Computer security issues

N

Ngereja

JF-Expert Member
Feb 27, 2007
798
333
Wana-ICT popte pale mlipo:

Nina swali ambalo nahitaji kufahamishwa. Mimi nina computer ambayo iko kwenye network almost 24/7. Swali langu ni kwamba je nitafahamuje kwamba kuna mtu (Intruder) ana-access computter yangu na anaiba data kutoka kwenye computer yangu? Ni viashiria gani vitakavyonionyesha kwamba something is wrong on my computer.

Swali hili ni muhimu sana kwa watumiaji wote wa computer kwenye network. Naomba msaada hapa wa kiteknolojia.
 
Tafuta Security Software, weka layers za security . The said layers being hardware firewall, software firewall, networked and localized antivirus etc, depending on the need, the general rule of thumb is there is no trade off between security and ease of use - the more secure your system is the more restrictive and irritating it can get, just ask Vista users.

Ona reviews na descriptions ziko hapa

Best Security Product Reviews
 
Last edited:
ngereja said:
Wana-ICT popte pale mlipo:

Nina swali ambalo nahitaji kufahamishwa. Mimi nina computer ambayo iko kwenye network almost 24/7. Swali langu ni kwamba je nitafahamuje kwamba kuna mtu (Intruder) ana-access computter yangu na anaiba data kutoka kwenye computer yangu? Ni viashiria gani vitakavyonionyesha kwamba something is wrong on my computer.

Swali hili ni muhimu sana kwa watumiaji wote wa computer kwenye network. Naomba msaada hapa wa kiteknolojia.
Click to expand...

Bwana Mkubwa cha kwanza kabla ya kuamua vyote ungeeleza network yako uliiplan vipi mambo operating system unayotumia kama server , clients katika ya Access katika files sharings na mambo kama hayo na unatumia software gani za ulinzi ukiacha za microsoft hiyo moja

Pili ningekuwa wewe , ningetafuta consultant dar es salaam sasa hivi wapo wapo wa mambo ya ulinzi wa mitandao ( hiyo ndio fani yao ) akija akiona system yako kuangalia kazi unazofanya na watu unaofanya nao kazi atakupa msaada zaidi wa kitaalamu kutokana na mazingira uliyokuwepo

Mwisho kabisa unatakiwa uwe na USER POLICY ya matumizi ya computer zenu ambayo inaeleza mambo kuhusu kazi zenu na majukumu ya watumiaji wa hiyo network resource

Hilo ni jibu langu la mwanzo sasa unaweza kutueleza kutokana na maelezo ya hapo juu basi tutaweza kuongea zaidi kukupa mbinu zaidi na mambo mengine ( MAUJANJA )
 
Asanteni Shy na Pundit.

Labda ni weke wazi hivi.
Mimi ninatumia laptop yangu binafsi na ninaiunganisha kwenye network ya University via WiFi, ila siyo Dar na wala siyo Tanzania. Ninatumia free antivirus AntiVir Personal Edition Classic na SuperAntispyware Free edition na zinafanya kazi vizuri sana. Kwa antivirus sina tatizo. Binafsi nilitaka tu kufahamu kwa mfano kama kuna "intruder" amefanikiwa ku-hack na akawa na access to my laptop kwa nia tu ya kuchukua data kutoka kwenye laptop yangu, je, nitajuaje kwamba nimeingiliwa? dalili zipi zitanijulisha kwamba kuna kitu kisicho cha kawaida kinaendelea kwenye computer yangu when connected to the internet?
 
Last edited:
SECURING YOUR MACHINE

Some people go through a lot of trouble providing security over a network, including a firewall and all the security settings associated with the system. Then they forget to lock the system locally. These are some of the things you can do to the machine.

1. Set a bios password to your system. By doing this you prevent any user from booting the machine and accessing the operating system. The only way a user can do this is then by opening the system up and resetting the CMOS battery.

2. If your computer case has a lock, use it. If your drives have locks, use them. Any little thing you can do can help to improve security helps. This is especially true if this machine happens to be a server.

3. If you are concerned with local security of the machine, disable the bios bootup of your cd and floppy drives. A hacker with a Knoppix STD cd can boot into your machine locally and bypass the operating system. With a little work they can gain access to your machine.

THE WINDOWS XP PRO OPERATING SYSTEM

1. NTFS is important. Use NTFS on all your drives. FAT and FAT32 are the older standard file systems that shipped with the old 9x kernel and they provide no security whatsoever. In contrast Windows XP uses the NT kernel which allows you to use NTFS which has security permissions that can be set all the way down to the file level. If you have FAT or FAT32 drives you should convert them using the built in convert.exe utility. Once you have converted a drive it cannot be converted back so be sure you really want to do this. Not only does NTFS provide file permissions it also provides Compression and the EFS (Encrypting File System). Using the EFS will prevent any user from seeing the contents of a file or folder unless that user is you. You cannot use compression and encryption on the same file so choose one.

2. Use strong passwords on all accounts. Strong passwords are passwords that are not easily guessable and contain both numbers and letters. Using your birth date or dog's name for your password will not do. These types of passwords can be easily guessed or brute forced cracked. Passwords that use both upper and lower case are also much harder to crack. A password should be alternating like this: 7g4W0b2Xs5Q. You should never make your passwords less than 6 characters long and of course the longer the better. Also know that in Windows 2000 and Windows XP passwords can contain spaces. In fact if you can type the password on your keyboard it?s considered a usable character. Just a note, a password like the one I described could take about 100,000 years to crack, however as computer technology improves as well as the speed of the cpus this can take less time.

Windows XP converts and stores all passwords for every username in something called an NT password hash. This is a set of numbers and letters windows uses to match your password. Talking about local security here again, this can play an important role. If someone does gain access to your local machine within 5 minutes of being in front of the machine they can have complete access to it using a Linux boot disk with a program called NT Password. NT password will allow the person the ability to gain access to the SAM file which contains the list of usernames and associated encrypted hashes. The person can then simply insert a new hash associated with a new password. Then they only have to reboot the system, use the new password and gain access to the system. There is however an easy way to stop this. Use the EFS to encrypt the contents of the drive. By doing this the user would need the original password to the associated username or else they would not be able to see the encrypted files. A good hacker with a Knoppix STD cd can grab the sam file and copy it to a floppy or a usb thumb drive. They can then take the sam file away and work on cracking it. This is why strong passwords are very important. The longer and more random the password the harder it is to crack. Not only that but anytime you change your password, Windows automatically updates the NT password hash. Thus anyone who obtained the previous hash file would find it completely useless to them. NOTE: Windows actually makes two hash file changes when changing your password. The first is the hash contained in the SAM file but it also makes a second change to something called the LMHash (LAN Manager Hash). LMHash is the remains of the old password authentication used in Windows 3.1, 95, and 98. This hash is really bad because it is treated as two 7-character passwords and converted to all uppercase. This makes the LM Hash very easy to crack with brute force means. In Windows XP you do not need it and can remove it with a registry modification like this:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Then in the right pane set nolmhash to hexadecimal 1.
If it doesn?t exist, create a new dword called nolmhash. Then right click on it and select modify. Then set it to hexadecimal 1.

Now Windows XP will only create your passwords in NT Hash stored in the SAM file, which is much more secure.

3. Disable the Guest account. The Guest account while it seems like a good idea does leave your system open to possible access by hackers.

4. Disable Simple File Sharing. Having instructed you to disable the Guest account you also need to disable simple file sharing. Simple File sharing is a huge hole in security as it by default enables file sharing and makes all shares forced to logon using the Guest account to access shares. You can disable Simple File sharing by Double clicking on my computer, selecting tools and then folder options. Select the view tab and go to advanced settings. Uncheck the Use Simple File Sharing box and click apply. By doing this you can now setup permissions on folder per user by right clicking a folder and selecting Sharing and Security. It brings up the Sharing tab which you can now configure to your liking and what best suits your security needs.

5. Use Limited Accounts whenever possible. One problem I have had with Windows XP is that by default the first user is created as an administrator. You should use administrative privileges with care. That is if you are an administrator and someone gains access to your account they are an administrator. Its better to use the limited accounts and use the Run As command if you need to install something that requires administrative privileges.

6. Firewalls, Antivirus, and Spyware. I?m always amazed by the number of people who use the internet but have never bought a firewall, an antivirus program or a spyware removal tool. The fact is the internet is a place full of people who want nothing more than to gain access to your machine and they will use whatever means necessary to do so. You wouldn?t go outside in the middle of winter without a coat on, nor would you stand in a room of flu infected people without getting a flu shot. You would also never let someone you do not know stay in your home and go through your things. Everyday, millions of people everyday log onto the internet without any means of protection, so lets talk about some of the means to protect yourself on the internet.

Firewalls: A firewall is a piece of software or hardware that sits itself in between your computer and the internet. It does this by blocking access to the ports that your computer communicates on with the rest of the world. It also may inspect packets coming in and determine if the packets are safe to be used by your computer.

A firewall is a must have piece of software for any machine and the best part about it is there are companies out there that offer you a free firewall. You don?t even have to purchase this useful piece of software, they want you to be more secure and you should want that to. Microsoft has also taken a step in the right direction by including a firewall with Windows XP called the ICF (Internet Connection Firewall). I don?t like the ICF because it is not enabled by default and only checks ports coming in, that means that it allows any data to leave your computer without being examined. This is important and I?ll talk a little about that later. A good firewall is one that can both check incoming and outgoing information like ZoneAlarm, which is also free. You can find it at ZoneAlarm by Check Point - Award winning PC Protection, Antivirus, Firewall, Anti-Spyware, Identity Protection, and much more.

Antivirus: Antivirus software is an application or set of applications that are used to scan and repair files on your computer that can be or may be infected with virus machine code. Good antiviral software is software that can scan, clean, and repair any form of malware from your computer. Malware is an acronym for malicious software.

Just like a firewall, good antivirus software is a required component for your computer. And just like firewall software there are some companies out there that will give it away for free because they want your computer to be more secure. Good antivirus software should both clean and repair malware but it should also scan your system regularly, and provide a real-time scanner. Though not a requirement it should also provide scanning of your email. Since email is the new way to spread internet worms, you should take great care with it, and never execute anything that came attached to an email.
You can find a free antivirus software application called AVG at AVG Antivirus and Security Software - Real-time protection against viruses, spyware and malicious websites
I like it because it can clean and repair malware and also provides an email scanner.

Spyware: In general, spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet, spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties.

There has been a lot of debate about what exactly makes something spyware, and for me it?s pretty clear. If an application installs another piece of software even with your knowledge and that software transmits data from your computer to another without telling you, its spyware. There is no reason that you would want something like this installed on your computer, yet millions of people are infected with this type of junk software everyday. Not only does spyware infect your machine like a virus, it uses up your system resources and your bandwidth to transmit data like your browsing preferences and the types of software you have installed on your machine. It can also be used to gathering information from your registry, like product codes and such. You never want to install anything that would install this type of software, that includes those browser plug-ins that advertise easier searches, or p2p software like kazaa media desktop. Again a lot of good companies have come forward and provided these spyware removal tools for free. The tool I like is Ad-aware and it can be found at Ad-Aware @ Lavasoft - The Original Anti-Spyware Company - Lavasoft but there are many good tools to use. You can find them just by searching on Google.

7. Windows Update. Check it at least once a week. There is no better way to make sure your system is updated. By installing the newest security patches you help to make your computer a little safer. Microsoft releases these patches because they do not want to see your machine exploited. Everyone knows that if each user just takes the time to update their machine when a new vulnerability is discovered less and less of these worms would be a problem. The fact is I find that very often when I see a user?s machine that it might never have been updated. So please do everyone a favor and update your machine if it needs it.


8. Wireless Everywhere. If you are one of those people who have started using wireless net access than you should know that its pretty easy to hack into your wireless network. But I?ll give you a few tips on how to secure that network.

Just about anyone with some knowledge and a few tools can hack into your wireless network and not only use your network bandwidth for free but gain access to your networked computers. They can do this by something called wardriving. A person can drive his or her car around with a laptop, a wireless card, and netstumbler. With this a person can gain easy access to any unencrypted wireless network.

So the first thing you will want to do when you setup your wireless network is change your SSID. Since a hacker has to know your network?s name to access it changing the SSID does help a little. Because SSID?s are usually assigned preset by the manufacturer, it?s easy for a hacker to gain access if he has a list of the manufacturers SSID defaults. It?s also recommended you change the password to your access point?s admin account. Since again this password is set by default. If they have the SSID they also have the password.
Also if your access point allows you to disable SSID broadcasting, use it.

Now you will want to get your WEP (Wired Equivalent Privacy) working. Get a Wireless access point and card that support at least 128-bit encryption. Make sure when setting your WEP password it?s long and difficult and doesn?t repeat the same letters and numbers often. Just by installing and configuring WEP you are making it much more difficult for the hacker. However even WEP can be bypassed if the hacker wants to spend long enough.

A hacker with Knoppix STD and AirSnort can begin cracking away on your network. AirSnort begins by capturing packets, but it needs something called interesting packets or weak key packets to really break the encryption. AirSnort needs these packets because these are the packets that contain password information used to crack the WEP encryption. The more users on a wireless network the more weak keys that are generated and the shorter the time it will take to break the encryption. This is why strong password encryption is important, the stronger the password the harder and longer it will take to crack. So unless this hacker really wants to access your network, a strong password should be good enough. One things hackers can be described accurately as is lazy. Why would a hacker spend a month trying to crack your hard password when someone else may not be using WEP and they can logon to their network with ease? So use WEP and make sure it?s a strong password.

9. Rename the Administrator account. Although a hacker can still gain access to the account by getting the SID from the sam file, it will keep the common script kiddies away. Also rename the account to something that isn?t obvious like admin. Rename it to something that makes it seem like a normal account. Another trick is to create a dummy Administrator account with no privileges at all. Then if you give it a strong password a hacker could spend a long time trying to crack the account only to find out its useless.

10. Don?t use Everyone. You should change the Everyone Group to Authenticated Users, so only authenticated users can gain access to the shares and printers on the network.

11. Clear the PageFile at shutdown. The pagefile can contain a lot of sensitive data that is stored in memory and if it?s not cleared at shutdown a person can potentially gain access to that information by viewing it. To have windows clear it you must edit your registry like this:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Then in the right pane set ClearPageFileAtShutdown to hexadecimal 1.
If it doesn?t exist, create a new dword called ClearPageFileAtShutdown. Then right click on it and select modify. Then set it to hexadecimal 1.

NOTE: By doing this you may add several seconds to your shutdown time.

12. Disable the Windows Default Shares. Windows XP starts up your system with a number of default shares enabled. The root of each partition is shared along with ADMIN$, FAX$, IPC$ and PRINT$, etc. You should at least disable the sharing of your drives by default. You may notice that if you try to disable them, Windows will just re-share them on startup. So to disable them permanently you need to modify the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Create a new dword called AutoShareWks. Then right click on it and select modify. Then set it to hexadecimal 0.

NOTE: This will disable all default administrative shares. This can cause problems with some programs so do not do it unless you are absolutely sure, and if you find it does cause problems set the value to 1 or remove it.

13. Disable storing of credentials and .NET passwords. Windows by default stores authentication credentials and .NET passwords on the local system and you should disable it for better security when on a domain. This can be modified in the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Create a new dword called DisableDomainCreds. Then right click on it and select modify. Then set it to hexadecimal 1.

14. Harden your TCP/IP stack to defend against DOS. Denial of Service attacks are now part of internet life and can be a pain in the backside. There are a few things you can do to try and improve your windows xp machine against these types of attacks and they involved modifying the registry to modify how the TCP/IP stack responds to these types of attacks. Do this only if you are connected directly to the internet and only if you are sure you want to make these changes. Because these changes modify the TCP/IP stack it may not make your connection perform the best because of the added checking. This can be modified in the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

You?ll need to create several new DWORD values. EnableDeadGWDetect, EnableICMPRedirect, EnablePMTUDiscovery, KeepAliveTime, NoNameReleaseOnDemand, PerformRouterDiscovery, SynAttackProtect.

After creating the new dword values you will need to modify each one separately by right clicking on it and selecting modify. If they already existed just modify them as such.

EnableDeadGWDetect set to hexadecimal 0
Disables dead-gateway detection as an attack could force the server to switch gateways.

EnableICMPRedirect set to hexadecimal 0
Stops Windows from altering its route table in response to ICMP redirect messages.

EnablePMTUDiscovery set to hexadecimal 0
Disables maximum transmission unit (MTU) discovery as an attacker could force the MTU value to a very small value and overwork the stack.

KeepAliveTime set to hexadecimal 300000
Reduces how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.

NoNameReleaseOnDemand set to hexadecimal 1
Protects the computer against malicious NetBIOS name-release attacks.

PerformRouterDiscovery set to hexadecimal 0
Disables ICMP Router Discovery Protocol (IRDP) where an attacker may remotely add default route entries on a remote system.

SynAttackProtect set to hexadecimal 2
Automatically adds additional delays to connection indications and TCP connection requests quickly timeout when a SYN attack is in progress.

NOTE: Take great care in modifying your registry and backup the original entries just in case you want to return these values to normal.

15. Add SYN Flood Protection. You can modify your registry to add better SYN Flood protection to your system. You?ll need to modify your registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Create a new dword called SynAttackProtect. Then right click on it and select modify. Then set it to hexadecimal 2.

You can set its default back by changing the value back to 0.

16. Disable the Messenger. Windows Messenger while useful on a large office network is not needed by default in Windows XP or on a computer that is not on a network. Since this service is being used to spam users with advertisements it should be shutoff and you can do that by accessing the System Services like so: Click on Start and go to settings and then control panel. In the control panel you should find Administrative Tools. You?ll then want to click on it and then on Services. Now a list will pop up with all the system services that start with Windows XP. Locate Messenger in the list, right click on it and click stop. Then right click on it again and click properties. Then in the startup type change it from automatic to disabled and click OK. Now it will no longer startup when your computer boots into Windows.

I want to make it clear when I speak of Messenger I meant the Windows Messenger Service, not be to confused with Windows Instant Messenger. These are entirely different Applications, though both closely named, thanks Microsoft. Oh you can remove the instant messenger by going to start and run and then typing:

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove


Well these are just some things you can do to improve the security of your Windows XP Pro computer.
 
Thanks very much Shy!

Very nice stuff and important for all computer users
 
Shy said:
SECURING YOUR MACHINE

Some people go through a lot of trouble providing security over a network, including a firewall and all the security settings associated with the system. Then they forget to lock the system locally. These are some of the things you can do to the machine.

1. Set a bios password to your system. By doing this you prevent any user from booting the machine and accessing the operating system. The only way a user can do this is then by opening the system up and resetting the CMOS battery.

2. If your computer case has a lock, use it. If your drives have locks, use them. Any little thing you can do can help to improve security helps. This is especially true if this machine happens to be a server.

3. If you are concerned with local security of the machine, disable the bios bootup of your cd and floppy drives. A hacker with a Knoppix STD cd can boot into your machine locally and bypass the operating system. With a little work they can gain access to your machine.

THE WINDOWS XP PRO OPERATING SYSTEM

1. NTFS is important. Use NTFS on all your drives. FAT and FAT32 are the older standard file systems that shipped with the old 9x kernel and they provide no security whatsoever. In contrast Windows XP uses the NT kernel which allows you to use NTFS which has security permissions that can be set all the way down to the file level. If you have FAT or FAT32 drives you should convert them using the built in convert.exe utility. Once you have converted a drive it cannot be converted back so be sure you really want to do this. Not only does NTFS provide file permissions it also provides Compression and the EFS (Encrypting File System). Using the EFS will prevent any user from seeing the contents of a file or folder unless that user is you. You cannot use compression and encryption on the same file so choose one.

2. Use strong passwords on all accounts. Strong passwords are passwords that are not easily guessable and contain both numbers and letters. Using your birth date or dog's name for your password will not do. These types of passwords can be easily guessed or brute forced cracked. Passwords that use both upper and lower case are also much harder to crack. A password should be alternating like this: 7g4W0b2Xs5Q. You should never make your passwords less than 6 characters long and of course the longer the better. Also know that in Windows 2000 and Windows XP passwords can contain spaces. In fact if you can type the password on your keyboard it?s considered a usable character. Just a note, a password like the one I described could take about 100,000 years to crack, however as computer technology improves as well as the speed of the cpus this can take less time.

Windows XP converts and stores all passwords for every username in something called an NT password hash. This is a set of numbers and letters windows uses to match your password. Talking about local security here again, this can play an important role. If someone does gain access to your local machine within 5 minutes of being in front of the machine they can have complete access to it using a Linux boot disk with a program called NT Password. NT password will allow the person the ability to gain access to the SAM file which contains the list of usernames and associated encrypted hashes. The person can then simply insert a new hash associated with a new password. Then they only have to reboot the system, use the new password and gain access to the system. There is however an easy way to stop this. Use the EFS to encrypt the contents of the drive. By doing this the user would need the original password to the associated username or else they would not be able to see the encrypted files. A good hacker with a Knoppix STD cd can grab the sam file and copy it to a floppy or a usb thumb drive. They can then take the sam file away and work on cracking it. This is why strong passwords are very important. The longer and more random the password the harder it is to crack. Not only that but anytime you change your password, Windows automatically updates the NT password hash. Thus anyone who obtained the previous hash file would find it completely useless to them. NOTE: Windows actually makes two hash file changes when changing your password. The first is the hash contained in the SAM file but it also makes a second change to something called the LMHash (LAN Manager Hash). LMHash is the remains of the old password authentication used in Windows 3.1, 95, and 98. This hash is really bad because it is treated as two 7-character passwords and converted to all uppercase. This makes the LM Hash very easy to crack with brute force means. In Windows XP you do not need it and can remove it with a registry modification like this:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Then in the right pane set nolmhash to hexadecimal 1.
If it doesn?t exist, create a new dword called nolmhash. Then right click on it and select modify. Then set it to hexadecimal 1.

Now Windows XP will only create your passwords in NT Hash stored in the SAM file, which is much more secure.

3. Disable the Guest account. The Guest account while it seems like a good idea does leave your system open to possible access by hackers.

4. Disable Simple File Sharing. Having instructed you to disable the Guest account you also need to disable simple file sharing. Simple File sharing is a huge hole in security as it by default enables file sharing and makes all shares forced to logon using the Guest account to access shares. You can disable Simple File sharing by Double clicking on my computer, selecting tools and then folder options. Select the view tab and go to advanced settings. Uncheck the Use Simple File Sharing box and click apply. By doing this you can now setup permissions on folder per user by right clicking a folder and selecting Sharing and Security. It brings up the Sharing tab which you can now configure to your liking and what best suits your security needs.

5. Use Limited Accounts whenever possible. One problem I have had with Windows XP is that by default the first user is created as an administrator. You should use administrative privileges with care. That is if you are an administrator and someone gains access to your account they are an administrator. Its better to use the limited accounts and use the Run As command if you need to install something that requires administrative privileges.

6. Firewalls, Antivirus, and Spyware. I?m always amazed by the number of people who use the internet but have never bought a firewall, an antivirus program or a spyware removal tool. The fact is the internet is a place full of people who want nothing more than to gain access to your machine and they will use whatever means necessary to do so. You wouldn?t go outside in the middle of winter without a coat on, nor would you stand in a room of flu infected people without getting a flu shot. You would also never let someone you do not know stay in your home and go through your things. Everyday, millions of people everyday log onto the internet without any means of protection, so lets talk about some of the means to protect yourself on the internet.

Firewalls: A firewall is a piece of software or hardware that sits itself in between your computer and the internet. It does this by blocking access to the ports that your computer communicates on with the rest of the world. It also may inspect packets coming in and determine if the packets are safe to be used by your computer.

A firewall is a must have piece of software for any machine and the best part about it is there are companies out there that offer you a free firewall. You don?t even have to purchase this useful piece of software, they want you to be more secure and you should want that to. Microsoft has also taken a step in the right direction by including a firewall with Windows XP called the ICF (Internet Connection Firewall). I don?t like the ICF because it is not enabled by default and only checks ports coming in, that means that it allows any data to leave your computer without being examined. This is important and I?ll talk a little about that later. A good firewall is one that can both check incoming and outgoing information like ZoneAlarm, which is also free. You can find it at ZoneAlarm by Check Point - Award winning PC Protection, Antivirus, Firewall, Anti-Spyware, Identity Protection, and much more.

Antivirus: Antivirus software is an application or set of applications that are used to scan and repair files on your computer that can be or may be infected with virus machine code. Good antiviral software is software that can scan, clean, and repair any form of malware from your computer. Malware is an acronym for malicious software.

Just like a firewall, good antivirus software is a required component for your computer. And just like firewall software there are some companies out there that will give it away for free because they want your computer to be more secure. Good antivirus software should both clean and repair malware but it should also scan your system regularly, and provide a real-time scanner. Though not a requirement it should also provide scanning of your email. Since email is the new way to spread internet worms, you should take great care with it, and never execute anything that came attached to an email.
You can find a free antivirus software application called AVG at AVG Antivirus and Security Software - Real-time protection against viruses, spyware and malicious websites
I like it because it can clean and repair malware and also provides an email scanner.

Spyware: In general, spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet, spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties.

There has been a lot of debate about what exactly makes something spyware, and for me it?s pretty clear. If an application installs another piece of software even with your knowledge and that software transmits data from your computer to another without telling you, its spyware. There is no reason that you would want something like this installed on your computer, yet millions of people are infected with this type of junk software everyday. Not only does spyware infect your machine like a virus, it uses up your system resources and your bandwidth to transmit data like your browsing preferences and the types of software you have installed on your machine. It can also be used to gathering information from your registry, like product codes and such. You never want to install anything that would install this type of software, that includes those browser plug-ins that advertise easier searches, or p2p software like kazaa media desktop. Again a lot of good companies have come forward and provided these spyware removal tools for free. The tool I like is Ad-aware and it can be found at Ad-Aware @ Lavasoft - The Original Anti-Spyware Company - Lavasoft but there are many good tools to use. You can find them just by searching on Google.

7. Windows Update. Check it at least once a week. There is no better way to make sure your system is updated. By installing the newest security patches you help to make your computer a little safer. Microsoft releases these patches because they do not want to see your machine exploited. Everyone knows that if each user just takes the time to update their machine when a new vulnerability is discovered less and less of these worms would be a problem. The fact is I find that very often when I see a user?s machine that it might never have been updated. So please do everyone a favor and update your machine if it needs it.


8. Wireless Everywhere. If you are one of those people who have started using wireless net access than you should know that its pretty easy to hack into your wireless network. But I?ll give you a few tips on how to secure that network.

Just about anyone with some knowledge and a few tools can hack into your wireless network and not only use your network bandwidth for free but gain access to your networked computers. They can do this by something called wardriving. A person can drive his or her car around with a laptop, a wireless card, and netstumbler. With this a person can gain easy access to any unencrypted wireless network.

So the first thing you will want to do when you setup your wireless network is change your SSID. Since a hacker has to know your network?s name to access it changing the SSID does help a little. Because SSID?s are usually assigned preset by the manufacturer, it?s easy for a hacker to gain access if he has a list of the manufacturers SSID defaults. It?s also recommended you change the password to your access point?s admin account. Since again this password is set by default. If they have the SSID they also have the password.
Also if your access point allows you to disable SSID broadcasting, use it.

Now you will want to get your WEP (Wired Equivalent Privacy) working. Get a Wireless access point and card that support at least 128-bit encryption. Make sure when setting your WEP password it?s long and difficult and doesn?t repeat the same letters and numbers often. Just by installing and configuring WEP you are making it much more difficult for the hacker. However even WEP can be bypassed if the hacker wants to spend long enough.

A hacker with Knoppix STD and AirSnort can begin cracking away on your network. AirSnort begins by capturing packets, but it needs something called interesting packets or weak key packets to really break the encryption. AirSnort needs these packets because these are the packets that contain password information used to crack the WEP encryption. The more users on a wireless network the more weak keys that are generated and the shorter the time it will take to break the encryption. This is why strong password encryption is important, the stronger the password the harder and longer it will take to crack. So unless this hacker really wants to access your network, a strong password should be good enough. One things hackers can be described accurately as is lazy. Why would a hacker spend a month trying to crack your hard password when someone else may not be using WEP and they can logon to their network with ease? So use WEP and make sure it?s a strong password.

9. Rename the Administrator account. Although a hacker can still gain access to the account by getting the SID from the sam file, it will keep the common script kiddies away. Also rename the account to something that isn?t obvious like admin. Rename it to something that makes it seem like a normal account. Another trick is to create a dummy Administrator account with no privileges at all. Then if you give it a strong password a hacker could spend a long time trying to crack the account only to find out its useless.

10. Don?t use Everyone. You should change the Everyone Group to Authenticated Users, so only authenticated users can gain access to the shares and printers on the network.

11. Clear the PageFile at shutdown. The pagefile can contain a lot of sensitive data that is stored in memory and if it?s not cleared at shutdown a person can potentially gain access to that information by viewing it. To have windows clear it you must edit your registry like this:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Then in the right pane set ClearPageFileAtShutdown to hexadecimal 1.
If it doesn?t exist, create a new dword called ClearPageFileAtShutdown. Then right click on it and select modify. Then set it to hexadecimal 1.

NOTE: By doing this you may add several seconds to your shutdown time.

12. Disable the Windows Default Shares. Windows XP starts up your system with a number of default shares enabled. The root of each partition is shared along with ADMIN$, FAX$, IPC$ and PRINT$, etc. You should at least disable the sharing of your drives by default. You may notice that if you try to disable them, Windows will just re-share them on startup. So to disable them permanently you need to modify the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Create a new dword called AutoShareWks. Then right click on it and select modify. Then set it to hexadecimal 0.

NOTE: This will disable all default administrative shares. This can cause problems with some programs so do not do it unless you are absolutely sure, and if you find it does cause problems set the value to 1 or remove it.

13. Disable storing of credentials and .NET passwords. Windows by default stores authentication credentials and .NET passwords on the local system and you should disable it for better security when on a domain. This can be modified in the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Create a new dword called DisableDomainCreds. Then right click on it and select modify. Then set it to hexadecimal 1.

14. Harden your TCP/IP stack to defend against DOS. Denial of Service attacks are now part of internet life and can be a pain in the backside. There are a few things you can do to try and improve your windows xp machine against these types of attacks and they involved modifying the registry to modify how the TCP/IP stack responds to these types of attacks. Do this only if you are connected directly to the internet and only if you are sure you want to make these changes. Because these changes modify the TCP/IP stack it may not make your connection perform the best because of the added checking. This can be modified in the registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

You?ll need to create several new DWORD values. EnableDeadGWDetect, EnableICMPRedirect, EnablePMTUDiscovery, KeepAliveTime, NoNameReleaseOnDemand, PerformRouterDiscovery, SynAttackProtect.

After creating the new dword values you will need to modify each one separately by right clicking on it and selecting modify. If they already existed just modify them as such.

EnableDeadGWDetect set to hexadecimal 0
Disables dead-gateway detection as an attack could force the server to switch gateways.

EnableICMPRedirect set to hexadecimal 0
Stops Windows from altering its route table in response to ICMP redirect messages.

EnablePMTUDiscovery set to hexadecimal 0
Disables maximum transmission unit (MTU) discovery as an attacker could force the MTU value to a very small value and overwork the stack.

KeepAliveTime set to hexadecimal 300000
Reduces how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.

NoNameReleaseOnDemand set to hexadecimal 1
Protects the computer against malicious NetBIOS name-release attacks.

PerformRouterDiscovery set to hexadecimal 0
Disables ICMP Router Discovery Protocol (IRDP) where an attacker may remotely add default route entries on a remote system.

SynAttackProtect set to hexadecimal 2
Automatically adds additional delays to connection indications and TCP connection requests quickly timeout when a SYN attack is in progress.

NOTE: Take great care in modifying your registry and backup the original entries just in case you want to return these values to normal.

15. Add SYN Flood Protection. You can modify your registry to add better SYN Flood protection to your system. You?ll need to modify your registry like so:

Open your registry editor by clicking Start and then run and by typing regedit and pressing OK. Then navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Create a new dword called SynAttackProtect. Then right click on it and select modify. Then set it to hexadecimal 2.

You can set its default back by changing the value back to 0.

16. Disable the Messenger. Windows Messenger while useful on a large office network is not needed by default in Windows XP or on a computer that is not on a network. Since this service is being used to spam users with advertisements it should be shutoff and you can do that by accessing the System Services like so: Click on Start and go to settings and then control panel. In the control panel you should find Administrative Tools. You?ll then want to click on it and then on Services. Now a list will pop up with all the system services that start with Windows XP. Locate Messenger in the list, right click on it and click stop. Then right click on it again and click properties. Then in the startup type change it from automatic to disabled and click OK. Now it will no longer startup when your computer boots into Windows.

I want to make it clear when I speak of Messenger I meant the Windows Messenger Service, not be to confused with Windows Instant Messenger. These are entirely different Applications, though both closely named, thanks Microsoft. Oh you can remove the instant messenger by going to start and run and then typing:

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove


Well these are just some things you can do to improve the security of your Windows XP Pro computer.
Click to expand...
Click to expand...

Good job Shy. Have been helpfull to JF all the time.
 
You must log in or register to reply here.

Similar Discussions

Back
Top Bottom
Forums
New posts
Post thread
Back