The Dark Side of the Internet
- Spam
- Malware
- Viruses, et al.
- Spyware / Adware
- Phishing
- Cracking
- Network Service Attacks
- Privacy
Spam - is unsolicited,
bulk e-mail. There are several types:
- Just plain text, or
links to vendors
- Misleading links
- Link text
indicates one web site, actual link
points elsewhere
- Phishing
- Link leads to
malware
- Toxic attachments
- Executable files
that install malware
- Application files
containing scripts
MS
Word "macros", other application macros
Phishing - scams to obtain personal info
- No real bank or vendor asks you to "verify
your information"
- Tip-offs:
- Misspelled words, poor
grammar
- Link text != link target
- Phishing Examples
Privacy - Do you know where your info is?
- Who has it?
- Financial
institutions
- Merchants
- Schools
- Medical providers
- Credit bureaus
- Governments
- Are they secure?
- Identity theft
- Credit cards
- Social Security
number
- Personal info used
to verify your identity
Birth date
Family names
Zip
code???
- Definitions - the lines are blurred...
- Viruses - get carried in on removable media, make
copies of themselves
on other disks
- Worms - send themselves over the network, e.g. via
e-mail, vulnerable
network services
- Trojans - hide in "useful" software, provide a
backdoor for others to
use your machine
- How to get infected:
- Application scripts ("macros")
- Browser scripts
- Vulnerable network services
- Lax security settings
- What malware
might do
- Send spam - with your name on it
- Send itself to
other computers
- Take part in
denial-of-service attacks
- Place expensive
phone calls - e.g.
to 1(900)
- Visit web sites - e.g. to get paid for visits
- Send info about
you to someone else
- Install itself all
over your disks
- Damage your files
- Interfere with
your computer use
- Use your computer
- Safety measures
- Install a
virus checker - keep it up to
date!!!
- Make a "rescue
disk" - have a CD you can
boot from
- Back up your
files!
- Write-lock
diskettes that you're only going to read from
- Use Mozilla in
place of Internet Explorer
IE runs scripts,
starts applications without being asked
- Don't let your
email program open attachments
Not even if you
know the sender...
Save the file to disk & let your virus checker scan it
- Change your
file settings to show the extension
Executable
attachments hide their type, e.g. xxx.txt.exe
Cracking - Gaining
illicit access to computers.
- How do they get in?
- Vulnerable network
services
Unnecessary services
left turned on
Port scan
- Trojans
Installs an account on
your machine
Opens up a network
service
- Password
stealing, guessing
Better to write your
password down than pick something easy to guess!
Beware the over-the-shoulder password snatch...
- OS or application
bug exploitation
This
is what all those security patches are for...
Network and Service attacks
- Network
denial-of-service attacks
- Attacks on the power
grid
- Collects information
about you, or your computer and network use, sends it to...?
- Web usage loggers
- Screen recorders
- Keystroke loggers
- Chat and email
recorders
- Application use
monitoring
- May include "active"
malware - see
section on viruses, etc.
- Non-info-gathering
damage typically associated
with spyware:
- Home page replacement
- Browser hijacking
- sneaking in visits
to other sites
- Reinstalls
itself if you try to get rid of it
- Adware
- Places ads
in application windows,
browser, desktop, popups...
- Gathers info
about your browsing,
maybe about application use
- Selects
"targeted" ads based on that
info
- Triggers ad
display based on your
activity
- Did you
"invite" it in? The infamous "end
user license agreement"
- Surest sign
of adware is the word "free"
(There are exceptions --
altruistic freeware, often open-source. E.g. Linux, Mozilla, and
Apache (a widely-used Web server) are all open-source freeware.)
- Spyware
- Monitoring for
other purposes besides ad targeting
- Usually unknown to
the user
- Where it comes from:
- "Free" software
- File-sharing
services
- Viruses or worms
- Unscrupulous
adware
- Employee monitoring
- Uses commercial
spyware tools
- Reports email and web
browsing
- Overt, "benign" (??),
information gathering tools
- Safety measures
- See virus safety
measures
- Get a spyware
removal program - keep
it up to date
- Don't click on any buttons or links inside ads or
popups!
No, not
even "Close window"
No, not if it offers to remove spyware
Use the window frame's close button
Beware ads embedded in web pages or application windows
- Do a search
for the name of the
widget you're considering, along with the words "adware" and "spyware"
- "TANSTAAFL" -
Robert Heinlein
Beware
"free" goodies - what's their motive? do you need it?
Except...reputable
free / open source software
- Spyware Examples
Additional Resources - web sites
with useful and/or interesting info
- Spam
- Scams
-
Chain letters and
hoaxes
- Malware:
Viruses, Worms, Trojans
- Malware:
Spyware and
adware
- Cracking
- Privacy,
phishing,
identity theft
- Can we have safety and freedom?