|
A DESPERATE ATTEMPT TO SECURE WINDOWS 95/98
-------------------------------------------
Let's face it, security programs cost a bomb. Some of us just aren't rich enough to buy them. Does that mean your computer is an open door welcoming crackers and script kiddies? Nope. In this tutorial I will show you simple steps to foiling certain (but not all) security threats. However since this article can be used in a malicious manner, I have provided a disclaimer.
DISCLAIMER
----------
This article contains malicious code. Obviously it's there for educational purposes. I do NOT in any way encourage you to try them out unless you have the permission to do so. I also do NOT guarantee that the code is completely correct. I will NOT be held responsible or liable for any damages or inconveniences of ANY kind from the use or misuse of this article. Certain issues are beyond the scope of this article, at which point a link leading to more information on the issue is provided. With that in mind, let's begin.
OPEN SESAME
-----------
I think it goes without saying. Keep your passwords secret. Don't write them down. Pound them into your head until you can't possibly forget them. Passwords are the first line of defence. Keep them strong. Don't create passwords with less than four letters. Try to use the maximum available. Don't just use letters. Use numbers, alphabets, and if you're allowed, special characters. An example of such a password would be P+8?1Au9A^a.! Sure it's hard to remember. It's also hard to crack. Or you could use the first letter of your favourite phrase seperated by numbers or whatever. Be creative. Don't use words found in the dictionary.
BEWARE OF GREEKS EVEN WHEN THEY BEAR GIFTS
------------------------------------------
If you've got access to the Internet, ask yourself the following questions:
1. Do you like downloading warez (pirated software)?
2. Do you like getting Email attachments and opening them?
3. Do you accept programs over IRC or ICQ and run them?
If you've answered yes to any of these questions, you're at risk of getting a program that seems to do something good, but does something maliciously unsuspected instead. A trojan horse. Many script kiddies who have the nerve to call themselves hackers create lame Batch programs and distribute them to unwary Net users. An example of a simple trojan would be:
@ECHO OFF
ECHO Grab a cup of coffee!!!
ECHO Y | FORMAT C: /Q/U/V:SCREWED > NUL
Okay, when you run this you get "Grab a cup of coffee!!!" and while you're pondering what it means, it destroys your C drive. It does this by silently executing FORMAT.COM, thus deleting all data in your C drive. How do you stop this? First create a boot disk or start up disk. You can do this in Control Panel -> Add/Remove Programs -> Startup Disk. Check the disk and if FORMAT.COM is not in there already, copy it there from your hard drive. Now delete FORMAT.COM from your computer. Now there's no way the trojan will work.
While you're at it, go to your \Windows\Command directory and delete (backup to your start up disk first!!!) files you won't be using. Such candidates include:
FORMAT.COM
DELTREE.EXE
FDISK.EXE
Anything else you want to delete, go ahead. It's inconvenient to run the program from a floppy, but it makes your computer more secure. If you're not sure what a certain program in Windows\Command does, open up a DOS window and type:
program_name /?
Where program_name is the name of the program you need help on. Note that this will NOT work for some programs.
Now that you're done with that, download The Cleaner from www.dynamsol.com/puppet. It scans for tons of trojans that might be running in your computer. Next using your Search Engine, make a search for trojans and learn of the new and old ones, what they do, how to detect and remove them.
THE WELL KNOWN THREAT
---------------------
Most people will know what a computer virus is. For those who don't, it's a program that when run, copies itself and infects other programs (usually .COM or .EXE). Such a threat can easily be thwarted with the use of anti-virus software. There are so many out there. Two such examples are McAfee (www.mcafee.com) and Norton (www.symantec.com) anti-virus. Ah... but how good are they? Well you can't expect them to detect every virus that's for sure. If you're really paranoid, then run more than one anti-virus program. Make sure you scan every program before you run it. Yes, it's incovenient but isn't a few minutes of scanning better than a few hours of re-installing? As an added bonus, some anti-virus software detect trojan horses as well. I realize that virus scanners cost money. But you could always check out freeware and shareware sites. Eg: www.tucows.com, www.shareware.com, www.nonags.com Also, some universities allow you to download their anti-virus software for free.
MALICIOIUS BROWSING
-------------------
Javascript and Java have changed the Internet forever. Dynamic content make going online entertaining. But Java and Javascript can do bad things to your computer... For instance, take the following JavaScript code:
<SCRIPT LANGUAGE="JavaScript">
<!--
while(1)
{
alert('This is a trap!')
alert('You cannot escape!')
}
//-->
</SCRIPT>
This is a Denial of Service attack. The user who happens to go to this page will be pummelled with two messages running in an infinite loop. You won't be able to do anything else with the browser. Many users will reboot. That's not the solution. Use the Vulcan-Nerve-Pinch (CTRL-ALT-DEL) to get the Close Program dialog. Shut down your browser. Problem solved. By the way, if you have the Active Desktop running when you do this, you might have to restore it.
However, a malicious Java applet could do something undetected. So to avoid these problems, simply configure your browser and disable Java and JavaScript. I'm not sure about Norton Anti-Virus, but McAfee's anti-virus 4.x allows an option to scan malicious applets.
ONLINE WARFARE
--------------
Did your computer suddenly freeze up or crash? Is your Inbox suddenly crammed with junk email? Do you suddenly have a thousand ICQ messages waiting to be answered? These are well known attacks by script kiddies. Nuking and bombing. How is this done? Anyone can really just download some program like WinNuke and armed with someone's IP address, start nuking. It's not complicated. How do you defend against this? NukeNabber (www.dynamsol.com/puppet) looks out for nukes and bombs (not email bombs though). When it detects one, it logs information about the offender and gets rid of the nuke/bomb. So yes, I recommend that you check it out. As for email bombs, it would be a good idea to use a web based email account since you can easily dump it if you're bombed. Also, avoid giving out your email addresses on IRC chats where there are tons of people who can read it.
POLICY EDITOR
-------------
The Windows 95/98 CD comes with a program called POLEDIT.EXE. Look for it. It's a good security program and it's free. Learn how to use it. For more help, check out www.cadvision.com/redicks/security.htm and www.mathematicscompanion.com/ncs/poledit.htm for tutorials on using this program.
SECRET MESSAGES
---------------
Encryption is an important security tool. What it does is basically make readable text unreadable. For encryption programs, I recommend PGP. PGP Freeware is free and is easy to use. Encrypt all important and sensitive data. This way even if it's stolen, no one will be able to read it. PGP Freeware can be downloaded from www.nai.com/products/security/freeware.asp If you don't want PGP, there are other encryption utilities out there. Refer to the freeware and shareware sites mentioned above.
HACKING MSDOS.SYS
-----------------
MSDOS.SYS contains data that affects how your computer boots up. It's a hidden file located in your C drive. What important security feature can this do? For one thing, it will let you disable the boot keys like F8 for example. The F8 key allows a cracker physically sitting in front of your computer to start up DOS and bypass any security programs running at Windows's start up. To disable the boot keys, backup MSDOS.SYS first and then edit the BootKeys option (or add it if it's not there) in the [Options] section. Eg:
[Options]
BootKeys=0
More information on the subject of hacking MSDOS.SYS can be at www.eagnet.com/kbcc/msdossys.htm
SCREEN SAVER GREETINGS
----------------------
The screen saver can have more than one use. Especially when you configure a password for it. I am aware that rebooting the computer will let a cracker start Windows, get rid of the screen saver and the password. But that's not what I was talking about. First of all, under Start -> Settings -> Control Panel -> Display, configure a password for the Screen Saver. With that done, go to your Windows\System directory and look for your screen saver of choice. They have an extension of .SCR. Eg: JUNGLE.SCR Now create a shortcut of that screen saver to your Windows\Start Menu\Programs\StartUp Now when Windows start up, so will your screen saver. The only way to get past it, is to enter the password. Oh, make sure that the screen saver you chose does not allow CTRL-ALT-DEL and CTRL-ESC.
Okay, I lied. It's not the only way to get past it. A cracker who's able to get into DOS can simply delete the shortcut in the StartUp folder. To prevent this, you could simply fire up REGEDIT.EXE from Start -> Run and go to HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/C urrentVersion/R un
Click on Edit -> String Value and call it Secure. Now double click on it and add the full path of the screen saver you want to use. Eg:
C:\Windows\System\Jungle.scr
Oh, make sure you BACKUP the Registry first! Use Registry -> Export Registry File to do this. Remember to configure a password for the screen saver.
CONCLUSION
----------
And that's it. A simple introduction to securing your computer. It's enough to keep out curious intruders, but remember that the most determined intruder will still find ways of breaking in.
- Gabriel Wing -
|
|
