You’re careful, but what about your kids?

It happens too often. I receive a voicemail or e-mail message from a client containing the somber words, “I think I have a virus.”

There is frequently an element of guilt and shame in the message, as if I would think badly of them for allowing this to happen. This is probably because everyone knows porn sites are common distributors of malware. But there are many other ways your system can become infected.

As we talk it over, the shame usually turns to frustration and annoyance. “I’ve been careful. I don’t surf to those sites and I don’t click on things that I shouldn’t. I don’t follow e-mail links that I don’t trust. I have anti-virus software. I’m doing everything right. Why did this happen?”

My next question is usually, “Do your kids use your computer?”

“Well, yes, but I’ve talked to them about being cautious as well, and they know about responsible web surfing…”

Doesn’t matter. The Internet is a minefield. New malicious sites pop up all the time, and there’s no practical way for the makers of anti-virus and parental control software to keep up with them all. You may never encounter such sites in your daily web routine, but that’s because the purveyors of malware are actively targeting topics that interest young people.

This article explains how the bad guys exploit web searches for top celebrity news, something that attracts mostly teens. Older folks like me, who couldn’t care less about Miley Cyrus’ latest antics and have never even heard of Lily Collins, may never encounter these traps.

But the pitfalls are still there and sometimes even we “mature” people stumble in. Once in a while I will do a web search for song lyrics. Mind you, any song I search for would have been recorded prior to 1986 (the year I graduated college and stopped paying attention to new music), but lyric sites attract all ages and are another frequent malware trap. Most any song lyric site you find will bombard you with pop-ups and malicious links. When your computer screen is going crazy like this, it’s easy to (even accidentally) click on something you shouldn’t. And before you know it, something has gotten into your browser and you have a problem.

Once a malicious program has installed itself on your system, it frequently opens the door for other malware. Think of it as a guy breaking into your house and then inviting his buddies over to eat all your food.

One of the issues I see most often is that malware has hijacked your browser’s search functions by replacing your default web search provider (such as Google or Bing) with another tool that captures information about your surfing patterns and web searches. This sort of information is valuable for marketing purposes. Sometimes these rogue search tools will change your browser’s home page, but often they are less obvious. Usually the first indication that you’ve been compromised is that you notice your PC running more slowly, especially when surfing the web. And as more bad programs are allowed into your system, performance continues to decline.

While this can be a significant annoyance, especially on older PCs that were never speed demons to begin with, there are malware removal tools that can deal with most of these problems with relative ease. But we are increasingly seeing instances of a more severe problem called ransomware, a malicious program that locks you out of your computer, displaying a warning message (frequently accusatory) and “helpful” instructions on how to send payment to disable the lock. This is, of course, extortion, and the authorities are going after these guys, but that doesn’t help you much if you’re currently a victim. Again, there are software tools that can remove ransomware, but the process tends to be tricky and time-consuming.

Unfortunately, there’s no surefire solution other than abandoning technology altogether and going off to live on a homestead with the Amish. Kids are always going to seek out the new and popular, and marketing is all about identifying predictable behaviors and exploiting them for profit. And there’s no reason kids shouldn’t be able to surf the Web for things that interest them — that’s what it’s there for. But if you’re wondering how on earth this stuff got all over your PC…mystery solved.

Wireless network security flaw found

I’ve written here before about the importance of properly securing your home wireless network. Now comes word that a potential security flaw exists on newer wireless routers even if they have been properly secured and administered.

The flaw is with a relatively new feature called Wi-fi Protected Setup, or WPS. This feature is used to simplify the process of connecting wireless clients by using a short PIN code to connect, instead of the normal shared key or passphrase.

Setting up a wireless network can be a complicated and tedious process, and obviously anything that simplifies this for home users is a good thing. However, a security researcher has discovered a design defect in the WPS protocol that makes it possible for an intruder to penetrate a wireless network using a brute force approach.

This article from c|net explains the whole issue, if you would like to read the details.

The flaw is reported to affect router hardware from Buffalo, D-Link, Cisco, Linksys, Netgear, Technicolor, TP-Link, and ZyXEL – pretty much all the major vendors. The recommended solution is to disable your router’s WPS function entirely. Different manufacturers have alternative names for WPS. Buffalo calls it AOSS, and Cisco/Linksys refers to it as SES.

WPS is only useful when you are actually connecting a new device. Otherwise, it’s unnecessary. But if your router is configured to leave WPS active all the time, it’s a very good idea to disable the feature. The likelihood of an attack is somewhat remote on a home network, but there’s no reason to leave an exploit like this open if it’s easily addressed.

Fake antivirus scams – what you need to know

I’ve seen a lot of these lately, affecting both clients and family members. Fake antivirus programs pop up and issue dire warnings, then trick you into clicking on them to repair your “infected” computer. That, of course, is when the real damage occurs.

I could ramble on regarding the details, but instead I’ll just refer you to this excellent article by Herb Weisbaum on msnbc.com.

How to avoid the nasty fake antivirus scam