Security Secrets – You must Know

Rogue scripts, fake antivirus programs, and infected PDFs: Defend yourself against the Web’s most insidious threats.

You already know the basics of internet security, right?

You know to keep your antivirus program and patches up to date, to be careful where you go on the Internet, and to exercise online street-smarts to resist being tricked into visiting a phishing site or downloading a Trojan horse.

But when you’ve got the basics covered, but you still don’t feel secure, what can you do? Here are a few advanced security tips to help you thwart some of today’s most common attacks.

Remember, however, that security is all about trade-offs. With most of these tips, what you gain in security, you lose in convenience. But hey, it’s your computer. Be as paranoid as you want to be.

Avoid Scripting

This may be the one piece of advice that will do most to keep you the safe on the Web: Steer clear of JavaScript, especially on sites you don’t trust.

JavaScript is very popular, and for good reason. It works in almost all browsers, and it makes the Web a lot more dynamic. But it also enables bad guys to trick your browser more easily into doing something that it shouldn’t. The deception could be something as simple as telling the browser to load an element from another Web page. Or it could involve something more complicated, like a cross-site scripting attack, which gives the attacker a way to impersonate the victim on a legitimate Web page.

JavaScipt attacks are everywhere. If you use Facebook, you may have seen one of the latest. Lately, scammers have set up illegitimate Facebook pages offering things like a free $500 gift card if you cut and paste some code into your browser’s address bar.

That code is JavaScript–and you should never add it to your browser. “Scammers use this technique to open up unwanted surveys, fill your social networking profiles with spam or even to send you to phishing pages,” says Chris Boyd, a security researcher with Sunbelt Software.

But miscreants can add JavaScript to hacked or malicious Web pages, too. To avoid attacks there, you can use a free Firefox plugin called NoScript that lets you control which Websites can and cannot run JavaScript in the browser. NoScript goes a long way toward preventing rogue antivirus programs or online attacks from popping up when you visit a new Website.

By blocking scripting everywhere and then using NoScript to build a whitelist of trusted sites, you can derail most of the so-called Web drive-by attacks that currently plague the Internet.

NoScript also comes with a cross-site scripting blocker. Cross-site scripting has been around for a while, but these days bad guys are using it more frequently than ever toseize control of online accounts on sites such as Facebook and YouTube.

If you don’t use Firefox, you still have some options for cracking down on scripting. Like Foxfire users, Google Chrome users can disable JavaScript universally and then build a whitelist of sites where it’s permitted.

Unfortunately, neither Internet Explorer nor Safari has a NoScript equivalent, but IE users can adjust their Internet Zones security settings to require prompts before scripting. And IE 8 includes new cross-site scripting protection to ward off some attacks.

Disabling JavaScript in Adobe Reader can help, too. According to Symantec, last year nearly half of all Web-based attacks were associated with malicious PDF files. If victims had adjusted their settings to make it impossible for PDFs to execute JavaScript, they would have thwarted most of those attacks.

To disable JavaScript in Reader, click Edit, Preferences, JavaScript and then uncheck the Enable Acrobat JavaScript box to the right of the window.

The downside of all these defensive tactics is inconvenience. With scripting disabled in your browser, many animations, movies, and dynamic Web pages simply won’t work–and many users get frustrated by the never-ending cycle of opening a Web page, seeing that it doesn’t work properly, and then choosing to allow scripting on that page.

The same holds true for Reader, where PDF-based forms may not submit properly if you’ve disabled JavaScript; nevertheless, many people don’t mind simply turning on Reader’s JavaScript whenever they need it.

Back Out of Rogue Antivirus Offers

Far too many people have had this experience recently: You’re surfing the Web on a totally legitimate site when a scary-looking warning message pops up suddenly. It tells you that your computer is infected. You try to get rid of it, but more windows keep popping up, urging you to scan your computer.