NWA-PCUG 08/2000 NewsLetter Article 18861 N. Hwy 112, Springdale, AR 72762-9303 Are You Safe from Attack? By Karl Rehak, LVPCUG From 02/2000 The Bytes of Las Vegas lf you watched NBC's Dateline on October 3, 1999, you received a healthy dose of the exposures we have around us every day. People who steal your identity, copy your checks, take your social security number and empty your savings accounts. What was surprising about the whole area is how easy it is to do all of this. The latest round of fast computers, cheap and high quality scanners and high quality ink jet printers not only open our world to new applications but also expose us at every level of our lives to incursions into our privacy and our finances. This has become a multi-billion dollar business, entry is easy, getting caught is unlikely and the penalties make the risks worthwhile. The top priority actions such as destroying unused checks, mailing checks at reasonably secure locations and not divulging private information about yourself are only the beginning. If you are reading this, you are likely to be a computer user interested in getting as much personal productivity as you can out of your computer system. Do you do on-line banking? Credit card reconciliation on-line? Make Internet purchases? Ever enter a credit card number over the Internet? If you answered yes to any of these questions, you need an answer to this question -- just how safe is it? The last part of the Dateline segment, summarized at: http://www.msnbc.com/news/318015.asp/, revealed an exposure to a virus which will permit hackers to capture your password and identification as you type! The segment quickly went through the piece with little fanfare or much in the way of detailed information. What was demonstrated was the latest in Trojan horse viruses announced earlier this year at the hacker convention, DefCon, in Las Vegas. The name of this Trojan horse virus is "Back Orifice," and like most viruses, it travels as an attachment to e- mail. When the offending attachment is opened, the virus is unleashed. The virus was distributed to conference attendees as a hacker tool kit, as such, hackers can use it to develop many similar Trojan horse viruses. This back door virus enables the perpetrator to have complete access to your computer -- look at everything, do anything. Stopping the Virus The easiest way to prevent virus infections is through the constant monitoring provided by a virus detection program. If any e-mail is received from strangers with attachments, just delete them. Keep the virus signature file current, check for new updates twice monthly. Make sure your virus scanning software is set to look at all files not just EXE files, viruses can travel as macros. Set your computer to scan all of your hard drives at least weekly, the Windows Task Scheduler can be set up to do that. Back up everything as a protective measure. Any type of program that is capable of executing instructions is capable of carrying a virus. You do all of that and now you are safe. How true is that? Not very. Your Computer's Open Door I have been following, with great interest, the observations of Steve Bass as he pursued this area. Steve is an editorial writer for PC World and president of the Pasadena IBM Users Group. Steve began to see just how exposed his computer was after installing his cable modem. Along the way Steve Gibson of Gibson Research and a couple of others took up the analysis. Their findings were alarming. Computer users are very exposed to incursions, particularly in conjunction with Trojan horse viruses like Back Orifice. In fact, tying their analysis back to the Dateline demonstration, it is possible for you to give up your identity through outside recording of your Internet financial activities without your knowledge. As pointed out in the Dateline segment, to date there have been no reported successful attacks directly on financial organizations by hackers. The use of secure web sites and firewalls offer protection. Where does tile security break down? Right inside your computer. From the time you depress a key on your keyboard until the keystroke is delivered to the encryption software, your keystroke is in the clear inside your computer's memory. This is an extremely short period of time -- microseconds. However, it can be read outside your computer by the type of Trojan horse just mentioned. What You Can Do There are some things that can be done to secure your computer. The first thing you want to do is perform some easy to use evaluations to see just how significantly you are exposed. Steve Gibson of Gibson Research in Laguna Beach, Ca. has an on-line evaluation. Steve is the creator of SpinRite, the data in-place hard drive formatting program. He also has contributed extensively to the analysis of the Iomega "Click of Death" problem. To perform the analysis go to http://www.grc.com/default.htm then click the "ShieldsUP!" icon on the home page. A second self administered security test is available on the net. The above referenced Dateline summary article has links to the test, which is located at: https://dateline.epatrol.com/. Tile test is provided by Internet Security Systems. Both tests offer an analysis of your computer's vulnerability with no invasion exposure to your computer. Both are remarkable offerings and should be used anytime hardware or software changes are made. Prepare yourself for a real shock. Quite coincidentally with all of this work, the October 4 issue of Network World did an analysis of Intrusion Detection software. Their analysis included four products. The prices for the products ranged from under forty dollars to over nineteen thousand dollars. The conclusion was that a product called BlackICE Defender scored the highest of the group. It received a 9.3 out of possible 10 in the analysis. It was also pointed out by Steve Bass to be his choice of defense. The price - $39.95. The manufacturer, Network ICE. at http://www.networkice.com I purchased the product on-line and installed it in less than 30 minutes. No restart was necessary. I then revisited Steve Gibson's web site and received information that, other than getting my physical Internet address, the analysis program could not get at any other information on my computer. Additionally, the BlackICE program offers a benefit to anyone who gets an intrusion alarm. That is the ability to trace back through the network and identify the intruder! The program also prevents intrusions through programs like Symantec's pcAnywhere for those who leave that program resident for remote use. Conclusion In the on-going war of hacker vs. users, it appears that there are worth while products to prevent the loss of critical personal and financial data. All Internet users need to understand the issues and implement their own line of defense. Your identity and your money are at stake.