Microsoft Windows Security Inside Out for Windows XP and Windows 2000 by Ed Bott, Carl Siechert

From Barnes & Noble

The Barnes & Noble Review
Once, Windows security was like the weather: everyone talked about it, but nobody did anything. Those days are gone. Driven by Bill Gates himself, new initiatives like Microsoft’s “Palladium” threaten to make your PC almost frighteningly secure. Meanwhile, Windows XP and Windows 2000, while imperfect, are far more secure than their predecessors. Most important, there’s now quite a bit you can do to tighten up the security of your own Windows-based systems.

If anything, the problem is too much information, scattered everywhere. Thankfully, Ed Bott and Carl Siechert have brought all the essential techniques, guidance, facts, and resources together in one book: Microsoft Windows Security Inside Out for Windows XP and Windows 2000.

Bott and Siechert coauthored the outstanding Microsoft Windows XP Inside Out, arguably the definitive XP guide for experienced computer users. This 800-page follow-up brings the same thoroughness and insight to Windows security. It’s a single source for information on everything from viruses to VPNs, firewalls to file encryption.

The authors begin by reviewing the seven most pervasive threats to your computer’s security, offering checklists for responding to them, and describing a high-level process for generally improving security on your PCs and network. If you’re in a high-traffic area, are you using a password-protected screen saver? (And is your PC locked to anything, or can someone simply walk off with it?)

Next, they focus on core Windows XP’s and Windows 2000’s features, including password-protected user accounts (more complex and subtle than you might imagine); logon and authentication services; and permissions (after all these years, it’s time to convert to NTFS).

Speaking of passwords, you’ve already been told to choose hard-to-guess passwords (and not sticky-tag them to your monitor), but are you choosing different passwords for each use? Wouldn’t want the scoundrel who steals your multiplayer game password to gain access to your bank account, would you? (Yes, managing multiple passwords is maddening, but the authors suggest software which makes it easier.)

This chapter ends with a detailed checklist of security tweaks for every Windows user, including some “advanced” options worth considering. (For instance, restricting executable file attachments in email. If you use Outlook 2002, you’ve got no choice. Surprisingly, however, Outlook Express's option for blocking dangerous attachments is switched off by default).

You’ll learn how to use Windows Update (and you’ll also learn where to find security fixes that haven’t or won’t show up in Windows Update, such as fixes to SQL Server and the Microsoft Data Engine). You’ll also discover tools like the Microsoft Network Security Hotfix Checker (Hfnetchk.exe), a speedy way to check all your computers for hotfixes and service packs.

There’s also extensive coverage of encryption, in all contexts: getting a personal certificate you can use to keep your email from being read or tampered with; plus a full chapter on encrypting files or entire folders.

Possibly you don’t want to broadcast unsecured data to your entire neighborhood. If you’ve got one of those cool new 802.11 wireless networks, you might be doing just that. Bott and Siechert walk you step-by-step through securing your wireless network against “war drivers” and whoever else is in the neighborhood.

As wireless networks prove, security and privacy issues overlap -- and this book offers extensive guidance on protecting your privacy. For instance, there’s a full chapter of strategies on reducing the spam filling your emailbox; and detailed coverage of clearing away the evidence of sites you’ve visited: “more difficult than it appears, because traces of your movements are scattered all over your hard drive...[and] even reformatting your hard disk might not be enough to eliminate all evidence...”

The accompanying CD-ROM contains the entire book in electronic format, as well as an up-to-date collection of scripts, security tools, and third-party utilities, many of which are covered in detail in the book. Use these tools, follow these directions, and sleep at night. Bill Camarda

Bill Camarda is a consultant, writer, and web/multimedia content developer. His 15 books include Special Edition Using Word 2000 and Upgrading & Fixing Networks For Dummies®, Second Edition.

From the Publisher

Hey, you know your way around a desktop-so now dig into the Windows operating system and really put its security features to work! Covering Windows XP Professional, Windows XP Home Edition, and Windows 2000 Professional, this supremely organized reference packs hundreds of timesaving solutions, checklists, troubleshooting tips, and workarounds-all in concise, fast-answers format. Learn the essential tools and techniques for tightening up security on your personal computer or network, including ways to fend off viruses, hackers, spam, denial-of-service attacks, and other threats. Discover how to button up your Virtual Private Networks (VPNs), remote access, and wireless networking services. And take ultimate control of security with advanced solutions such as file encryption, port blocking, Internet Protocol Security, group policies, and tamper-proofing the Registry.

Product Details

• Table of Contents
• Read a Sample Chapter

Table of Contents

Read a Sample Chapter

Every year, personal computers become more powerful, more complex, more connected…and more vulnerable.

In 1995, when the Internet was still in its infancy, a leading computer security clearinghouse, the CERT Coordination Center, reported the discovery of 171 vulnerabilities that thieves and vandals could exploit to attack widely used operating systems and applications. In 2000, the number of newly discovered vulnerabilities jumped to 1,090; and in 2001, the total skyrocketed to more than 2,500, with 37 of those flaws considered serious enough to warrant formal security alerts. Security experts predict that the number of new vulnerabilities in computer operating systems and networks will continue to increase.

Those alerts are aimed at users of many operating systems and hardware platforms, of course, not only at those of us who run Microsoft Windows. But the world’s most popular operating system makes a tempting target. Destructive, fast-spreading viruses and newly discovered bugs in the Windows operating system make for juicy headlines. And for every security threat that makes the nightly news, a hundred more might be reported only on Web sites and mailing lists aimed at security professionals. Make no mistake about it: What you don’t know can hurt you.

As personal computers weave themselves ever more tightly into the social and economic fabric of our lives, the potential for damage from viruses, malicious Web sites, cybervandals, and online thieves increases. A successful attacker can vaporize data files and wipe out installed programs on your computer, drain funds from your online bank and brokerage accounts, ruin your credit, send forged e-mail messages that appear to come from your address, and hijack your Internet connection for use in attacks on other computers and networks. Viruses and worms can scramble data and render entire networks unusable for days.

The cost to clean up after a major outbreak of a new virus or worm can be staggering. In two weeks during the summer of 2001, the Code Red worm infected hundreds of thousands of computers. Computer Economics, an Internet research firm, estimated that the direct costs of removing the worm, applying software updates to patch the security vulnerability, and returning these systems to normal service reached $1 billion, with another $1.4 billion in lost productivity indirectly attributable to the worm during that same period. Even if you’re responsible for only a single computer, the costs can be significant. Imagine how much you would lose if the computer that runs your business were rendered unusable for several days or a week and all your saved files were destroyed.

Fortunately, you don’t need a degree in computer science to protect your computer. We wrote this book with the specific intent of helping ordinary Windows users break through the haze of misinformation, myth, and technobabble that defines most of the currently available information about Windows security. If you want to take control of your personal computer and protect yourself from online threats, you’ve come to the right place. Our focus is on vulnerabilities and threats that affect anyone running Windows XP (Home Edition or Professional) or Windows 2000 Professional. We’ll explain how each vulnerability works, how it can affect you, and how you can close the security hole.

NOTE:
As the title suggests, this book focuses on Windows XP (Home Edition and Professional) and Windows 2000 Professional. If you’re using Windows 95, Windows 98, or Windows Me, some of the information in this book will be relevant to you, but most of our recommendations rely on features found only in Windows XP and its predecessor, Windows 2000. Both of these operating systems were designed from the ground up with security in mind; features such as the NTFS file system, built-in encryption, and support for multiple users are essential building blocks of a comprehensive computer security program. If you’re serious about protecting your personal computer and you’re still running an older version of Windows, we’ve got one word of advice: Upgrade.

In this chapter, we examine the most common threats to your computer’s security and list the basic steps you need to take as part of a comprehensive security program. In Chapter 2, we describe the arsenal of security tools and technologies built into Windows 2000 and Windows XP and explain how you can put them to best use. In the remainder of the book, we explore each type of threat in detail, providing in-depth technical information, expert tips, additional resources, and checklists you can use to stop even the most determined intruder.

Balancing Safety and Convenience

Let’s start with a simple, inescapable truth: There is no such thing as a perfectly secure personal computer, just as there is no such thing as a perfectly secure house.

Keeping your personal data and your Internet connection safe from hostile software and unwelcome visitors is, by definition, a balancing act. Some of the features available in Windows that ease your online life can inadvertently expose confidential information to an untrusted stranger. For instance, a feature in Microsoft Internet Explorer called AutoComplete allows you to save logon names and passwords associated with Web sites so that you can access your data with a single click instead of having to remember your password and enter it each time. But that time-saving trick works equally well for any person who sits down at your computer. In a matter of minutes, anyone with physical access to your computer can poke around in your banking records, record sensitive information, and even transfer funds.

To protect yourself, you can disable features of the operating system and its components that pose unnecessary risks to your security. You can increase the complexity of the passwords you use to access your computer and online accounts. You can also add third-party security software and hardware devices to make life more difficult for intruders. Unfortunately, each additional layer of security also makes performing even simple computing tasks more difficult for you. (For a much more detailed discussion of these fundamental security concepts, see "The Ten Immutable Laws of Security," reprinted in Appendix A, page 699.)

How do you find the right balance between security and convenience? The role of the computer and the value of the data stored there determine the level of security that’s appropriate. If you’re an analyst for the Central Intelligence Agency or an auditor for a multinational bank, you need world-class security, and you should be prepared to pay a steep price for that level of protection. On the other hand, if you have a home computer located in your den, accessible only to members of your family, you can tip the scales in favor of convenience.

Before you can decide how to protect yourself, however, you need to understand the different types of threats that confront every computer user, every day.

Know Your Enemy: Seven Threats to Your Computer’s Security

If you pay attention only to the mainstream media, you might think that credit card thieves and occasional outbreaks of e-mail–borne viruses are the only serious threats to your computer and its data. Nothing could be further from the truth. Attacks can come from just about anywhere, including your own office. According to a 2002 study by the Computer Security Institute and the San Francisco office of the FBI, 38 percent of the businesses surveyed experienced unauthorized access to their systems and data by insiders—disgruntled current or former employees. And some of the most serious attacks on the global Internet in recent years have come as a result of "Trojan horse" programs planted on Windows computers by technically unsophisticated amateur attackers.

In this section, we list seven common categories of threats you’re likely to encounter.

Threat #1: Physical Attacks

The most basic breach of your computer’s security doesn’t require the attacker to have any technical skill at all. If you leave a notebook computer unattended for even a few seconds in a busy airport or train station, a thief can pick it up and carry it away, along with all your personal data and access to any passwords stored there. Stealing a desktop computer is logistically more challenging, but the resulting loss can be equally disastrous. And don’t assume that a complex, hard-to-guess password or even well-encrypted files will protect you. If a technically savvy crook can cart away your computer, he (the overwhelming majority of malicious hackers and high-tech thieves are male) can work on it for days or weeks; given enough time, bad guys can break into any computer, no matter how well it’s protected.

As bad as that sounds, some physical attacks on your computer can be even more devastating. Consider the consequences, for instance, if you leave your office door unlocked and your computer on and unlocked while you go to lunch or a meeting. A brief absence is long enough for an intruder to sneak into your office, sit down at the keyboard, and copy data files to a floppy disk or upload them to another computer over the Internet. A malicious intruder could sabotage your work by altering numbers in a spreadsheet or changing the wording of a contract or letter. A really determined spy could even install surveillance software that runs in the background on your computer, sending the information to a remote computer.

Figure 1-1, for instance, shows the remote console of an infamous remote control program called Back Orifice. The server program is small enough to fit on a floppy disk, installs in a few seconds, and is nearly undetectable when running on the victim’s computer. Using the remote console, an attacker can take full control of the victim’s computer—transferring files and folders, modifying the Windows registry, and (using the controls shown here) recording details of every keystroke—including passwords, credit card numbers, confidential memos, online chat sessions, and love letters.

Figure 1-1.  An attacker who gets physical access to your computer for even a few minutes can install surveillance software and literally take control of your computer from a remote location. (Image unavailable)

For more details about how you can detect and remove Trojan horses and other remote control software, see "Repairing an Infected System," page 328. Physical Security: A Checklist:
As the experts at the Microsoft Security Response Center note, "If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore." That’s why, as part of a comprehensive computer security plan, your absolute first line of defense is to make sure that your computer is physically protected. Follow these guidelines:

• Keep any computer containing sensitive information behind a locked door. Cubicles make it too easy for intruders to attempt a break-in.

• In high-traffic areas, use external locks to physically bolt a computer to a desk. This extra level of protection won’t stop a determined professional thief, but it will prevent crimes of opportunity.

• Take extra precautions to protect portable computers and handheld devices, especially when they contain sensitive information. Consider using a radio-controlled alarm such as those available from TrackIT Corporation; it sounds an alert if you and your notebook carrying case are unexpectedly separated.

• At work, make a habit of logging out or locking the computer every time you leave your desk. Casual snoops can learn a lot just by looking at the names of files and folders, without even touching your keyboard. Don’t make their job easy.

• Watch out for "shoulder surfers" who try to steal passwords by watching your fingers as you log on. Arrange your work space so that your keyboard is not in plain view.

• Use a password-protected screen saver. Set your screen saver to kick in after a short period of inactivity—no more than 10 minutes—and choose the option to display a password prompt when resuming.

• Convert FAT32 disks to NTFS format to prevent snoops from booting with a floppy disk and accessing data files without having to log on. (For details on making this conversion, see "Use NTFS for All Drives," page 52.)

• If your computer contains ultrasensitive data, consider using the encrypting file system (for details, read Chapter 18, "Encrypting Files and Folders"), and add a hardware-based logon device such as a smart card or a biometric identification system.

Do some of these precautions sound extreme? They’re not. In fact, most of this advice is common sense. You wouldn’t think of leaving your front door unlocked when you go to bed at night. Why then would you want to leave your personal computer unlocked, especially when you know that would-be intruders are constantly on the prowl, rattling virtual doorknobs in search of unsecured computers? CAUTION:
Encrypting data is a superb way to lock out thieves, as long as you’re also diligent about setting strong passwords and logging off when you’re not using your computer. Just make sure to keep a backup copy of the encryption key! If anything happens to the hard disk containing your Windows system files, you must be able to replace the encryption key. Without it, you’re permanently locked out from all your encrypted files, even if you’re able to restore them from a backup copy. Before you even think about using the encrypting file system built into Windows XP Professional and Windows 2000, read Chapter 18, "Encrypting Files and Folders."

Threat #2: Pilfered Passwords

On the overwhelming majority of computers and secure Web sites, entering a password is the only way to establish that you are who you say you are. If someone else borrows, steals, or guesses your password, that person has complete access to all your files and network resources. By logging on with your password, a malicious intruder can read your e-mail, poke around in your sensitive files, access protected network resources such as corporate databases, and perform all sorts of mischief, leaving you to clean up the mess.

Surprisingly, the newest and most secure version of Windows, Windows XP, actually encourages sloppy password habits. When you install Windows XP (Home Edition or Professional) on a computer that’s not connected to a Windows domain, the Setup program creates new user accounts with blank passwords and full administrative rights—hardly a secure configuration (although, in the system’s defense, its default settings disable any access to shared files from across the network until you create a password). When you run the Network Setup Wizard and enable file sharing, Windows XP encourages each user to create a password and add a hint, like the one shown in Figure 1-2. The hint makes it easy to remember your password later; unfortunately, it also makes things easier for anyone trying to guess your password.

Figure 1-2.  Avoid using hints like the one shown here, which weaken the security of your logon password. (Image unavailable)

Strong, effective passwords are at least eight characters long and contain a random mix of uppercase and lowercase letters, numbers, and punctuation marks. Sad to say, most people do a lousy job of picking passwords and personal identification numbers, using easy-to-remember and easy-to-guess combinations of numbers and letters, such as birthdates or the names of children or pets. Worse still, most people reuse the same password at every opportunity, which means that an intruder who steals the password for your favorite online bookstore might also be able to access your bank account, log on to your computer, and read or send messages using your e-mail account.

Using a strong password increases your online security dramatically. Figure 1-3 shows Windows XP Home Edition running a password-cracking utility called Advanced NT Security Explorer, from ElcomSoft. (For more details about how password-cracking utilities work, see "Recovering a Lost Password," page 95.) On this computer, the account for the user George is protected by a simple password: ROVER. Cracking that code is child’s play for this utility, which took exactly two seconds to try every entry in its 100,000-word dictionary and successfully unscramble the saved password. After George changed the password to a randomly selected sequence of eight letters and numbers, spi2RuLa, the password-cracking utility had to work more than 20,000 times as hard to crack the password, spending roughly 12 hours in "brute force" mode, crunching through every conceivable combination of letters and numbers.

Figure 1-3.  This password-cracking utility was able to guess George’s password in two seconds. A longer password made up of randomly selected letters and numbers is more secure. (Image unavailable)

Of course, even the strongest password offers scant protection if it’s written on a sticky note tacked to the side of a monitor or stuffed in the top desk drawer. Enterprising thieves also use "social engineering" to trick a gullible computer user into giving up passwords to a complete stranger over the phone or via e-mail. A con artist using social-engineering techniques might pretend to be a technical support specialist diagnosing trouble with your computer. By interspersing details about your company, its network, and your applications, the would-be thief tries to lull the victim into a false sense of security. ("Mr. Bott? Yes, this is Carl in the network operations center. We’ve been trying to track down a problem on the 16th floor Ethernet run and wonder whether you can help us. We think there are some problems in the fiber runs between your wing and the server room. Do you have a minute to help me do some testing so I can figure out what’s going on?") Although the technique fails more often than it succeeds, it’s still surprisingly effective. Even seasoned computer support professionals sometimes fall for social-engineering scams, in which an outside caller pretends to be a user experiencing password problems. ("Can you reset my password, please? I’ve forgotten it.") On corporate networks, where individual users have access to a broad range of resources, the results can be devastating.

For technical details on how Windows saves passwords and how you can increase the security of password-protected resources, see "Using Passwords Effectively," page 87.

Threat #3: Nosy Network Neighbors

Do you trust the person in the next cubicle? Misplaced trust and misconfigured systems can lead to security headaches on computer networks of any size. Networks promote collaboration by allowing users to share files, folders, and other resources in real time. Used effectively, networks can have a dramatic positive effect on productivity. Used carelessly, however, networks can contribute to security problems. The most common weaknesses occur when users don’t pay sufficiently close attention while sharing resources and setting up user accounts.

The three most common security problems on networks are the following:

• Sharing files that should remain confidential. Users can inadvertently create this problem by sharing a folder filled with several subfolders, some of which contain data files that should remain confidential. Simple carelessness can also cause data to be compromised, as when a user copies sensitive files to a removable disk or to a local workstation or a portable computer that isn’t properly secured. Creating policies that define what types of local files can be shared or copied and training users in proper techniques for managing confidential data are essential steps in avoiding this problem.

• Allowing unrestricted access to shared files. Some types of information need to be shared with a small, tightly restricted group of network users. A Microsoft Excel workbook containing your company’s budget and salary details, for instance, might need to be shared among a group of senior executives. If share permissions are too broad, unauthorized users might inadvertently be able to access these files. This is a particular problem on peer-to-peer networks running Windows XP, in which the default Simple File Sharing configuration allows all network users to access shared resources.

  For more details about your alternatives when setting up shared access to sensitive files, see "Restricting Network Access to Files and Folders," page 486.

• Allowing users to change files without permission. Many collaborative environments depend on a team of workers being able to share information. Sensible management policies often dictate that only one or two team members have responsibility for making changes to files. What happens if a network share is set up incorrectly, so that everyone who has access to files in a particular folder also has the capability to edit, replace, or delete those files? In that scenario, a single distracted user can wipe out a frightful amount of work by accidentally saving a new file using the same name as an existing file or by deleting a group of files in a misguided cleanup effort. Good backups can undo some of the damage (a topic we cover in depth in Chapter 6, "Preventing Data Loss"), but configuring the shared resources correctly can prevent the problem from occurring in the first place.

InsideOut:
For extra security, add a server

If the data stored on your business network is truly sensitive, we strongly recommend that you augment the basic protections afforded by access controls in Windows 2000 Professional and Windows XP Professional. In this type of environment, consider setting up at least one server running Windows 2000 Server or Windows .NET Server and creating a Windows domain. When all user data is stored on domain servers, a trained administrator can manage security policies and enforce them across the entire network, instead of relying on each user to maintain secure data. Using network servers also makes it easier to ensure that data is backed up regularly. Although this book doesn’t cover server configuration in detail, you can learn more about how to work with domains in "Workgroups vs. Domains," page 510.

Threat #4: Viruses, Worms, and Other Hostile Programs

Mainstream media outlets reserve their most breathless headlines for outbreaks of viruses and worms, often prompted by press releases from companies that sell software intended to fight those hostile programs. In recent years, a handful of new viruses and worms have caused massive amounts of damage to the computers they infected and have disrupted the flow of information on the Internet. Sadly, Windows users who pay attention to the threat of viruses only when a new outbreak occurs are most likely to become victims of a new attack.

Understanding how viruses and worms work is essential to keeping them out of your computer and network. Let’s start with some definitions:

• A virus is a piece of code that replicates by attaching itself to another object. A virus doesn’t have to be a self-contained program; in fact, many outbreaks of seemingly new viruses actually involve rewritten and repackaged versions of older virus code. When a virus infects a computer running Windows, it can attack the registry, replace system files, and take over e-mail programs in its attempt to replicate itself. The virus payload is the destructive portion of the code. Depending on the malicious intent and skill of the virus writer, the virus can destroy or corrupt data files, wipe out installed programs, or damage the operating system itself.

• Worms are independent programs that replicate by copying themselves from one computer to another, usually over a network or through e-mail attachments. Many modern worms also contain virus code that can damage data or consume so many system resources that they render the operating system unusable.

Computer viruses date back to the 1980s, when they were most commonly transmitted through infected floppy disks. In recent years, though, virus outbreaks have become faster and more destructive, thanks to the ubiquitous nature of the Windows platform and popular e-mail programs such as Microsoft Outlook and Outlook Express, coupled with the soaring popularity of the Internet. Virus writers have become more sophisticated, too, adding smart setup routines, sophisticated encryption, downloadable plug-ins, and automatic Web-based updates to their dangerous wares. Polymorphic viruses can mutate as they infect new host files, making discovery and disinfection difficult because no two instances of the virus "look" the same to virus scanners. A new class of so-called stealth viruses can disguise themselves so that installed antivirus software can’t detect them. If you know where to look in the virus underground, you can find point-and-click virus-authoring software, which lets even a nonprogrammer build a fully functional, destructive virus.

Many viruses and worms spread by attaching themselves to e-mail messages and then transmitting themselves to every address they can find on the victim’s computer. Some, like the Maldal virus shown here, bury the virus code in an executable file that masquerades as a seemingly innocuous animated greeting card.

(Image Unavailable)

When the victim opens the attachment, the animated file plays in its own window, disguising the virus activity.

(Image Unavailable)

Other viruses hidden in e-mail attachments try to cloak their true identity by appending an additional file name extension to the infected attachment. This strategy relies on the intended victim using the default settings of Windows Explorer, which hide extensions for known file types. The SirCam virus, shown here, infects a randomly selected file and adds an extension that makes it executable. In this example, you can see both extensions, including the suspicious .pif at the end of the file name. With file name extensions turned off, the attachment would appear to be an innocuous Microsoft Word document, and an unwary recipient would be more likely to open it.

(Image Unavailable)

Although most viruses and worms arrive as e-mail attachments, that’s not the only method of transmission. Malicious code can also be transmitted to unprotected machines via network shares, through ActiveX controls and scripts, and by HTML-based e-mail messages or Web pages. The infamous Code Red and Nimda worms represent particularly virulent examples of "blended threats" that replicate using multiple vectors.

CAUTION:
Underground" Web sites that host pornography, illegal software, and other questionable content are disproportionately likely to transmit viruses and worms. If novice computer users have access to your computer, make sure they understand the dangers of downloading and installing software from unknown sources. Up-to-date antivirus software is imperative on multiuser computers.

How can you stop viruses and worms before they cause damage to your computer or network? Here are four general guidelines to follow. (For more details, including how to identify a virus or worm and how to recover from a virus infection, see Chapter 9, "Stopping Viruses, Worms, and Trojan Horses.")

• Learn how to spot the warning signs of viruses. This is especially important in the first few hours or days after a new virus or worm appears on the scene, before antivirus software makers have developed updates that can detect the new strain. Unexpected e-mail attachments, even from familiar correspondents, should always be treated with extreme caution. (For a complete list of the telltale clues, see "Identifying Malicious Software," page 307.)

  TIP   When in doubt, delete suspicious files:
  When a new virus outbreak occurs, articles in the mainstream press often advise users to avoid opening attachments from strangers. That advice is dangerously incomplete. It’s equally important to avoid opening attachments from friends and colleagues. A favorite tactic of virus writers who target Windows computers is to program the virus so that it sends copies of itself via e-mail to everyone in the victim’s address book or Windows Messenger list. The infected attachment might be a real file, plucked from the victim’s My Documents folder. If you receive an unexpected attachment from anyone, especially someone you know, don’t open it until you can verify that it’s safe. When in doubt, hit the Delete key.

• Install antivirus software and keep it up to date. A good antivirus program monitors downloads and e-mail attachments in real time instead of relying on after-the-fact scans to identify infected files. Be sure to update the virus definitions regularly. Out-of-date antivirus software is worse than none at all because it promotes a false sense of security without offering any protection against recent strains.

• Train other network users on how to avoid viruses. Make sure that people you share a network with develop a healthy suspicion of file attachments and questionable Web pages. Impress on them how important it is to have antivirus software running at all times.

• Build additional barriers to prevent viruses from attacking computers. The best protection against viruses and worms is to keep them from ever reaching the user. Some third-party firewall programs offer extra layers of protection that block malicious code. Recent versions of Outlook and Outlook Express also include features that can disable potentially dangerous attachments. On a corporate network that includes an e-mail server, e-mail gateways can quarantine dangerous mail before it has a chance to reach users.

Threat #5: Outside Intruders and Trojan Horse Takeovers

If you’ve been to the movies, you’ve seen Hollywood’s stereotypical hacker—brilliant, antisocial, fueled by pizza and Mountain Dew, and so skilled that he can break into any bank, corporate database, or international spy headquarters with just a few taps on the keyboard.

In the real world, malicious hackers are far less glamorous and, for the most part, far less skilled than their counterparts on the silver screen. Unfortunately, even a novice hacker can do a frightful amount of damage by targeting an inadequately protected computer over the Internet.

NOTE:
Some security professionals bristle at what they perceive as the misuse of the term hacker, especially by the mainstream news media. In the computer underground, a hacker is anyone who spends time poking into computers and operating systems, testing their limits and discovering their vulnerabilities. "White hat" hackers who find and fix vulnerabilities in operating systems, applications, and networks are widely respected for their skills. "Black hat" hackers, or crackers, are more interested in breaking into computers and networks without authorization, either for the sheer fun of it or to steal valuable information, such as credit card numbers. In this book, we use the more precise terms attacker and intruder to refer to anyone who tries to access an unauthorized computer system from outside.

Most would-be intruders don’t bother aiming at a particular computer or network. Instead, they use widely available underground utilities to automate the process of breaking and entering. These tools scan hundreds or thousands of IP addresses in search of specific, known vulnerabilities; they’re most effective against always-on Internet connections, such as cable modems and DSL lines, whose IP addresses remain constant for long periods of time. Here are some examples of what they’re looking for:

• Unprotected shared resources. In theory, shared resources should be accessible only to other users on your network. In practice, poorly secured shares might be accessed from other computers on the same network segment (users connected to the same dial-up modem or cable router, for instance) and in some circumstances by any computer, anywhere on the Internet. A malicious intruder who finds an open share that isn’t protected by a password can do anything with the files and folders in that location. More important, the intruder can install one of several remote access programs that provide complete access to the shared computer.

• Open service ports. An intruder who finds a server running on your computer can probe it for weak passwords or known security holes; if you haven’t applied software patches to fix those vulnerabilities, the intruder can exploit the weakness to access your computer. Web servers, FTP servers, remote access programs like pcAnywhere, and messaging clients such as ICQ are especially susceptible to this sort of attack. For information about identifying open service ports, see "Determining Which Ports Are Active," page 564.

• Trojan horses. Also known as "back door" programs, these pieces of hostile software act as stealth servers that allow intruders to take control of a remote computer without the owner’s knowledge. Like the Greek myth after which they’re named, Trojan horse programs typically masquerade as benign programs and rely on gullible users to install them. Computers that have been taken over by a Trojan horse program are sometimes referred to as zombies. As we’ll see shortly, armies of these zombies can be used to launch crippling attacks against Web sites.

To prevent intruders from breaking into your computer from the Internet, follow these three general guidelines:

• Shut down services you’re not using. If you once installed a personal Web server to experiment with Web page design but no longer use it, make sure it’s not still running on your computer, inviting intruders to take a crack at it. (For details about turning off unused services, see "Shutting Down Unneeded Services," page 582.)

• Use firewall software to block access to your computer and to monitor intrusion attempts. Windows XP includes a serviceable Internet Connection Firewall that is configured automatically when you run the Network Setup Wizard. As Figure 1-4 shows, you can configure the firewall to allow certain types of traffic through, while blocking all others. Third-party firewall software offers additional capabilities, including the capability to block unwanted outbound connections and to restrict Internet access on a per-application basis.

• Use hardware barriers for an extra layer of protection on networks. A simple router or residential gateway provides basic Network Address Translation, which shields the IP addresses of computers on the network and rebuffs many attempts at intrusion. More sophisticated (and more expensive) firewall devices add the capability to block specific ports and protocols that outside attackers might be able to exploit.

Figure 1-4.  The Internet Connection Firewall in Windows XP provides basic but effective protection from intruders. (Image unavailable)

For more details about blocking intruders, see "Blocking Attacks with a Firewall," page 400.

Threat #6: Invasions of Privacy

When a hacker, cracker, or attacker connects to your computer, the threat to your security is immediate and personal. But threats to your online privacy are more subtle, and different users have different reactions to features in Windows and Internet Explorer that deliberately or unintentionally reveal personal information about you.

Internet Explorer, for example, reveals extensive details about your browser—which version you’re using, which optional components you’ve installed, and which site contained the link that brought you to the current page. It also betrays a few details that might be able to help the owner of a Web site pin down your location: your IP address and time zone, for instance.

Those details are relatively minor and are primarily intended to improve communication between your Web browser and the sites you visit. But another feature that’s common to all modern browsers is considerably more controversial. Cookies are tiny data files that contain persistent bits of information about you and your interaction with a particular Web site. They’re also a source of raging controversy among people who are passionate about privacy. In Chapter 13, "Protecting Your Privacy," we explain how cookies work and how you can control them. For the purposes of this discussion, you should know these four facts:

• Cookies can contain personal information only if you provide it. Most cookies simply create a serial number that allows the Web site to recognize that you’re a repeat visitor. If you enter personal details—by entering an online contest or filling in a registration form, for instance—the cookie can keep track of those details and match them with your browsing history from previous visits to the same site. Cookies are especially helpful for online shopping applications and at sites where you need to establish your identity for access.

• Internet Explorer 6 (an upgrade for Windows 2000 users, a standard part of Windows XP) includes a Privacy dialog box that lets you control cookies en masse or individually. Figure 1-5 shows an expanded version of the dialog box that appears when you configure Internet Explorer to prompt you before accepting a cookie.

  Figure 1-5.  As this example illustrates, most cookies consist of identifying numbers, not personal details. (Image unavailable)

• The most troubling threats to privacy come from third-party cookies, which allow advertisers and marketing companies to track your movements between different sites that include elements (such as banner ads) from that third party’s site. Internet Explorer 6 allows you to handle third-party cookies using different rules than those that apply to cookies associated directly with a site. A variety of add-on utilities for Internet Explorer and other browsers let you exercise even more precise control over which sites are allowed to set cookies on your computer.

• An emerging standard called the Platform for Privacy Preferences (P3P) allows Web sites to define the privacy standards they follow and publish that policy in a compact form as part of their Web site. Internet Explorer 6 can read this compact privacy policy and compare its settings to the preferences you entered. In theory, at least, this feature should let you automatically handle cookies at some sites.

Your browser has an impact on your privacy in one other way as well: The browser’s history keeps a record of every site you visit—going back, by default, almost three weeks. Anyone who has physical access to your computer can examine the list of sites you’ve visited and learn a lot about you—perhaps more than you’d like them to know. Sweeping away this evidence of where you’ve been in cyberspace is more difficult than it appears, because traces of your movements are scattered all over your hard drive. We’ll show you how to clean up all those scattered bits and pieces and also explain why even reformatting your hard disk might not be enough to eliminate all evidence of where you’ve been on the Web. For details, see "Covering Your Tracks," page 466.

Threat #7: E-Mail Threats

You’re exposed to a myriad of threats every time you open your e-mail client. We’ve already discussed e-mail as a delivery mechanism for viruses, but other security issues are equally important, if not as obvious.

If you use Internet-standard e-mail servers, every message you send travels in plain text on an unpredictable path that can pass through dozens of intermediate computers or routers before it reaches its destination. At any step along the way, your message can be intercepted and read; it can also be altered. In fact, it’s easy for a moderately tech-savvy crook to forge your name and address on a message so that it appears to have come from you. Because of that fundamental insecurity, you should never send confidential information such as credit card details or your Social Security number in a normal e–mail message; likewise, you should never rely on ordinary e-mail messages for important business transactions.

However, if you’re willing to endure some hassles, you can protect a message from prying eyes by using strong encryption and digital signatures so that the recipient can be certain the message was sent by you and hasn’t been tampered with. Full details are available in Chapter 10, "Keeping Your E-Mail Secure."

And then there’s the dark side of e-mail—unsolicited commercial e-mail, more popularly known as spam. For most of us, spam is a nuisance rather than a serious threat to our computer’s security. But spam can carry viruses and other hostile software. Unwanted ads for Web-based casinos and pornography can cause embarrassment or threaten your job security if they land in your work mailbox. And some of the tactics people use to fight back against spam actually make the problem worse, as we explain in Chapter 11, "Blocking Spam." We can’t promise to eliminate the problem completely, but we can offer a series of steps that can dramatically reduce the accumulation of e-mail in your inbox.

How Can You Protect Yourself?

Now that you have a basic overview of the security threats that can affect you, what should you do next? The most important step you can take is to put together a comprehensive security plan. It should incorporate the following elements:

• Stay up to date with patches for Windows and the applications you use regularly. Configure Windows XP and Windows 2000 to download critical updates automatically; you can choose when to install those updates. Visit Windows Update at least once a month to check for other important updates that might apply to your computer. Patching vulnerabilities as soon as they’re discovered is a crucial first step in protecting your data and your network. (See Chapter 7, "Keeping Your System Secure," for pointers to Windows Update and other sources of patches and updated system files.)

• Be sure that your computer is physically secure.

• Use strong passwords that are difficult or impossible to guess. Don’t use the same password for multiple accounts, and be sure to change your passwords every few months. Don’t use automatic logons for your main Windows account.

  TIP   Get help remembering passwords:
  If your memory isn’t up to the challenge of remembering dozens of randomly selected passwords, don’t worry—help is available. You can download any of several Windows utilities that can help you securely store your password list in encrypted form; some of these utilities even include password generators that help you create truly random, hard-to-break passwords. For some suggestions, see "Managing Passwords," page 99.

• Install antivirus software and update it regularly.

• Use firewall software and hardware to protect yourself from outside intruders.

• Back up critical data regularly, and store the backups in a safe location, away from your computer.

Above all, don’t think of security as a chore or a one-time task. Keeping your data, your computer, and your network secure is an ongoing process. The day you let your guard down is the day you’re most likely to become a victim.

In Chapter 2, we’ll walk you through important security-related features in Windows XP and Windows 2000.