Philippa Murray Philippa Murray

TechSpot
More Adventures with Computer Security
Steve Friedman (Vice President, COO, TECHSPA) - Main Street
Last month TechSpot covered some “adventures”
with insidious malware, techniques to keep safe from
infection, and if you are unfortunate enough to get hit
with it, some ways for it to be removed. Since then,
I’ve received so many calls and questions that I felt compelled to continue. In this
follow-up, I’d like to start by mentioning some additional security vulnerabilities
and exploits that are not secretly injected into your computer over the Internet.
Instead, telephone scam artists, trying to enlist your cooperation in compromising
your own security, attempt to breach your safety. I have personally experienced
these attempts. Just the other day, I got a call from Gord Savery (thanks Gord!)
reminding me about these calls. Here’s the scenario: someone calls claiming to be
from a well-known computer company, a software developer such as Microsoft, or
a security software company, like Symantec. They say they’ve noticed “dangerous
activity” or have “seen many errors” coming from your computer and they ask
you to allow them access to remotely “fix the problem.”
These characters actually have no knowledge of what’s on your computer, nor
do they have a connection to your computer, yet! They’re attempting to get you
to provide it for them. Once you let them in, if you’re gullible enough, they can
then have their way with your computer. Let’s get this straight! Unless you’ve
contracted with somebody to remotely maintain your computer, no one should
have access to see anything on your computer over the Internet. That’s what
firewalls are for. Most modern operating systems are set, by default, to block
incoming connections. Unless you really know what you’re doing, don’t change
these settings and open connections from outside.
Here’s another non-viral vulnerability. When your Wi-Fi router is installed,
most installers commit a very serious security error. The mistake is forgetting to
properly secure the router’s administration settings. Your wireless Wi-Fi network
access may have a secure password to prevent unauthorized wireless access
to your network, but access by a wired connection, as with an Ethernet cable
plugged directly into your router, doesn’t require a password. This administrator
configuration is critical, but often left installed with its factory settings. Since
the factory settings are widely available for tutorials on the Internet and easily
located, access to this most vulnerable part of your router is left wide open. With
wired, or an unprotected “guest access,” your administration configuration page
allows anyone to gain control or even reassign whatever passwords you’d created.
The most popular routers come from the factory set with Admin as the username
and Admin as the password (or some variation, like blank user name or
“password”). The instructions don’t make it nearly clear enough, how critical this
setting is. And the Quick-Start guides hardly ever mention it. It’s actually more
important than the password for your wireless connections since control of your
router configuration allows an administrator to establish a remote connection over
the Internet at any time.
Last but not least, one more horrible exploit I forgot to mention is a nasty, little
package that comes to you via the Internet. Once your computer is infected,
several separate programs start their work. All of a sudden, your computer is
hijacked and displays a message claiming to be none other than the RCMP,
notifying you that they have detected that you have downloaded illegally obtained
copyrighted material such as music or video, OR, downloaded child pornography,
or something else illegal to have on your computer.
This notice is obviously tailored to scare you into immediately paying a ransom
to free your computer. It directs you to pay a $100 fee through its window, by
credit card, in order to release your computer. Sadly, after submitting payment,
your money and identity are stolen while your computer is still locked from your
access. Multiple pieces of special anti-malware software is required to adequately
remove all the parts, which unless completely removed, will automatically
reinstall when you restart.
If you’re currently experiencing any of these threats, it’s time for attention and I’d
be glad to help.
If you would like to access my previous articles, please go to www.facebook.com/
techspa.inc/notes or http://themainstreet.org/previous-editions.html
If you have any questions regarding the topic of this article, please call TECHSPA
at 450 227-4118 or email info@techspa.ca.
May 2013
13