|
If you use public computers - like those at Kinkos,
airports, hotels, etc., then you need to read this story...
There's a guy in New York who may have
gotten into your personal business. If he did, he probably looted your
online bank account.
Juju Jiang is serving time now after
pleading guilty. But for a couple years, he bugged public computers at
Kinko's with software that logged keystrokes. He used it to capture
usernames and passwords. Some he used to steal money; others he sold on
the Web.
He got caught when he manipulated a
victim's home computer while she was present. She watched incredulously
as he methodically searched her computer. He was using GoToMyPC, which
allows travelers to manipulate their computers from afar. The victim had
used GoToMyPC previously from a Kinko's machine. Jiang stole her
username and password.
This raises an issue which many people
haven't considered. Spying software can easily be placed on public
computers, such as those not only at Kinko's stores, but in Internet
cafés, airports, libraries and other public places.
With spying software, a criminal can grab
your passwords and usernames. Ultimately, you could lose your money or
have your identity stolen. That should tell you enough to be wary of
public PC terminals.
Software is unobtrusive
Spies usually use software because it is
invisible to the untutored eye. Hardware to do virtually the same thing
also can be used, placing it between the keyboard and computer. But
using it is too obvious in a public place.
The software programs, however, can
unobtrusively make a record of a victim's every keystroke. The keystroke
loggers can then e-mail the collected information on a set schedule. It
also can be downloaded. Other software programs take screen shots of
places you go. These, too, send their collected information via e-mail.
As I said, the spying programs are
inconspicuous. Unless you know how to look for them, you'll never see
them. It's a good idea to check the computer for spy software before you
use it. I'll explain how to do that in a minute.
But keep in mind that there are other
threats besides spy programs. Trust me, this can be worse than using a
public toilet seat!
Here are five things to
consider when you sit down in front of a strange computer:
1. What is Spyware?
Spyware is software that may have
been slipped into your computer without your knowledge and through no
fault of your own - but there is something you CAN do about. Educate
yourself. Start here:
http://www.microsoft.com/athome/security/spyware/default.mspx and
for anti-spyware product info and more on the subject, these guys have a
lot of good advise:
http://www.spywareinfo.com/
2. Erase your tracks.
When you use an Internet browser, it
keeps records of where you went. When you finish surfing with Microsoft
Internet Explorer, click Tools > Internet Options. On the General tab,
click Delete Files and Delete Cookies. Then click Clear History.
If you're using Netscape Navigator, it's
a little more complicated. Follow these steps.
- Check the settings before going
online. Click Edit and Preferences. Click the arrow next to Navigator
and select History. On the right, find Browsing History. Change
"Remember visited pages" to 0.
- Click on the arrow next to Privacy and
Security. Select Disable Cookies and Disable Cookies in Mail and
Newsgroups.
- When you finish surfing, click Edit
and Preferences. Click the arrow next to Navigator. Click Clear
History and Clear Location Bar. Go to Privacy and Security on the left
side and click the arrow. Select Cookies. Click Manage Stored Cookies.
On the Stored Cookies tab, click Remove All Cookies.
- Now go to Advanced, in the left-hand
panel. Click the Arrow and click Cache. Click Clear Memory Cache and
Clear Disk Cache.
3. Protect your passwords.
Browsers also track passwords. Before
going on the Web, if you're using Internet Explorer, click Tools >
Internet Options. On the Content tab, click AutoComplete. Clear the four
boxes.
When you finish surfing, again click
Tools > Internet Options. Go to the Content tab and click AutoComplete.
Click Clear Forms and Clear Passwords.
If you're using Netscape, click Edit and
Preferences. Click the arrow next to Privacy and Security. Click
Passwords. Clear the box next to Remember Passwords. When you finish
browsing, click Passwords again, under Privacy and Security. Click
Manage Stored Passwords. Select the Passwords Saved tab and click Remove
All.
Netscape has a feature similar to
AutoComplete. It saves data entered into forms. To disable that, under
Privacy and Security, click Forms. Uncheck "Save form data from Web
pages when completing forms." When you finish browsing, return to the
Forms page. Click Manage Stored Form Data. Click Remove All Saved Data.
Cleaning out the browser will ensure that
no one can track your surfing or grab your passwords with saved data.
But a keystroke-logging program will still catch your passwords.
Some, but not all, key-logging programs
can be defeated if you copy and paste in the letters or numbers of your
password. For instance, say the page you have open in the browser has
lots of type on it. And say your password is jim (let's hope it's not
that simple!). Find a "j," an "i" and an "m" on the page. Copy and paste
them into the password box.
Probably the best password protection is
a temporary password. Use it while you're on the road, then discard it.
4. Don't rely on encryption.
There are a number of encryption packages
on the market. They can be used to encrypt e-mail. However, they encrypt
the mail when the Send button is clicked. That's too late if a
key-logging program is on the computer. It will make a record of the
password and message as it is being written.
5. Use some common sense.
Public computers may be secure. But you
really have no way of being sure. You can secure your home or business
computer, but you can't be certain of what has been done with a public
machine.
Approach these machines with care. Don't
do any banking or stock trading on them if you can avoid it. Avoid
credit-card transactions. Use a temporary password if you must check
your e-mail. And ask your system administrator how to "expire page
views."
If you're just surfing, that should not
be a problem. But avoid sensitive business if you can. There might be a
Juju Jiang watching.
Return to Index
|
