's page and insert new real addresses.
      • A malevolent site might do that to capture your login credentials.
    8. Set network connection type to Public (No file sharing)
      Windows 11 Settings - Select Public Network
      • The public network setting turns off file and printer sharing which adds another layer of protection for your files.
    9. Accept all OS and Browser security updates
      • Most modern operating systems and browsers automatically apply security updates.
      • Older OS versions and browsers with small user bases may not do so.
    10. Good news and bad news
      • The good news:
        Modern operating systems and browsers apply a lot of techniques to secure your computing experience. You don't need to be paranoid about these protections.
      • The bad news:
        There are a lot of bad actors attempting to compromise personal computers and network servers. So, you need to help your OS and browser by following the advice above. If you don't, most of the time you will escape damage, but it only takes once to cause a lot of grief.
  • References
  Next Prev Pages Sections About Keys