Basic Computer Security

Explaining computer security so even those who are not tech savvy can understand how to protect themselves from threats like viruses, phishing scams, vulnerabilities, losing data, hackers or other cyber security threats.

[basiccomputersecurity]

This article gives some good online shopping tips.

Watch out for ridiculously good deals, especially if it is on a site that is not well known. If your on a well known site like Amazon or Walmart make sure you typed the address in correctly and the address of the website isn't something like  walmart.gooddeal.com. If this is the case, you might be on a phishing website. The part before the .com shows what website it is. Make sure you are on a well known site like Walmart, Amazon, etc.

Don't do online shopping or banking on public wireless networks. It is easier for hackers to steal your personal information on public wifi.

Try using gift cards instead of debit or credit cards.

Also, make sure the start of the website says https. The s stands for secure and all legitimate shopping and banking websites will use it to protect your information.

Avoid saving your credit card and other personal information when shopping. Although this can save you time if you want to buy something from the same site later, it also opens the possibility for hackers to steal this information.

[basiccomputersecurity]

Keeping it cool

It's important to keep your computer cool. Heat can shorten the lifespan of certain computer parts or possibly destroy them immediately if they get too hot. There is also a possibility that this will cause data loss. Your computer will slow itself down or even shut itself off to try to prevent this damage. To keep your computer cool, you need to keep it clean. Computers use fans to try to cool themselves off, but dust makes this more difficult. About once a year, you should use a can of compressed air to clean out the inside.

To clean a desktop computer, take it outside, to a basement or somewhere you don't mind getting dusty, but make sure there are no animals or small children around. To avoid damaging your computer with static electricity, touch the outside of the metal case to discharge the static electricity and avoid touching anything inside the case unless you need to. You can open up the case usually by unscrewing some screws on the back and sliding off the side panel of the computer. Once the case is open, connect the straw that came with the compressed air and blow short bursts of air to blow dust, cat hair, etc out of your computer. When you blow compressed air on the fans in your computer, hold them in place with your fingers to prevent them from spinning too fast and getting damaged. Keep the can upright to keep it from spraying any liquid. The can will get cold as you use it. This is normal. To avoid damaging your computer with static electricity, don't use a vacuum to clean your computer unless you have anti-static vacuum for computers.

You shouldn't open up a laptop unless you really know what you are doing. But, you can still blow compressed air into the vent where the fan blows hot air out (usually on the back). Also, to keep your laptop from overheating avoid putting it on soft fabric objects like beds, pillows, couches, carpet. Place it on a hard flat surface instead. If your laptop's fan is making a lot of noise (indicating that it's getting hot), you can prop the back of the laptop up with a book. This makes it easier for your laptop to suck cool air in the bottom and cool itself off so the fans don't have to spin as fast. You can also buy laptop stands to improve the air flow.

A really hot room can sometimes make your computer overheat. If your computer is running really slow or even shutting off, try moving your computer to a cooler room or reducing the temperature in the room.

If your computer suddenly goes completely silent and the fan isn't making any noise at all, turn your computer off immediately and get a computer repair shop to replace the fan. 

[basiccomputersecurity]

Smartphone Safety

Here are some tips to keep personal information safe on your smartphone.

1. Password protect your phone to prevent thieves from getting into it.

2. If your phone is stolen you can use tracking and remote wipe. Apple's iCloud will let you track your device if it is lost or stolen. Set up iCloud here. After you have done that, you can go to iCloud.com and log in. It will also let you erase everything on your phone to prevent the thieves from getting your personal information. If you have an Android phone, this article explains how to use Google's Android Device Manager  which will let you do the same thing as iCloud. iCloud also works with iPads and iPod touches and Android Device Manager will work with Android tablets.

3. Don't use public wifi if your doing online banking or shopping because it is easier for hackers to steal information on unsecured wireless networks. Use your smartphone's data plan when you are doing these things. 4. Install anti-virus on your phone and run it regularly. This is important for android. iPhones haven't had problems with viruses so far because Apple reviews every app added to the app store. 5. When installing apps on an android phone, check out what others are saying about it using Google and looking at reviews. If other people are saying it collects personal information or is a virus, don't download that app!

[basiccomputersecurity]

Staying safe on Facebook part 2

Be careful about what you post on Facebook. This article tells about someone who posted about their vacation on Facebook and came back to find that her house had been robbed by one of her Facebook "friends."

To prevent this from happening to you, don't post about your vacation until you get back or don't post the exact dates you will be gone. For similar reasons, you shouldn't post where you live, where you are, or where going to be on Facebook. If someone wants to stalk you and you post this information, they know exactly where to find you.

When you take photos on a device with a gps, like a smart phone, geotagging will store the longitude and latitude in the picture. If you upload that picture to Facebook, then people will be able to find where you took that picture. Click here to learn more about geotagging and to find out how to disable it on your smart phone.

[basiccomputersecurity]

Staying safe on Facebook

Be cautious about using Facebook apps. Many of these Facebook apps require access to your personal information. Do you really want to hand this information over to a complete stranger who might be an identity thief?  Before you install the app, Facebook will show you what information the app will have access to. Make sure you pay attention to this! Some apps will will also automatically send messages to your friends to try to get them to install the app too. If your going to install apps, stick with popular ones from large companies, like the app candy crush and pay attention to what the apps have access to!

If you've already installed apps and you want to remove them, on the left side of Facebook place your mouse to the right of where it says apps and click "more." This will bring up a list of apps you have installed. Click the pencil to the right of the app and click edit settings to see what information the app has access or click remove app. You can also remove the app by clicking the pencil and clicking remove app instead of edit settings.

Also, watch out for posts or messages that seem to be trying too hard get your attention. For example, "You won't believe what this person did watch this video to find out." When you click these, they usually try to get you to install an app which sends the same message to your friends, or they may try to get you to install a plug-in so you can watch the video. Don't take this risk because it might be a virus! If you think you might need a legitimate plug-in like adobe flash player, get it from adobe's site directly. If you downloaded a bad plug-in, check out my post about how to remove viruses.

[basiccomputersecurity]

Heart Bleed

A bug called Heart bleed was discovered yesterday that affects over two thirds of websites. This bug allows hackers to collect confidential information like passwords, usernames, or credit card numbers. Some sites like Yahoo and Tumblr were affected by this, but others like Google and Facebook appear not to be affected.

Here's some things you can do to protect yourself.

1. Don't use affected sites until they are fixed, and when they are change your password. Changing your password before the site is fixed won't help because a hacker could just get the new password. To check if a site is affected or has been fixed, you can use this site https://lastpass.com/heartbleed/. This site could not tell if a few sites I tried were vulnerable, so you can also search on  Google to check if specific sites have fixed the heart bleed vulnerability. Tumblr has been fixed, so you should change your password right now.

2. If you used the same password on others sites (which you should not do), you will need to change those too. Some people are also suggesting that you change your passwords on sites that are not effected because they may have been vulnerable in the past and hackers might have stolen the data.

3. Monitor your bank account for fraudulent charges in case your credit card number was stolen.

4. Use a password manager like LastPass or Keepass, so you don't have to use the same password on every site. This way hackers don't get access to all your accounts if one site is hacked. Here is my earlier post about passwords and how to use these password managers.

Edit: https://www.ssllabs.com/ssltest/ this site seems to work better for testing if sites are affected.

[basiccomputersecurity]

CryptoLocker

Most viruses are not that difficult to deal with. However, CryptoLocker is one virus that you do not want to get. The virus is usually sent as an email attachment that pretends to be a pdf file. It encrypts files on your computer like word documents, pictures, power point files, and excel spread sheets. It then demands you pay a ransom (about $100 or $300) to decrypt the files. The virus can be removed like any other virus, but your files can't be decrypted without paying the ransom.

If you find out you have the virus you should disconnect your computer from the internet by disconnecting the Lan cable or disconnecting from the wireless network. This stops more files from being encrypted. If you have a back up of your files, you can remove the virus and restore your files from that backup. Other wise you have to choose whether to pay the ransom or lose the files. You may also be able to recover the files from a shadow copy even if you don't have a backup. Newer versions of the virus try to delete these though. If you have cloud backup the encrypted files might be automatically uploaded to your backup. Most backup services include a way to restore an older version of the file, but it has to be manually done on each file.

To see if a file attachment is being disguised as a pdf, open my computer, press the alt button, then press tools and click folder options. In the box that opens, click the view tab. Uncheck the box that says "hide extensions for known file types." After that, look at the file name. If it ends in .exe or .pdf.exe, it is not really a pdf file even if it has a pdf icon. Exe files can have viruses. The fake pdf can also be sent in a .zip file. Make sure you check the files inside to see if they are being disguised.

Bleeping computer has a good article on how to deal with this virus including how to restore shadow copies and what the email looks like. Avoid opening attachments in suspicious emails and make sure you have a good backup.

[basiccomputersecurity]

Permanently removing data

Thinking about selling or giving away your computer? Or maybe you want to sell, give away, or dispose of a hard drive. First, you need to remove any personal or confidential information. Delete your personal files in folders like My Documents or anywhere else you stored files. Also, uninstall any programs that you enter personal information into. Create a new user account and delete the old one to remove information that is stored in your user account. Windows stores information from some programs here.

Just deleting the information isn't enough. The data stays on your hard drive until your computer needs to save something else to the same location. There are programs that can undelete these files. In order to permanently delete the data, you need to do a bit level overwrite. The free version of CCleaner allows you to do this. Select tools then drive wiper and select wipe free space only. Selecting 1 or 3 passes should be fine. 3 passes means that the data is overwritten 3 times. Check the boxes next to the drives you want to wipe. Finally, click wipe to permanently wipe the data that you deleted from your hard drive.

Another option, if you don't mind wiping everything on the hard drive, is to use DBAN. This is not as easy to do, but you'll know you didn't forget to remove something. You may want to have a friend that is good with computers help you because you will need to create a boot disc from an ISO file, change the bios settings to boot from a disc, and reinstall Windows. This article explains how to use DBAN. To burn an ISO file to a disc in Windows 7 or 8, just right click the file and click burn to disc. Make sure there is a blank disc in your cd/dvd drive. This article explains  how to reinstall every version of Windows.

[basiccomputersecurity]

Phishing

Phishing is when criminals pretend to be legitimate companies and try to steal your information like passwords or credit card numbers. They can do this by sending emails that look like emails from a well known company. They can even make the address of the sender say "[email protected]" even though that is not their email address! Here are some tips that can help you spot a phishing email.

The email contains bad grammar or spelling

The email makes threats. e.g. we will delete or lock your account if you don't click this link and enter your information.

The email tries to scare you into giving them information. e.g. Your account has be hacked and will be locked until you click a link and change your password.

Any email asking for you to click a link and enter your information is a huge red flag.

Links in the email that don't go to the webpage that the text says. e.g. the link might say ebay.com but when you hover your mouse over the link, the bottom left of the browser says ebay.notebay.com.The part before the .com shows what the site really is.

It's best to avoid clicking links in emails in addition to phishing they could also install malware on your computer. If you think there might be a legitimate issue, type the website into your web browser yourself to go to the website.

Here is an example that contains several of these warning signs.

[basiccomputersecurity]

Anti-Virus for Android

The smart phones of today are more similar to computers than older phones that could just text and call. One downside to this is that it is possible to get viruses on your android phone. But, you can get the free Malwarebytes Anti-Malware mobile on Google play or the amazon app store for android to protect yourself. This article shows how to set up and use Malwarebytes Anti-Malware mobile.

iPhone users don't have to worry about viruses, or at least not yet. Apple reviews apps that are added to the app store to make sure they are not malicious. So far, this has kept iPhones safe from viruses. Warning: If you jail break your iPhone, you are taking a risk. This modifies the phone so you can install apps that have not been approved by Apple. These apps might contain viruses.

[basiccomputersecurity]

Make sure your wifi is password protected!

Why should you password protect your wifi?

 Your internet will be slower if other people are downloading large files or watching videos. Also, most internet providers have a maximum amount of data you are allowed to download each month. This is usually so high that you don't have to worry about it, but you might have problems if someone decides to download ten seasons of a TV show using your wifi. Which brings me to my next point.

 If someone uses your wifi to do something illegal online, such as illegal downloads, child pornography, or threatening someone online like a politician, that can be traced back to you.  There have been a few rare cases where the SWAT team has raided an innocent person's house because of this.

 Any information sent and received from a web site that doesn't start with https can be seen by hackers that use your wifi. Also, if there is another vulnerability like the one mentioned my post about Apple's SSL vulnerability even information sent to https websites can be seen.

To password protect your wifi, you will need to log onto your wireless router and change some settings. Every router will be a little bit different, so if you have trouble with one of the steps, look up how to do it with your model of router.

1. First, you need to type 192.168.1.1 or 192.168.0.1 into your web browser. A box should pop up asking you for your user name and password. If this doesn't work, search for cmd or command prompt on your computer. After you have opened that, type ipconfig, press enter, and look for the line that says default gateway for the number you should typing into your browser.

2. For most routers the user name is admin and the password is admin, password or you just leave the password blank and click ok. If none of these work, look up what it is for your router.

3. Now you need to look for your wireless security settings. These are usually under something like wireless, security, or wireless security. If you can't find it, Google how to get to these settings with your model of router.

4. There are a few things you need to change. Select WPA2 (PSK or personal not enterprise). If your router doesn't have WPA2, select WPA. Don't select WEP because it is old and easily cracked. If your router allows you to choose between TKIP and AES, choose AES. Finally enter a password (could also be called a key or passphrase).

5. You should also enter a name (ssid) for your network. If you use the default name, hackers can figure out what router you are using and exploit any vulnerabilities that router has.

6. When your done with that click apply or save and your done!

[basiccomputersecurity]

Protect your password with a password manager.

Most people pick passwords that can be easily guessed. For example, many people use birth dates, names of their kids, or names of pets. Many people also choose passwords like "password" or "12345." Some people pick passwords that use a combination of dictionary words, names of real or fictional characters, and a few numbers. This seems like it would be hard to guess, but hackers write programs that can test billions of passwords a second using a list of dictionary words. This makes these passwords easy to crack. Also, passwords like IL0v3C00kieZ! or tbontbtitq (first letters of to be or not to be that is the question) are not good passwords anymore. As this article points out, hackers today are using more powerful computers and have written programs that test for common letter/number/symbol substitutions and famous quotes turned into letters.

Good passwords should have at least 12 characters, have uppercase and lowercase letters, and have numbers. They should not have dictionary words in them. Adding symbols will also increase the strength of the password.

Remembering complex passwords like this is difficult, especially because you should not write them down or or use the same password on every site. If you use the same password on multiple sites and a site is hacked, the hackers now have your password to multiple sites instead of just one.

The best way to keep your passwords safe today is to use a password manager. These will save your passwords in an encrypted database that can only be accessed with your master password. This way you only have to remember the master password for the password manager. These password managers will allow you to generate random passwords like /4=#wcNMBQf&^|aSlyKq that are very secure and save them so you don't have to remember them.

KeePass is a password manager that you can install on your computer. You can also download a portable version that you can put on a flash drive if you want to be able to use your passwords on other computers. Since KeePass stores you passwords in a file on your local computer (or flash drive) instead of online, it is harder for hackers to gain access to it. They would need both your password for KeePass and the file from your computer. If KeePass is open, you can press ctrl + alt + a to automatically enter the password. You have to save the url for the login page  and the username and password in KeePass for this to work. On some pages it doesn't work and you have to copy and paste the password. You can also backup the database file (has a .kdbx file extension) that stores your passwords with a cloud backup program to sync it between your devices and make sure you don't lose all your passwords.

LastPass is another popular password manager. It is more covenant to use because it can automatically fill passwords into the sites you visit instead of having open your password manager and copy and paste your password into the browser. LassPass also stores your passwords online in the cloud, so they are synced to all your devices. However, this convenience comes with a cost. Since your passwords are stored online, if someone gets your LastPass password they have all your passwords. For this reason if you use LastPass, I strongly recommend  you use one of their multifactor authentication options like Google authenticator. You can install Google authenticator on your smart phone and when you need to sign onto LastPass a code will be sent to your phone for you to type in with your password. This way you have to have something (Your phone) and know something (Your password) to gain access to your passwords.

[basiccomputersecurity]

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

I installed a Google Chrome extension with a 4.5 star rating and lots of users thinking it would be safe to use. I even checked the first page or two of reviews. However, when I installed it, the extension put malware, browser hijackers, and other programs I didn't want on my computer. When I saw a program I didn't install scanning the registry and telling me there were errors, I knew something was up, so I ran my anti-virus to remove the malware. I also ran a program called AdwCleaner to remove the browser hijackers and any adware the extension might have installed. Anti-virus programs usually don't remove these because they are less malicious. However, they should still be removed because they do annoying things like change your home page and search engine without your permission and prevent you from changing it back. They also display ads to earn the adware creators money.

I found out from the featured arstechnica.com article that malware creators have started buying popular high rated Chrome extensions and adding malware to them with an update (which chrome automatically installs). This means that you can't trust extensions or add-ons even if they have a high rating with lots of users anymore. Avoiding browser add -ons and extensions is good idea unless Google does something to make this more difficult for malware creators to do. Extensions made by large companies like Google should be safe.

[basiccomputersecurity]

XP support Ending April 8th!

Windows XP is 13 years old and on April 8th Microsoft will no longer support updates for this operating system.  Make sure you install all the updates that have already released. Click the start button then click all programs and click Windows Update. This will open a page in internet explorer. On this page click express to install the high priority updates. After it downloads and installs these updates, you will need to reboot your computer and do it again. Keep repeating this until it shows no new updates. The webpage also has a button to click to set up automatic updates. This will automatically download any updates that Microsoft releases before April 8th.

If the main computer you are using is running Windows XP, it might be a good idea to consider purchasing a new computer. XP computers will be vulnerable to any securities vulnerabilities that hackers and virus creators discover after April 8th of 2014.

[basiccomputersecurity]

Have a backup plan!

Eventually, hard drives fail, and when they do, you lose all the data on them. Viruses can also corrupt data or delete it. Natural disasters like fires, floods, tornadoes, etc can also destroy your data. The only way to keep you from losing data is to regularly back it up.

What should you backup? Anything that's important that you don't lose. You should backup your documents unless you don't mind retyping that ten page paper. Digital photos are important to backup because they can never be replaced. You'll also want to back up music and videos you have on your computer that you don't want to lose. Backup license keys for any programs you've bought, so you can reinstall them without having to buy them again. You can store these in a text/word file and back that up.

Backup Options:

1. Cloud backup

One of the easiest ways to backup is with a cloud backup program. When you install the program on your computer it will add a folder to your computer. Anything you put in that folder will automatically be backed up to the cloud. An advantage to cloud backup is you can access your files from any computer that is connected to the internet. Cloud backup will also protect your data even if a natural disaster like a fire destroys your home. One disadvantage is that they only give you a limited amount of space for free. If you want more space, you will have to pay a yearly or monthly payment. Here are some good cloud backup options.

Copy.com (By barracuda networks) gives you 15 GBs for free. Also, if someone who already has it invites you, both people get 5 extra GBs. If you follow this link you will get 5 extra GBs because I invited you. You have to install the program on your computer to get the extra 5GBs.

Google Drive gives you 15 GBs for free and also works well with Google docs (A free alternative to Microsoft Office).

OneDrive (Formerly skydrive) gives you 7 GBs for free.

2. External Hard drives or Flash drives

You can get a 1 TB (1024 GBs) hard drive for about $70. 128 GB Flash drives are also fairly common now if you don't need that much space and want to have something smaller than a hard drive. I've seen some good deals on 128 GB pin drives for around $40 or $50. Whenever you get new music, pictures, or videos copy them over to your hard drive or flash drive.

3. DVDs or CDs

You can also back up your files on discs. The disadvantage to this is that CDs only hold 700 MB and DVDs only  hold about 4.7 GB. Also, most of the time the data stored on DVDs or CDs can't be changed after its burned to the disc. If you have a lot of music or other data to backup this can make discs impractical. How do you remember what Music disk 3/15 has on it? However, discs are cheap and good for backing up pictures. You can burn all the pictures from last Christmas to one disc and label it Christmas 2013 for example.

4. A combination of the three.

If you don't want to pay for a lot of cloud storage space, a combination of the three may be best. You can store your documents and anything else that can fit on the cloud. For example, I only have 3 GB of pictures right now so I am backing them up on the cloud too. You can back music and videos up to a external hard drive. If you have a lot of photos you can back those up to discs or an external hard drive.

[simplecomputersecurity]

The 25 Worst Passwords of 2013

[basiccomputersecurity]

Don't use these common bad passwords! Apparently, Monkey is one of the most common passwords. I never would have guessed that.

[basiccomputersecurity]

How to remove viruses.

Most viruses are not that difficult to remove so don't panic. First, you need to know if you have a virus. Here are some signs that you might have a virus.

1. Your computer suddenly becomes much slower.

2. You notice programs or files on your computer that you didn't put there.

3. Your anti-virus program says you have a virus.

4. If you don't have an anti-virus program or it doesn't run regularly (Daily or weekly), it is also highly likely that you have a virus.

5. You computer doesn't boot to Windows but instead shows some screen. I've seen viruses that claim that the FBI is locking your computer and you need to pay to unlock it. Don't fall for scams like this.

Example virus scam:

Removing the Virus

Step 1. Run a full virus scan and when it is finished remove any viruses it finds. If you don't have an anti-virus program, you will need to download and install one. You may have to boot into safe mode if the virus prevents you from doing this. Press f8 repeatedly while your computer is turning on and select safe mode with networking.

Step 2. If that wasn't able to remove the virus, you will need to boot into safe mode to run the virus scan. Again press f8 repeatedly and select safe mode with the arrow keys in the menu that pops up and press enter. If you need to download an anti-virus or update your anti-virus, select safe mode with networking.

Step 3. If neither of those worked try another anti-virus program in safe mode, Malwarebytes is very good at detecting and removing viruses. I don't recommend running it as your main anti-virus though because the free version doesn't allow you to schedule updates or virus scans. The free version also does not have real time protection to block viruses before they attack your computer. However, the free version is great at removing viruses already on your computer.

Almost all viruses can be removed with the first 3 steps.

Step 4. If none of that has worked you can make a bootable anti-virus rescue CD/Flash Drive. Warning: You will have to change the boot order in your bios, so you may want to have a tech savvy friend help or consider taking it to a computer repair shop. If you decide to do it yourself, don't mess with any settings other than the boot settings because messing up the bios settings can mess up your computer! This page has the instructions to create a Kasperkey Rescue Disk on a USB flash drive and boot from it. I had to right click the rescue2usb and click run as administrator to get it to work.

Step 5. Google is also a good way to figure out how to remove viruses. If you can't remove a virus, see if someone else has figured out how to remove the virus. Check a few websites to make sure they aren't giving you bad advice.

Step 6. If none of the above has helped, then you have two options. Take it to a computer repair shop or reformat your computer and reinstall Windows. Reformatting will make you lose all your files and programs, so I hope you have a backup. You will need a Windows installation CD, DVD, or Flash Drive, and your windows license key (Usually on a sticker somewhere on your computer). If your computer came with a recovery disc, you can use that instead of the Windows disc. Here is a link that describes how to reinstall windows. You might want to have a friend that is good with computers help you with this if you don't feel comfortable doing it yourself.