|
If you use public
computers - like those at Kinkos,
airports, hotels, etc., then you need to
read this story...
There's a
guy in New York who may have gotten into
your personal business. If he did, he
probably looted your online bank
account.
Juju
Jiang is serving time now after pleading
guilty. But for a couple years, he
bugged public computers at Kinko's with
software that logged keystrokes. He used
it to capture usernames and passwords.
Some he used to steal money; others he
sold on the Web.
He got
caught when he manipulated a victim's
home computer while she was present. She
watched incredulously as he methodically
searched her computer. He was using
GoToMyPC, which allows travelers to
manipulate their computers from afar.
The victim had used GoToMyPC previously
from a Kinko's machine. Jiang stole her
username and password.
This
raises an issue which many people
haven't considered. Spying software can
easily be placed on public computers,
such as those not only at Kinko's
stores, but in Internet cafés, airports,
libraries and other public places.
With
spying software, a criminal can grab
your passwords and usernames.
Ultimately, you could lose your money or
have your identity stolen. That should
tell you enough to be wary of public PC
terminals.
Software is unobtrusive
Spies
usually use software because it is
invisible to the untutored eye. Hardware
to do virtually the same thing also can
be used, placing it between the keyboard
and computer. But using it is too
obvious in a public place.
The
software programs, however, can
unobtrusively make a record of a
victim's every keystroke. The keystroke
loggers can then e-mail the collected
information on a set schedule. It also
can be downloaded. Other software
programs take screen shots of places you
go. These, too, send their collected
information via e-mail.
As I
said, the spying programs are
inconspicuous. Unless you know how to
look for them, you'll never see them.
It's a good idea to check the computer
for spy software before you use it. I'll
explain how to do that in a minute.
But keep
in mind that there are other threats
besides spy programs. Trust me, this can
be worse than using a public toilet
seat!
Here are five
things to consider when you sit down in
front of a strange computer:
1. What is
Spyware?
Spyware
is software that may have been slipped
into your computer without your
knowledge and through no fault of your
own - but there is something you CAN do
about. Educate yourself. Start here:
http://www.microsoft.com/athome/security/spyware/default.mspx
and for anti-spyware product info and
more on the subject, these guys have a
lot of good advise:
http://www.spywareinfo.com/
2. Erase your
tracks.
When you
use an Internet browser, it keeps
records of where you went. When you
finish surfing with Microsoft Internet
Explorer, click Tools > Internet
Options. On the General tab, click
Delete Files and Delete Cookies. Then
click Clear History.
If you're
using Netscape Navigator, it's a little
more complicated. Follow these steps.
-
Check the settings
before going online.
Click Edit and
Preferences. Click the
arrow next to Navigator
and select History. On
the right, find Browsing
History. Change
"Remember visited pages"
to 0.
-
Click on the arrow next
to Privacy and Security.
Select Disable Cookies
and Disable Cookies in
Mail and Newsgroups.
-
When you finish surfing,
click Edit and
Preferences. Click the
arrow next to Navigator.
Click Clear History and
Clear Location Bar. Go
to Privacy and Security
on the left side and
click the arrow. Select
Cookies. Click Manage
Stored Cookies. On the
Stored Cookies tab,
click Remove All
Cookies.
-
Now go to Advanced, in
the left-hand panel.
Click the Arrow and
click Cache. Click Clear
Memory Cache and Clear
Disk Cache.
3. Protect your
passwords.
Browsers
also track passwords. Before going on
the Web, if you're using Internet
Explorer, click Tools > Internet
Options. On the Content tab, click
AutoComplete. Clear the four boxes.
When you
finish surfing, again click Tools >
Internet Options. Go to the Content tab
and click AutoComplete. Click Clear
Forms and Clear Passwords.
If you're
using Netscape, click Edit and
Preferences. Click the arrow next to
Privacy and Security. Click Passwords.
Clear the box next to Remember
Passwords. When you finish browsing,
click Passwords again, under Privacy and
Security. Click Manage Stored Passwords.
Select the Passwords Saved tab and click
Remove All.
Netscape
has a feature similar to AutoComplete.
It saves data entered into forms. To
disable that, under Privacy and
Security, click Forms. Uncheck "Save
form data from Web pages when completing
forms." When you finish browsing, return
to the Forms page. Click Manage Stored
Form Data. Click Remove All Saved Data.
Cleaning
out the browser will ensure that no one
can track your surfing or grab your
passwords with saved data. But a
keystroke-logging program will still
catch your passwords.
Some, but
not all, key-logging programs can be
defeated if you copy and paste in the
letters or numbers of your password. For
instance, say the page you have open in
the browser has lots of type on it. And
say your password is jim (let's hope
it's not that simple!). Find a "j," an "i"
and an "m" on the page. Copy and paste
them into the password box.
Probably
the best password protection is a
temporary password. Use it while you're
on the road, then discard it.
4. Don't rely
on encryption.
There are
a number of encryption packages on the
market. They can be used to encrypt
e-mail. However, they encrypt the mail
when the Send button is clicked. That's
too late if a key-logging program is on
the computer. It will make a record of
the password and message as it is being
written.
5. Use some
common sense.
Public
computers may be secure. But you really
have no way of being sure. You can
secure your home or business computer,
but you can't be certain of what has
been done with a public machine.
Approach
these machines with care. Don't do any
banking or stock trading on them if you
can avoid it. Avoid credit-card
transactions. Use a temporary password
if you must check your e-mail. And ask
your system administrator how to "expire
page views."
If you're
just surfing, that should not be a
problem. But avoid sensitive business if
you can. There might be a Juju Jiang
watching.
Return to Index
|
