CompuBlab

If you’ve read the news at all lately, you are no doubt aware that computing hackers and “malware” (software that does malicious things to your computer or your data) is very much on the rise. As such, I thought I would comment on a computer setup technique that is very simple to implement, yet stops a large number of malicious software programs before they even get started.

This technique involves setting up a “non-administrator” login account. This technique is especially important to users of Microsoft’s Windows XP operating system…but it applies to ANY operating system.

Whenever you access a modern operating system (such as Windows, Max OS, Linux, etc.), you typically have to “log in” to the system using a user name and password. While some operating systems can make it look like you are bypassing this step (such as some configurations of Windows XP), the fact is that you really are NOT bypassing the log in phase. What is occurring is that the operating system is logging you in “automatically” to a specific “default” login account.

Login accounts serve many purposes, one of which is to be able to assign permissions to the user of that account. Permissions are used to limit what actions a given user is capable of performing. For example, you would NOT want just any old user of your computer to be able to format the main hard disk, causing you to lose all of the data on that drive. Some people might format the disk maliciously…others might do it accidentally. To prevent this, only highly trusted users have their login accounts granted the permission to perform such a potentially dangerous action.

The thing that is important to note here is that some operating systems (Windows XP was one of them) used to set up your log in account for you during installation…and always set up the account as an Administrator (an administrator account is one that typically is allowed to do ANYTHING on the system). When it comes to malware…running in an Administrator account is a death sentence!

You see, malicious software typically needs to install itself somehow onto your computer in such a way that it will be activated each and every time your computer is turned on. To do this, it needs access to parts of the system that non-administrator logins usually are not allowed to access. Since malware first runs under the account that is logged in at the time if first arrives on your computer, if you are logged in as an administrator, the malware has no trouble at all installing itself into the deep recesses of your computer. However, if after you set your computer up you were to create a “non-administrator” login account…and if you always used THAT account for your every day activities, then malware would have a MUCH harder time trying to install itself into the operating system.

Now, there are some really “hard-core” malware programs out there that can take advantage of flaws in your operating system or other related software and install themselves even from a non-administrator login account. However, by using this one setup technique, you eliminate a LARGE precentage of the malware floating around on the internet from being able to trouble you.

Since each operating system has its own method for setting up login accounts, I can’t give you a step-by-step description on how to do that. You will need to read the manual (always a measure of last resort!) or else get assistance from a computer savvy friend or family member that you trust.

If you already have a non-administrator account that you use on your computer for every day tasks, then good for you! If not, make it a goal this week to set up (or have set up on your behalf) a non-administrator account and then USE THAT ACCOUNT for your day-to-day activities. The headache you avoid may just be your own!

We all have heard about the dangers of identity theft. There have even been some clever commercials about it on the television. But when the “bad guys” get a hold of enough information to impersonate you to the point where they can establish credit in your name, you are in for a world of hurt. The amount of time and effort that you must spend to clean things up, not to mention the damage to your reputation and the pain of clearing your credit rating, can be enough to give you a major migraine headache.

But did you know that those who are listing their birthdates on social networking sites (or any other site for that matter) are taking a risk with their identity?

The information that an identity thief needs to steal your identity is:

1. Your name
2. Your Birthdate
3. Your Social Security Number

The name is pretty much a given. It can be taken from lots of places. The social security number is something most of us by now have heard that we need to protect with great vigor. But what about your birthdate?

Well, beyond the fact that it is one of the three pieces of information that an identity thief needs to steal your identity, it was reported two years ago that it is possible to “guess” your social security number with a surprisingly high degree of accuracy given only your birthdate, the state of your birth, and publicly available data.

Research at Carnagie Mellon University in 2009 ( Click here for SSN Prediction Article) showed that by using your name, birthdate, state of birth, and publicly available data, they could predict the first 5 digits of your social security number with 60% accuracy in only two tries! And with less than 1,000 attempts, 8.5 percent of people’s complete social security number could be accurately guessed.

Of course you may be saying, “so if it takes 1,000 attempts to get my SSN correct, what have I to worry about?” Well, it turns out plenty. You see, the “bad guys” can create programs to query credit card systems to apply for a credit card. They can try different combinations of name, social security number, etc. over and over again until they get the right one. Thus, needing only 1,000 tries is not that big of a deal to them.

Now also keep in mind that this research was performed TWO YEARS AGO! I have no doubt that statistical methods, as well as the data contained in online public databases has only increased the accuracy of such predictions.

Now consider the millions of people who use social networking tools such as facebook who proudly post personal information such as their home state, their birthdate, etc., and you begin to see the potential for abuse of this information. An additional problem with birthdates is that there are so manly public databases that contain this information that the persistent “bad guy” could probably find your birthdate without much trouble. But why would you want to make it easy for them?

With regards to social networking sites, there are a growing number of people who now give false birthdates so as not to divulge that information so publicly. However, whether or not you want to make it easy on the “bad guys” by posting it on your facebook profile is up to you. The purpose of this post is to simply make you aware of the potential danger, however slight you may feel that it is, so that you can make an informed decision.

Until next time…think before you post!

If you are a user of an online storage facility like DropBox or one of the many others, have you considered the security ramifications of what you are doing?

Today, computing “in the cloud” is a big buzzword (that should probably be “buzzphrase”). Cloud computing, in its simplest form, is just a fancy way of saying that your computing resources are coming from someone else. Online storage and backup services have been around for a while, and I have been amazed at how people have not understood all of the impact of storing data online.

Perhaps the most important thing I want to make certain you consider is exactly WHAT information are you putting on someone else’s servers. Is it just pictures, or school projects, or other items not of great importance to anyone but you? Then you are fine. But what if you are storing files related to your banking, or tax returns, or other sensitive information? Here you might want to give pause for storing such information “in the cloud.”

You see, no matter what these companies tell you, computer security is still in its infancy. These companies may tout that they use “encryption” methods (that is, they “scramble” your data in such a way that hopefully only THEY can recover the original data at a later time) to hide your data…but what they don’t tell you is that encryption is not “fool-proof” protection. In addition, when you put your data on someone else’s servers, you have to also hope that the company who is hosting your data screens its employees very carefully. Encryption doesn’t mean diddly if the company’s employees are not properly screened and are given access to both your data and the encryption algorithms used to protect it.

I am not saying that online storage is not to be trusted…I am saying that you need to be made aware of the risks of putting your data online. If you choose to put your data online and you have an understanding of the risks and accept them, then this is a good thing.

KNOWLEDGE is your best weapon against bad outcomes with computing…and knowledge is what I hope to impart to you. Do not assume, just because your data is encrypted that it cannot be read. It makes it more difficult to be read, but there are ways of breaking encryption. If you need proof of this, just follow the tech news for a few weeks and you’ll see how many security violations are being reported in the news on a weekly basis. Encryption is good…but by itself it is not, in my opinion, sufficient to protect your data.

The best security for data is to not have the data accessible to those who might try to gain access to it. Tax return information stored on a CD in your home is much harder for a hacker in another country to gain access to than data you have uploaded to an online storage facility.

Don’t get me wrong…I am not saying “never use online storage”…I am only saying be very aware of WHAT you are storing there…and know the risks. Life is not without risks. The important thing is that we identify the risks and choose for ourselves what risks are worth taking and what risks we choose to avoid.

Knowledge is the key, my friends, and that knowledge will set you free!