HACKERS, VIRUSES, AND WORMS-OH MY

HACKERS, VIRUSES, AND WORMS OH MY!

Attack of the Data-Eating Zombies

The Annoyance:

My computer seems to have a mind of its own. The drive light is flashing and it seems to be busy doing things when I'm nowhere near it. Have I been hacked? Do I have a computer virus? What can I do to keep from being hacked or infected?

The Fix:

Your machine may well have a virus. (Then again, maybe Windows is having one its regular nervous breakdowns.) Some viruses and worms announce themselves by displaying a silly message on screen; some make themselves known by destroying data or disabling your system. But in the past year we've seen an epidemic of attacks that turn PCs into so-called zombies machines that are remotely controlled over the Internet and used to launch attacks against other sites, forward spam, or do virtually anything else the hacker desires. Another big threat is keystroke loggers software that captures what you type and sends it to a remote location. These are extremely handy for stealing passwords, credit card numbers, and other confidential information.

The only way to prevent zombification is to follow safe email practices (such as not opening file attachments; see "Don't Get Too Attached"), keep your operating system up to date, and get software that protects you from digital delinquents (see the sidebar "Ten Essential Privacy Tools").

Think your PC is safe just the way it is? A visit to Steve Gibson's ShieldsUP! (http://www.grc.com/default.htm) may change your mind. (Scroll down to the "Hot Spots" area of the page to reveal the ShieldsUP! link.) The site will perform a benign probe of your PC's ports the communications gateways it uses to send email, get web pages, and so on and tell you whether you're vulnerable to attack. If you aren't running some kind of firewall or connected to a router, your system is wide open.

A BRIEF FIELD GUIDE TO MALWARE

So you think a virus is a bug that makes you sick and a worm is a bug that lives in your garden? In the digital world, these words have entirely different meanings and they ain't pretty.

Simply put, a virus is malicious code that attacks other programs. A virus may simply display a silly message on your screen, destroy all the data on your computer, or steal your personal information and shoot it off to a ring of identity thieves. Viruses typically attach themselves to executable files (EXE) and are spread by human actions like double-clicking that unknown email attachment. A current popular species of virus turns your computer into a zombie that a hacker can control remotely via the Internet, using it to send spam or overwhelm web sites with traffic, effectively shutting them down.

A worm is a kind of malware that's designed to spread itself far and wide, typically via email. Most worms are blended threats, combining a destructive payload with spreadability; i.e., they infect your system, and then transmit themselves using your email account. (And the havoc they wreak can be considerable. In January 2003, the Slammer worm spread across 90 percent of the Internet in less than 30 minutes, according to the Cooperative Association for Internet Data Analysis (CAIDA). It hit a wide variety of computer systems, knocking out everything from airline computers to bank ATMs.) One popular conduit is, you guessed it, Microsoft Outlook. If your system isn't properly protected, a worm could easily exploit a flaw in Outlook and send itself to everyone in your address book giving you yet another reason to love Microsoft.

A third form of malware is the so-called Trojan Horse, a seemingly innocuous program with a hidden payload (you know, like the soldiers hiding in the big wooden doorstop in that Brad Pitt movie). Trojans can steal personal information or let the machine be controlled by a remote user (see "Attack of the Data-Eating Zombies").

There's no such thing as good malware (hence the name), which is why every computer needs a solid security system including personal firewalls, spam filters, anti-virus programs, and regular software updates as well as a little bit of luck.

At a bare minimum, you want a firewall to keep hackers from installing software that takes over your system or steals your data. Windows XP comes with a very basic firewall, but the firewall is not enabled by default unless Service Pack 2 (SP2) is installed. To turn on XP's firewall, open the Network Connections control panel and right-click the connection you want to protect. Select Properties, click the Advanced tab, and check the Internet Connection Firewall box. (If you've upgraded to SP2, or bought your computer with SP2 already on it, the steps are slightly different. On the Advanced tab, you click the Settings button in the Windows Firewall section, and in the subsequent dialog box, click the General tab, then "On (recommended).") Click OK to confirm your choices and close Network Connections.

The Windows Firewall should keep Internet hackers from probing your system for openings, but that's about it. It won't, for example, keep applications on your PC from accessing the Internet behind your back, as many Trojan Horses and keystroke loggers do. A better choice is ZoneAlarm Pro ($30, http://www.zonelabs.com), which controls which apps can and can't access the Net, blocks pop ups, and lets you manage cookies. (ZoneAlarm also comes in a more limited free version, and as part of a $40 suite that includes a virus scanner, anti-spam tools, and other useful goodies.)

Mac OS X's firewall settings are found in System PreferencesInternet & NetworkSharing. Select Firewall, click the Start button, and close the Sharing window to turn on the Macs digital bodyguard.

PRIVACY IN PERIL: GET INFECTED, GO TO JAIL?

So what's the worst that could happen to you if your PC is turned into a digital zombie? Try 140 years in prison. Two recent cases in the United Kingdom hinged on the defendants' ability to prove the crimes they were accused of were, in fact, the result of malware planted on their PCs.

In April 2003, attorneys for 39-year-old Karl Schofield convinced a jury that 14 child porno images found on Schofield's computer were placed there by a Trojan Horse program, according to a report in The Register (http://www.theregister.com), a UK-based news service. Schofield could have faced a maximum of 10 years in prison for each offense. In October 2003, teenager Aaron Caffrey was acquitted of launching a distributed denial of service (DDoS) attack against web sites operated by the Port of Houston. (In a DDOS attack, a web site is flooded with Net traffic, rendering it inaccessible.) Again, a Trojan Horse that allowed his system to be controlled remotely was fingered as the source of the attack, even though no traces of such malware were found on his system.

Don't Get Too Attached

The Annoyance:

I just received an "email undeliverable" message. But there's a file attached. What should I do with it?

The Fix:

Follow Tynan's Golden Rule of Computing #2: when in doubt, delete. (Golden Rule #1: when things go wrong, blame Microsoft.) If you get an attachment you're not expecting, 9 times out of 10 it's a worm or some other digital nasty. Do not (I repeat, DO NOT) save or open this sucker. Opening the file will infect your computer; saving the file can be dangerous if you forget it's there and open it later. Delete it with prejudice. And get yourself an anti-virus program that will automatically detect and neutralize such attachments before they land in your inbox.

If you don't already have antivirus software installed, Panda Software's Active Scan (http://www.pandasoftware.com/activescan/com/activescan_principal.htm) will perform a free one-time scan of your system. You'll have to download an applet, surrender your email address and agree to receive e-newsletters as part of the deal, but that's a small cost for some peace of mind.

Friends Don't Let Friends Open Attachments

The Annoyance:

My best friend in the whole world just sent me a message with a file attachment. I know the person, so it's okay to open it, right?

The Fix:

Not necessarily. (See Tynan Rule #2.) One reason viruses spread like, well, viruses is that once they infect your system, they often mail themselves to everyone in your address book. If you get an attachment from somebody that you trust, call and ask them if they sent you something and if so, what it is. Only if you're convinced the file is benign should you take the plunge and even then, scan the attachment with your antivirus software the second it lands on your hard drive.

MAKING THE MOVE TO SERVICE PACK 2

If you haven't already upgraded XP to Service Pack 2, now would be a good time. Released in August 2004, SP2 patches some gaping security holes in XP and Internet Explorer. It also adds a pop-up blocker to IE and automatically turns on XP's Internet Connection Firewall. (XP's default setting was off does the word duh mean anything to Microsoft?) ICF can make your computer invisible to hackers and remote attackers, though unlike Zone Alarm or other third-party firewalls, it won't alert you if your PC is already a zombie or stop malware from phoning home.

You may be able to download and install SP2 using XP's Automatic Updates feature (see "Make Updates Automatic"). Or you might not Windows is just finicky that way. And at 266MB, you'd spend quite a while waiting for the file to download. An easier method is to order the CD from Microsoft. Visit the XP page at http://www.microsoft.com/windowsxp/sp2/default.mspx, click the "Order a CD" link under "Get Windows XP Service Pack 2," and fill out some web forms. It's free, and you can use it to upgrade more than one computer (but only if it runs XP). The page claims that shipping will take 4 to 6 weeks, but I got my disc in less than a week. The downside? SP2 doesn't always play nicely with other programs, including some versions of AutoCAD and Symantec AntiVirus. (For a list of known problems and ways to address them, see http://support.microsoft.com/kb/842242). You might also experience system slowdowns, especially if you're upgrading an older computer. And because SP2 has flaws of its own notably, a hole that could allow your files to be shared with the entire Internet you may need to download patches for it as well. For most users, though, SP2's additional protection is worth the trade-offs.

Antivirus Software Is Not Enough

The Annoyance:

My antivirus package scans incoming and outgoing mail, so I can open attachments with no worries, right?

The Fix:

Don't let that lull you into a false sense of security. Digital nasties can fool AV programs in a number of ways. For one thing, there's always a lag between the time a virus is set loose in the wild and when your antivirus vendor comes up with a fix an average of around 10 to 12 hours, according to German virus researcher Andreas Marx (http://www.av-test.org). And then you've got to remember to download the fix and install it, which can add several days to the tally plenty of time for you to get infected. Major AV packages like Norton AntiVirus and McAfee VirusScan let you schedule automatic updates, though after a certain period (which ranges from 90 days to a year) you'll have to pay an annual fee for future virus definitions. My advice: update your software at least once a week and whenever you hear of a big virus outbreak (which seems to happen at least once a week).

Better yet, set your AV software to automatically update itself whenever new virus definitions are available. In ZoneAlarm Security Suite, you do this by opening the suite's Control Center. Select Antivirus from the list on the left and click the Antivirus Options button. Under Advanced Settings select Updates, and check the Enable Automatic Updates (Recommended) box. Then click OK.

Stop Spreading the News

The Annoyance:

Ooops, I think I've just infected every member of my family and all of my close friends by sending them a virus. What do I do now? Do I have to enter the witness protection program?

The Fix:

No, but you might consider the witless protection program. First, send an email to the family and (former) close friends you may have infected, alerting them (sending flowers and candy couldn't hurt either). If you haven't already installed an AV program, now would be the time it should be able to isolate and kill the virus, assuming your system hasn't been damaged too badly. You should also update your operating system, as security holes are constantly being discovered and patches issued.

Windows XP makes this easy: make sure you're connected to the Internet, then click StartAll ProgramsWindows Update. On the Windows Update web page, click Custom Install. Microsoft will present you with a list of patches to install; pick the ones you want (certainly, all the critical "High Priority Updates). Click the "Go to install updates" link, then click the Install button. When the install is done you may need to reboot your system.

Make Updates Automatic

The Annoyance:

Virus scanners really slow down my system. I figure as long as I don't open attachments I'll be fine, right?

The Fix:

Wrong. In March 2004, clever virus fiends released variants on the Bagle worm that could infect systems when a piece of email was opened no strings (or files) attached. Opening the noxious message caused the victim's PC to secretly download and install malicious code. In this case, the worm only infected Windows machines whose users failed to install a critical security patch for Internet Explorer that Microsoft had released five months earlier. (To find out if your copy of IE is still vulnerable to such attacks, you can run a test at http://secunia.com/MS03-032.)

Of course, keeping up with Microsoft's critical security patches can be a fulltime job (and the pay sucks). Rather than fetching each update manually, simplify your life by telling Windows XP to automatically download and install updates as they become available (see Figure 3-9).

annoyances 3-9. Tired of keeping track of Window's critical updates? Let XP download and install the patches for you automatically.

Open the System control panel, click the Automatic Updates tab, and check the "Keep my computer up to date" box; if you're using XP with Service Pack 2, click "Automatic (recommended)." You can tell Windows to automatically download and install the updates; download the update and ask if you want them installed, or simply have it notify you when updates are available.