Discussion Community

How to stop 11 hidden security threats

Shortened URLs
Most tweets, and lots of other electronic messages, include links that have been shortened by services such as Bit.ly, Tr.im, and Goo.gl. The URL aliases are handy, but they pose a risk, too: Since short URLs give no hint of the destination, attackers can exploit them to send you to malicious sites.

Use a Twitter client: Programs such as TweetDeck include options in their settings to display previews of shortened URLs. With such a setting enabled, clicking a shortened URL within a tweet brings up a screen that shows the destination page's title, as well as its full-length URL and a tally of how many other people have clicked that link. With this information at your disposal, you can make an informed decision about whether to click through and visit the actual site.

Install a URL-preview plug-in: Several Web browser plug-ins and services perform a similar preview function. When you create a shortened address with the TinyURL service, for instance, you can choose an option to create a preview version so that recipients can see where it goes before clicking. Conversely, if you're considering visiting a TinyURL link, you can enable its preview service to see the complete URL. For the TinyURL previews to work, though, you must have cookies enabled in your browser.

ExpandMyURL and LongURLPlease both provide Web browser plug-ins or applets that will verify the safety of the full URLs behind abbreviated links from all the major URL-shortening services. Rather than changing the shortened links to their full URLs, however, ExpandMyURL checks destination sites in the background and marks the short URLs green if they are safe.

Goo.gl, Google's URL-shortening service, provides security by automatically scanning the destination URL to detect and identify malicious Websites, and by warning users when the shortened URL might be a security concern. Unfortunately, Goo.gl has limited application because it works only through other Google products and services.

Data harvesting of your profile
Some of the personal details that you might share on social networks, such as your high school, hometown, or birthday, are often the same items used in "secret" security questions for banks and Websites. An attacker who collects enough of this information may be able to access your most sensitive accounts.

Check your Facebook privacy settings: After signing in to your Facebook account, click Settings on the menu bar and select Privacy Settings.

Facebook's privacy settings allow you to choose who may see various personal details. You can hide your details from everyone but your Facebook friends (our recommendation), allow members of your networks to view your details as well, or open the floodgates and permit everyone to see your information. In addition, you can set the privacy level for each component of your profile -- for example, your birthday, your religious and political views, the photos you post, and your status updates.

Don't accept any friend requests from strangers: From time to time you may get a friend request from someone you don't know. If you're serious about protecting your personal information, you shouldn't accept such requests.

computerworld

Social network impostors
If you've connected with someone on Facebook, LinkedIn, Twitter, or another social network, it's probably because you know and trust the person. Attackers, however, can take control of your friend's online persona and then exploit that trust.

Beware of scams sent from 'friends': Attackers can hijack one of your online buddies' social networking accounts through malware, phishing scams, and other techniques, and then use the stolen accounts to spam you, steal your personal data, or even con you out of cash. Once the thieves have locked your friend out of the account, they may send you a note saying, "Help! I'm in London and my wallet was stolen. Can you wire me some money for a plane ticket?" Or they may recommend that you click on doctored links that will allow them to infect your computer or compromise your own account.

Web snooping
Now that so much entertainment, shopping, and socializing has shifted online, every Internet user leaves a rich digital trail of preferences. The books you read, the movies you rent, the people you interact with, the items you buy, and other details constitute a gold mine of demographic data for search engines, advertisers, and anyone who might want to snoop around your computer.

Do business with companies you trust: Stay aware of the privacy policies of the Websites and services you interact with, and restrict your dealings to those that you believe you can trust to guard your sensitive information.

Use private browsing: The current versions of Internet Explorer, Firefox, Safari, and Chrome include private-browsing modes. These features, such as IE 8's InPrivate Browsing and Firefox 3.5's Private Browsing, ensure that the site history, form data, searches, passwords, and other details of the current Internet session don't remain in your browser's cache or password manager once you shut the browser down. By protecting such information on the computer you do your surfing on, these features help you foil nosy coworkers or relatives.

Scareware
You're probably familiar with the garden-variety phishing attack. Like a weekend angler, a phisher uses bait, such as an e-mail message designed to look as if it came from a bank or financial institution, to hook a victim. Scareware is a twist on the standard phishing attack that tricks you into installing rogue antivirus software by "alerting" you that your PC may be infected.

Don't take the bait: Stop and think. If, for instance, you don't have any security software installed on your PC, how did the "alert" magically appear? If you do have a security utility that identifies and blocks malicious software, why would it tell you to buy or download more software to clean the alleged infection? Become familiar with what your security software's alerts look like so that you can recognize fake pop-ups.

Don't panic: You should already have antimalware protection. If you don't, and you're concerned that your PC may in fact be infected (not an unreasonable concern, given the existence of a rogue "alert" on your screen), scan your system with Trend Micro's free online malware scanner, HouseCall, or try running Microsoft's Malicious Software Removal Tool; for more help, see "Additional Security Resources." Once you complete that scan, whether it discovers anything or not, find yourself a reputable antimalware app and install it to protect your PC in the future.

computerworld

Trojan horse texts
Some attackers will send spam text messages to your mobile phone that appear to be from your network provider or financial institution. These Trojan horse text messages may direct you to a malicious site or request permission to install an update that will change the settings on your cell phone to allow the attackers to capture usernames, passwords, and other sensitive information from your device.

Go to the source for updates and news: If you receive a text message that appears to be from a trustworthy source, but it directs you to install or update software, or if it initiates the installation and requests permission to continue, immediately exit the text-messaging app and contact the customer service department for the wireless provider or business in question to verify whether the software is legitimate.

You may receive a lot of unsolicited e-mail from companies that you do business with -- e-mail that you might even regard as spam -- but reputable companies will not send you unsolicited links and updates via e-mail. Similarly, reputable companies will not send unsolicited text messages to your mobile device directing you to install an update or download new software.

Attackers prey on your tendency to trust your wireless provider or financial institution. Do not blindly accept software updates or download applications to your mobile phone simply because the text message appears to be official. If in any doubt, follow up with your wireless provider or with the business.

Lost laptops, exposed data
The portability of laptops and cell phones is convenient, of course, but that same portability means that such devices are easily lost or stolen. If your laptop, netbook, phone, or other device falls into the wrong hands, unauthorized users may access the sensitive data that you've stored there.

Encrypt your data: You can use a utility such as Microsoft's BitLocker to encrypt data. Unfortunately, BitLocker is available only for Windows Vista and Windows 7, and even then it's exclusive to the Ultimate and Enterprise editions of those OSs (and is also available in Windows Server 2008); you won't find the tool in the consumer versions of Vista and Windows 7.

Fortunately, BitLocker isn't the only game in town. You can use another encryption program, such as TrueCrypt (available for free under open-source licensing), to protect your data from unauthorized access.

Encrypting your data is not without a pitfall or two, however. The biggest issue is to ensure that you always possess the key. If you lose your encryption key, you will quickly discover just how good encryption is at keeping out unauthorized users.

Use stronger passwords: If encrypting seems to be more of a hassle than it's worth, at least use strong passwords to protect your PC. Longer passwords are better; more characters take longer to crack. You should also mix things up by substituting numbers and special characters for letters. For example, instead of using the plain "PCWorldMagazine", you could use "PCW0r1dM@g@zin3". Though that's still a phrase you can easily remember, the character diversity makes it significantly harder to guess or crack.

Hi Dhilip,

It was an wonderful information about hidden security threats.

Keep posting informative tips. Thanks in advance.