Computer Security 102 - Escape from the Botnet

Posted by: David Stroop
on February 18, 2010

It used to be that malware writers’ favorite trick was to delete your C: drive. You used to know right away when your computer was infected: it didn’t work right. Those Good Old Days are gone. The modern perp never wants you to notice that he is using your computer. If you do notice and stop his activities, he can no longer make money by using your computer. He wants to use your computer for many different things, mostly tied to getting money, some of it yours.

He wants to use it to send spam to thousands of mailboxes. He is paid to send spam for many reasons. Some perps use spam to try to trick targets into revealing personal information, or to install malware, or to sell fake pills and watches.

He wants to collect your login credentials. Since many people reuse their bank login credentials on other sites, he is interested in all your login credentials.
He wants to use it to attack hundreds of websites with traffic they can’t handle. He has “customers” who pay him to attack web sites. These “customers” have many reasons to pay for this “service.” Some are competitors of the targets, some are people with political agendas, some could be governments trying to disrupt entire countries. Some even run “protection” rackets, collecting “payments” from web sites so that they won’t be attacted by these racketeers.

He can use your computer to spy on you and collect sensitive documents and information from your computer. This information can be used by terrorists, and badly acting governments and corporations.
He can use your mobile computer (your cellphone) to send expensive SMS messages or make expensive phone calls. You pay for these in your phone bill and the perp gets your money.

Fight Back

This money is being used to finance more and “better” crime. It also finances terrorism. Information gathered is aggressively used by governments and others to further their own agendas. It is possible that your computer could be used for warfare against your own country. But you can prevent these parasites from using your things.

Don’t blindly click links in emails, tweets and other messages. Checkout those short URLs with: http://longurl.org/.

Check the reputations of web sites with the sites mentioned on: http://www.linkextend.com/safety.
http://www.linkextend.com/, with many browsers, can instantly show safety information about links. You can right click on any link, such as the one shown by LongUrl above and select LinkExtend to see various safety ratings.

Flash memory and USB memory sticks can carry infections. Don’t put unknown memory or USB devices in your computer and don’t put yours in other computers. If you really have to do this, turn AutoRun off: http://support.microsoft.com/kb/967715/. You will then have to use My Computer to manually start these devices, but it will stop automatic infections from them too.

Keep your computer updated with the latest versions of your software, including the operating system, for instance with Automatic Updates. It is best to only update your software from the websites that originate that software. For instance, infection is likely if you let just any site install Adobe Flash updates.

These and other apps can help keep your computer up to date:
http://secunia.com/vulnerability_scanning/personal/ (recommended)
http://www.belarc.com/free_download.html
http://www.kcsoftwares.com/?sumo
http://technet.microsoft.com/en-us/security/cc184923.aspx

Since PDF readers like Adobe Reader and Foxit have had many exploits, especially keep them updated. Consider turning JavaScript off on these, since most documents don’t need this and some infections do. Adobe: http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html.
In Foxit, open Tools / Preferences / JavaScript and uncheck Enable JavaScript Actions.

Before you install anything or open a download on your computer (including any media file and, especially, any virus checker), these sites can help scan it for malware or fraudware:
http://virscan.org/
http://virusscan.jotti.org/
http://www.virustotal.com/

These and other apps can help detect some botnets and other infections already on your machine:
http://www.superantispyware.com/
http://www.malwarebytes.org/

Regularly examine your billing and bank statements for unauthorized activity. Don’t reuse your financial credentials (user names or passwords) for any other purpose. Do your online banking and other financial transactions only on systems you are absolutely sure about.

For banking and other highly sensitive transactions, consider using a freshly booted live CD from http://www.ubuntu.com/ or http://getchrome.eu/download.php.

For ordinary web browsing, consider using Firefox with NoScript: https://addons.mozilla.org/en-US/firefox/addon/722. NoScript is a little inconvenient, since it won’t let your FireFox do everything a web site requests until you give it permission. But, it’s worth the trouble.

Since advertising has carried infections, consider adding to FireFox, the malewaredomains blocklist for Adblock Plus. See http://adblockplus.org/blog/blocking-malicious-sites-with-adblock-plus. Install https://addons.mozilla.org/en-US/firefox/addon/1865, then click View All Subscriptions, and select Malware Domains near bottom.

And for your mobile phone: https://smobilesystems.com/.