| Most of us don't give security risks a second thought. After all, who is a data thief going to target: me or the Pentagon? Who'd be interested in my computer? Well, the sad truth is that there are thousands of people out there who'd be delighted to find that they could connect to your computer. They might be looking for your credit card information, passwords for computers and Web sites, or a way to get to other computers on your LAN. Even more, they would love to find that they could install software on your computer, which they could then use to send spam and probe other peoples' computers. They might even use your computer to launch attacks against corporate or governmental networks. Don't doubt that this could happen to you. Much of the spam you receive is sent from home computers that have been taken over by criminals through the conduit of an unsecured Internet connection. The problem has gotten so bad in the past few years that starting with Windows XP Service Pack 2, when you install Windows software, Microsoft is now enabling the strictest network security settings by default, rather than requiring you to take explicit steps to enable them. There were just too many Windows computersperhaps millionswith no protection whatsoever. And with the advent of high-speed, always-on Internet connections, the risks are increasing, because computers stay connected and exposed for longer periods of time. In this chapter, I'll explain a bit about how network attacks and defenses work. I'll tell you ways to prevent and prepare for recovery from a hacker attack. And most importantly, I'll show you what to do to make your Windows XP system secure. NOTE If your computer is connected to a Windows Domain-type network, your network administrators probably have taken care of all this for you. In fact, you might not even be able to make any changes in your computer's network or security settings. If this is the case, you might find it frustrating, but it's in the best interest of your organization.
Even if you're not too interested in this, and you don't read any other part of this chapter, you should read and carry out the steps in the section titled "Specific Configuration Steps for Windows XP." Think You're Safe? Think Again. I want to give you a practical example of what can happen over the Internet. Just to see how easy it might be, one night at 1 a.m., I scanned the Internet for computers with unprotected Windows File Sharing. I picked a block of IP addresses near mine and used common, completely legal programs to find computers that were turned on and connected. Within a few minutes, I had found 20. I went through these 20 to see whether they had shared files or folders. My efforts didn't take long; on the fourth try, I was presented with the contents of someone's entire hard drive. Of course, I immediately closed the display, but not before noticing that one of the folders on the hard drive was named Quicken and probably contained all this person's checking and savings account information. Within 10 minutes I had hacked into someone's computer, and I wasn't trying very hard or using one of the many sophisticated tools available. I didn't even have to attempt to break a password. But even if I'd had to, would that person have noticed his or her computer's hard disk light flickering at 1 a.m.? Would you? |
To make matters worse, in a business environment, security risks can come from inside a network environment as well as from outside. Inside, you might be subject to highly sophisticated eavesdropping techniques or even simple theft. I know of a company whose entire customer list and confidential pricing database walked out the door one night with the receptionist, whose significant other worked for the competition. The theft was easy; any employee could read and print any file on the company's network. Computer security is a real and serious issue. And it only helps to think about it before things go wrong. Types of Attack Before I talk about how to defend your computer against attack, let's briefly go through the types of attacks you're facing. Hackers can work their way into your computer and network using several methods. Here are some of them: Password Cracking Given a user account name, so-called "cracking" software can tirelessly try dictionary words, proper names, and random combinations in the hope of guessing a correct password. This doesn't take a modern fast processor very long to accomplish. Address Spoofing If you've seen the Caller ID service used on telephones, you know that it can be used to screen calls: You only answer the phone if you recognize the caller. But what if telemarketers could make the device say "Mom's calling"? There's an analogy to this in networking. Hackers can send "spoofed" network commands into a network with a trusted IP address. Impersonation By tricking Internet routers and the domain name registry system, hackers can have Internet or network data traffic routed to their own computers rather than the legitimate Web site server. With a fake Web site in operation, they can collect credit card numbers and other valuable data. Eavesdropping Wiretaps on your telephone or network cable, or monitoring of the radio emissions from your computer and monitor can let the more sophisticated hackers and spies see what you're seeing and record what you're typing. Exploits It's a given that complex software has bugs. Some bugs make programs fail in such a way that part of the program itself gets replaced by data from the user. Exploiting this sort of bug, hackers can run their own programs on your computer. It sounds farfetched and unlikely, but exploits in Microsoft's products alone are reported about once a week. The hacker community usually hears about them a few weeks before anyone else does, so even on the most up-to-date copy of Windows, there are a few available for use. Back Doors Some software developers put special features into programs intended for their use only, usually to help in debugging. These back doors sometimes circumvent security features. Hackers discover and trade information on these, and are only too happy to use the Internet to see if they work on your computer. Open Doors All of the attack methods I described up to here involve direct and malicious actions to try to break into your system. But this isn't always necessary: Sometimes a computer can be left open in such a way that it just offers itself to the public. Like leaving your front door wide open might invite burglary, leaving a computer unsecured by passwords and without proper controls on network access allows hackers to read and write your files by the simplest means. Simple File Sharing, which I'll discuss later in the chapter, mitigates this risk somewhat. Viruses and Trojan Horses The ancient Greeks came up with it 3200 years ago, and the Trojan Horse trick is still alive and well today. Shareware programs used to be the favored way to distribute disguised attack software, but today email attachments are the favored method. Most email providers automatically strip out obviously executable email attachments, so the current trend is for viruses to send their payloads in .ZIP file attachments. Social Engineering A more subtle approach than brute force hacking is to simply call or email someone who has useful information and ask for it. One variation on this approach is the email that purports to come from a service provider like AOL, saying there was some sort of account glitch and could the user please reply with their password and social security number so the glitch can be fixed. P.T. Barnum said there's a sucker born every minute. Sadly, this works out to 1,440 suckers per day, or over half a million per year, and it's not too hard to reach a lot of them with one bulk email. Recently there has been an upsurge in a new form of social engineering called phishing, where spammers send an email that purports to be from your bank or eBay or other such vendor, with a link to a Web site that looks official, and a request that you sign on with your username, password, and other personal information. Denial of Service Finally, not every hacker is interested in your credit cards or business secrets. Some are just plain vandals, and it's enough for them to know that you can't get your work done. They may erase your hard drive, or more subtly, crash your server or tie up your Internet connection with a torrent of meaningless data. In any case, you're inconvenienced. For an interesting write-up on one such attack, see www.grc.com/dos.
If all this makes you nervous about hooking your LAN up to the Internet, I've done my job well. Before you pull the plug, though, read on. Your Lines of Defense Making your computer and network completely impervious to all these forms of attack is quite impossible, if for no other reason than there is always a human element that you cannot control, and there are always bugs and exploits not yet anticipated. You can do a great deal, however, if you plan ahead. Furthermore, as new software introduces new features and risks, and as existing flaws are identified and repaired, you'll have to keep on top of things to maintain your defenses. The most important part of the process is that you spend some time thinking about security. The following sections delve into the four main lines of computer defense. They are You can omit any of these measures, of course, if you weigh what you have at risk against what these efforts will cost you, and decide that the benefit isn't worth the effort. What I'm describing sounds like a lot of work, and it can be if you take full-fledged measures in a business environment. Nevertheless, even if you're a home user, I encourage you to consider each of the following steps and to put them into effect with as much diligence as you can muster. Just think of that poor sleeping soul whose hard disk I could have erased that morning at 1 a.m. (If you missed this poignant example, see the sidebar titled "Think You're Safe? Think Again." earlier in the chapter.) |
