any firewall hints and trips?

[Mrious_be]

Hi People
Today, all with that MyDoom virus and clones going on, i tested my computer to see how much it is vulnarable for hacks and/or virusses.
I used the scanner from Symantec and it seems i came out pretty secured.
Only thing is, i was vulnerable for Trojan Horses.
I know i'm on a mac so all this pc-stuff doesn't really work here but still was thinking to activate a firewall.

I'll take the one build in here but i know i tried it like 2 years ago and it was really hard to set it up, and keep everything running as it should be (internet software).
Sooo.... does anybody has some hints and/or trick to follow?
What should i take in consideration to activate this firewall.
And how secure is it anyway?

Well... let's say, any help is welcome
Thx againnnnnnnnn people.

[kelly]

I think the built in should be easier to use now.

Are you on Dial-Up or Broadband?

[Mrious_be]

QUOTE(kelly @ Jan 31 2004, 4:46 PM)

Are you on Dial-Up or Broadband?

 Euhm... as the signature mentiones.... i'm on broadband  

Tomorrow i'll play with the built in firewall abit

Thanks.

[Epaminondas]

(1) << I used the scanner from Symantec and it seems i came out pretty secured.
Only thing is, i was vulnerable for Trojan Horses. >>

The Symantec scanner is very, very limited.

If you want a real Internet security check, you might try:

http://www.alken.nl/online-security-check.htm


(2) Firewalls

Various reviews indicate that a combination of a hardware firewall and a software firewall is better than either alone.  They are complementary.

This may seem like overkill - belt and suspenders - but the more one becomes aware of Internet security issues, the more careful one tends to become:  you are undergoing this process of digging deeper into these matters with your current exploration of the Symantec site and of firewalling.

Hardware firewall routers are pretty cheap insurance - you should be able to pick one up for around $10-$86 these days. They will steath, not just block, most of your ports - i.e., make you invisible on the Internet.  Stealth is good. They are not difficult to set up.

For software firewalls, NetBarrier tends to get better reviews than Norton, is cheaper, is easy to use with lotsa explanations, and you can try it out 30 days for free.  Even if you do not stick with it it will educate you as to issues that you can then put into practice on the included OS X firewall. They also have a version for MacOS 9.x.x  What's not to like?


(3) Other security issues:  

Remember that convenience and security tend to be inversely proportional. More secure = less convenient.  More convenient = less secure. That's just the way life is.  If your only goal is convenience then you will hate having to do the things necessary for security.  For example: a good random password is more effort to keep track of that just using a girlfriend's name - and less enjoyable - but a good random password is much more secure.

If you are concerned about security, you just make security a habit and it becomes routine.  It's no big deal.

There is no such thing as a "secure" computer connected to the Internet.  There is only "more secure" and "less secure."

Some security is better than no security, but -

Computer security is only as strong as the weakest link.


Other ditties for the security oriented:


(a)  Avoid Microsoft products if you have the slightest concern about security - particularly IE and Outlook.  The MyDoom virus is just another example of how seriously Microsoft takes security - it is only perpetuated on Windows machines.  

This is not a bug.  This is a "feature."

Avoid wireless products.  They are typically significantly less secure than wired products, even when security measures are put in place.

[c] Use random gibberish alpha-numeric passwords - with symbols and with random capitalizations - of eight or more characters.  Example: "9/jRg?8b)" is a good password. "Jennifer21" is not - though she may be a wonderful person. ;-)

(d) Generally one thinks in terms of running anti-viral/anti-trojan/anti-worm software and keeping it up to date.  I don't know if this applies yet to MacOS X - I will defer to others' wisdom in this matter.  Doesn't seem to apply to Linux at this point - I doubt that MacOS X is particularly vulnerable.

(e)  It is my understanding that it is not necessary to run Spyware-sniffing software on the Mac, as no Mac Spyware is currently known.  Spyware seems to be another Windows "feature."

(f) Do not leave your computer unattended on an always-on connection to the Internet.

(g) Never take candy from strangers.


Regards,

Epaminondas

[Diana]

Hey,

And my I add a couple of things to Epaminondas' most excellent suggestions...don't use that password he provided as an example because just the act of putting it in print raises the possiblilty that it will be added to "cracker" dictionaries...*grin...I know you say.."..never intended to"..but you would be surprised to know how many people will take examples and use them in the name of convenience..*grin..thinking they're getting something secure.

also, don't use a public computer and put in any passwords or userIDs that can be cached, logged by a keystroke logger, or sniffed over an unsecure line. People talk of the convenience of using web mail because they can check it from any computer. Well there ya go again..*grin...don't do it. If you must check mail while you're away, carry a laptop you control. If you MUST check mail on a public computer, make absolutely sure that the password you need for that operation is totally and radically different from any other password you use for _anything else_. If you've checked mail over a public computer, change your password as soon as possible when you get back to a computer you control. Use SSL, SSH2, APOP, AuthSMTP, as much as you can when passwords/ID are being passed from your browser/program (Email/FTP/Shell) to a remote computer.

If you carry a laptop, utilize _every_ security option you can think of. Use logon passwords, don't run using the administrator account..make sure your normal userID doesn't have admin authority, encrypt your file system if possible, and even install physical devices such as alarms that sound when moved. Use locking cables to secure the laptop to an unmovable object, use safes in motel rooms or carry the laptop with you whenever you leave. Don't allow anyone to "borrow" your laptop/computer and use your userID. If you must share, set up a separate user or guest account with _very_ limited permissions.

Investigate PGP/GnuPG for file encryption and file/email signing. Make a habit to sign emails you send. If someone sends an email as you by spoofing your address, you can at least head your defense by saying and showing a history of signing your emails. You can then say,.."If I didn't sign it, I didn't send it, even if it came from my computer" This requires yet another password, but if you get use to this philosophy, you will find it's not a bother and you'll just do it automatically. Signing an email also will give the receiver who understands the implications a measure of comfort that the  email wasn't tampered with after you sent it and before he received it.

http://gnupg.org/

I know that most of this is uninteresting to most people, but I'm now a crusader. This stuff is more important than people realize, and once they realize it personally, it may be too late. There are even big government forces that are making decisions that will effect every computer user. Learning what this is about is the only hope we have of retaining our freedoms and rights. Currently there is a push to ratify the Council of Europe Cybercrime Convention. This treaty, if signed, will give more power to the authorities than even the Patriot Act has done, the worst part being that it won't be our government only that is the authority. Other countries will have authority over US citizens on US soil.

OK..I'm done for now... You can label me paranoid, but I will continue to try to teach that personal security is worth the effort. When it becomes paramount, you'll be glad if you studied beforehand.

see ya,

[pendragon]

Epaminondas & Diana, Thanks so much for your counsel. Indeed it is sage advice.

A few years ago I worked with an NSA fellow whose job entailed breaking in to computers. The short version of this story is that every computer can be accessed--it's just a matter of how difficult you can make it. But to the casual hacker/script kiddie, you can make it so difficult that he/she will just go elsewhere. Also, never, ever put anything on your computer that if it were revealed, your life would be ruined. At least those were his words off wisdom.

Harv

[Mrious_be]

Wooow, that was a lot to read
But ok, i went through it, and actually...i could "quote" alot so i decided not, hehehe.

About passwords, i do use passwords that are as far away from my private life as possible (but still connected to me so i can remember them).

Appart from the XBox, i do not use any Microsoft software and i probably never will.

Never thought of having both software and hardware router, but the minute i'll go online with my XBox also, i probably  need to buy a router, so that's a good thing to take in consideration.
I like the suggestion of a "stealth" one, if it's save than i probably go for such one.
Pitty to say that in Belgium (Europe?) the hardware prices on such things are much higher than US

I did tried NetBarrier (2 i think) but my head was about to explode so i throwed it away after not being able to do certain things anymore).

Oh ow... no candy from strangers?

One thing i'm doubting now,
Let's say i activate the OsX firewall, than i can assume that all my ports are closed, except the ones i put open?
Or is that a wrong thing to think about it?

Thanks for all the great explanations everyone

[Mrious_be]

OsX Firewall is easy in use so that's good.
I just can't send pictures and little files anymore over iChat, i would like to keep this though, without having to deactivate firewall all the time.
Anybody know the port being used for that so i can make a "private" exeption for this?

Thanks

[kelly]

Found this M_B. Hope this doesn't make your head explode also.

iChat AV: How to Use With a Firewall or NAT Router

http://docs.info.apple.com/article.html?artnum=93208

[Mrious_be]

Wooow, that's it Kelly... gosh... amazing
My head is still on it's place so that will be ok

Thxxxxxxx

[Mrious_be]

A list of all ports and why they are used (on apple):

http://docs.info.apple.com/article.html?artnum=106439

[Epaminondas]

Mrious_be,

It's neat to watch your learning curve on this.

I am now learning about Macintosh ports from you.

<<I like the suggestion of a "stealth" one, if it's save than i probably go for such one.>>

Yeah - one firewall strategy is to be a stout well-protected wall with a few well-watched doors in it.

Of course - the bad guys just try to bang down the doors.  Or pick the locks.  Or dig under the wall.  Or climb over.  Or take the doors off their hinges.  Or blow a hole in the wall . . .

This is all automated.  Nuthin' personal.  Exposure is greatly increased on a cable connection.

So ya gotta keep an eye out. Such is life when you are a visible target.

Another strategy is to be completely invisible on the Internet so the bad guys do not even know you are there.  :-)

You might try the following sites for a few quick dirty tests of your Internet visibility/invisibility - for example, before and after opening up your firewall for iChat.  There are three levels - stealthed (invisible), blocked (visible target but the doors are locked for the moment), and open:

Shields Up

https://grc.com/x/ne.dll?bh0bkyd2

PC Flank

http://www.pcflank.com/

Note - quick scans are quick because they do not test all your vulnerable ports.  Some only test five or so and declare you "secure."  Better ones may test twenty or thirty.

But I think there are something like 60,000 ports:  a complete test of all of these takes overnight.

Probably worth doing.
_____________________________________________________________

Diana,

As to that password example, I never intended . . .

Sigh.

You are way ahead of me on security.  Towards where I hope to be within a few years.

Of course, by then you will be many more years ahead of me.

It never ends.

Do you know anything about encrypting whole hard drives - Linux, Mac, whatever?

That looks like a logical next step, here.

Are there any problems with speed or troubleshooting?  I.e., one hardware or software glitch and you lose everything?

Any idea where one might start learning about this?


Looking through the http://gnupg.org/ site you posted.  Learnin' . . .

Good stuff.


You mention a lot on local security in the context of the portable laptop.  Good stuff to learn. I run desktops and have been thinking more of remote security issues -  i.e., Internet - than local security.

A few thoughts on local security . . .

Anyone with physical access to a PC - Linux or Windows, anyway - can bypass a lot of the security measures by just inserting a boot floppy or boot CD and accessing the PC's hard drive from there.  This can be thwarted by going to your bios and setting your hard drive as the initial boot drive and/or disabling the floppy and CD as boot drives.  Of course, someone who knows this can just go to your bios and re-enable the floppy or CD as the initial boot drive.  So it is prudent to password protect your bios - these options are all available if you explore around your bios on a PC, typically by holding down the "delete" button on startup.  

If you need to re-access your floppy or CD as a boot drive, you just go back to the password-protected bios and re-enable.

Password protection of the bios has also been an issue on PCs in the context of viruses that can change the bios settings, kill the processor cooling fan and thereby kill the computer.  I don't know if any such Windows virus actually exists, but it is a comforting thought that if someone can think of it, someone else might actually be able to make it.  :-)

How does one adjust the "bios" on a Mac  - "Open Firmware?" - I dunno.  Perhaps there is no equivalent to the PC bios.  Any ideas?

Of course - if you do this strategy on a PC, the bad guy's next step would be to transfer your hard drive and read it off of another PC.  But that is a lot more work and is a lot more time consuming and conspicuous than accessing it via another boot floppy or CD.

So it is just one more step in security - not a complete solution.

How this works on laptops, I do not know.


Another likely next step here is removable hard drives - kinda like having great big fast reliable zip drives.  The gismo fits in a free 5" bay, with individual carriers for each hard drive.  With 80 GB WD hard drives occasionally on sale for $20-50, this is beginning to look financially feasible.  Just run one relatively insecure hard drive on the Internet, without your financials or business stuff on it.  When you want to do taxes and such, disconnect from the Internet and exchange the insecure hard dirve with the relatively secure one.  

Of course, ya gotta be careful.  One mistake and . . .

Oops!


Diana wrote:

<< You can label me paranoid, but I will continue to try to teach that personal security is worth the effort. When it becomes paramount, you'll be glad if you studied beforehand. >>

Is it paranoid to eat right and to get some exercise?  Or to not stay out in the sun too long?

Or is it just good judgment?

Is it paranoid to wear a seat belt?  

We thought it a little silly at first.  Now is is automatic.  Unconcious, really.  Can't really remember when we didn't.

Is it paranoid to drive carefully?

Is it paranoid to be careful on the Internet?

Or should it just be become another good habit?

___________________________________________________________

The pendragon wrote:

<< Also, never, ever put anything on your computer that if it were revealed, your life would be ruined. At least those were his words off wisdom. >>

Yup.

A variant is - expose no financial information on your computer you would not want open to the world.

If I ever do any Internet banking, it will be on a little bitty account in a separate bank.

No need to risk anything that I am not willing to completely lose.


The relatives gathered over Christmas, as relatives do.  One is a credit union officer who has a PC in the house, set up by the credit union for access to the credit union files from home.

He also lets the kids use it.

He was complaining that it was slowing down so he would need to get a new PC.  My brother and I looked at each other, rolled our eyes, and with his permission - we had at it.

Windows 98 - not SE - no maintanace in at least two years.  Diagnostics/repair, deleting 2000+ temporary files and defragmenting the hard drive took overnight and well into the next day.  No firewall. We could not find any antivirus software on it - "Yeah," he laughed "there isn't any."

He's got a great sense of humor.

We didn't have to ask for any passwords to fully access the guts of the OS - there weren't any

The kids had downloaded all sorts of stuff.

We tried to talk security with him but he was dismissive.  Computer security is for his credit union's IT staff to deal with, he told us  - that is what they are paid for - it is not his concern.  It was clearly a work culture issue - such concerns were beneath someone as important as himself.  IT people were like janitors to him - Administrators were the important fellas.

Hey - this is a smart guy.  Both a loving and a very intellectual family atmosphere - his kids have various academic honours.  The brains are there.  It's the attitude . . .

Are my brother and I paranoid?  Or is he imprudent and resistant to learning something he really ought to know?

Is he actually stupid?  Or is this an issue of the attitudes of the bureacratic financial services culture of which he is a part?

I will leave this as an exercise for the reader.

But if this is typical of financial services culture attitude in regards to computer security - and I submit that it probably is not an isolated attitude, particularly in view of some credit unions and banks now putting Microsoft OSs on their automatic teller machines  - I would prefer not to do my credit union/banking activities over the Internet.

And when I deal with the credit unions or banks, I always keep a paper record.


Regards,

Epaminondas

[Mayo]

What a great topic; I wish more people were hip to the need for greater security when it comes to their computers.

BrickHouse provides a GUI for accessing OS X's network firewall settings without having to use Terminal.app.  I haven't used it yet, so I can't recommend it, but I include the link since we're on the topic of firewalls...And using BrickHouse and OS X's built-in firewall is less expensive than purchasing NetBarrier.

After recently upgrading from OS 9 to Panther I faced the prospect of finding new software to replace PowerOnSoftware's excellent DiskLock, which provides driver-level volume protection and an easy-to-use encryption feature.  The driver-level password protection means it cannot be bypassed; as far as I know, the only option is to replace the drive.  I don't think that you can even start-up from a bootable utility CD and wipe the drive; someone correct me if I am wrong.  If you still use a pre-OS X Mac I highly recommend DiskLock.

A few weeks ago I stumbled upon SubRosaSoft. The company sells a variety of Mac (and some Windows) utilities, with many focusing on Mac security.

SubRosa offers CipherDisk which is a driver-level encryption program for OS X volumes.  Unlike DiskLock, CipherDisk cannot be used to protect the boot drive; SubRosa tech support told me that it has something to do with the open-firmware nature of OS X, if I remember correctly...  So CipherDisk is only good for protecting disks you don't plan on booting from, such as an external drive.

One neat thing that can be done with CipherDisk is password-protected encryption of an entire CD, which would be useful for people who use CDs to backup or transport sensitive data.

With that limitation in mind I opted for SubRosaSoft Encryptor, a $12.95 application that securely encrypts files and folders.  It comes in Mac and Windows flavors.  While in theory any encryption method can be cracked, practically-speaking I doubt that it can be done if you use the most secure options.  I have done a fair amount of reading on the subject and I have yet to find a single example of it actually being accomplished. It would take considerable computer muscle and time to crack the best encryption algorithms.

Maybe the U.S. government could do it, but I haven't found any reference to the Feds having this capability, such as successful prosecutions that used cracked encrypted files as evidence.  What I have read indicates that law enforcement is very concerned about criminals and terrorists using encryption technology, which is presumably the reason PGP was dogged for so long by the U.S. government.  Recently I read about a proposed or new law (can't remember which!) regarding penalities for having encrypted files on a computer that can be linked to a criminal enterprise.  Apparently the presumption is that if you have the need for encyrpted files and you are the subject of an investigation, then you must have something to hide.

Since most of us are only facing real-world threats to our computer security such as petty theft, a good encyrption program is going to be all we need to protect sensitive files from prying eyes. Web Confidential is an easy way to store all manner of passwords, credit card numbers, etc. on your Mac, Windows box or Palm PDA and encrypt it all.

I also use NetShred X to securely delete e-mail trash, history and cache files.  I got it mainly to digitally shred trashed e-mail in Eudora.  I have it start-up automatically when I boot my iBook and it does its thing a few seconds after I quit Eudora or Safari.

I also use ShredIt, which I upgraded when I moved to X and before I knew about the "Secure Empty Trash" option in Panther.

The key to using any of these programs is getting in the habit of taking the small amount of extra time required to actually protect your sensitive files.  I have adopted these steps into my normal computer workflow and the extra seconds I spend on the task is a small price to pay for Peace of Mind.

Have a Happy Sunday everyone!

 

[Diana]

Hey,

IAWM...I wish more people were concerned too.. I dearly hope their concern grows from curiosity, not necessity.

Thanks to Mayo for contributing to the topic.. Saves me from doing research through Google for Mac encryption software. It sounds like Mayo has some really good suggestions.

To Epaminondas..

The bad guys are light years ahead of me on this security stuff...that's what scares _me_. I hope the government keeps up, but doesn't stand in my way when I want to protect myself. There was a time when our government tried to outlaw encryption for individuals as Mayo alluded. GnuPG was an outgrowth of that to the extent that it is open source. PGP is not. PGP is "free" in some contexts for individual use, but with closed sources, no one is allowed to see how it works. GnuPG is open and anyone with knowhow can tear through the software and review it for holes, backdoors, inconsistences and outright errors. Nowing "how" something like encryption works doesn't mean it is then crackable. As long as the system that does the encrption is "honest", then knowing how it does it can't hurt. Not knowing means you have to trust the original creator and trust that no one tampers with the software even after the fact...(realize that copyright doesn't prevent the bad guys decompiling and screwing with the source)  If the bad guys did that with open source, it will be discovered sooner or later and odds are that not all copies are affected.

See, I believe that security and open source go hand-in-hand. Realize again that Open Source does _not_ equal free. One can program and leave the source open, copyright their work and sell it. Granted, it can still be "stolen", but so can closed source software..see statement above. So further to my recommendation that everyone should be learning this stuff, I also recommend that you choose the open source options for software every chance you get.

*grin..learn, then tell two friends who will tell two friends, who will tell two friends...progress will be made.

see ya

[Mayo]

Diana, does GnuPG work better and is it easier to use than PGP?  I had compatibility problems with PGP and I also found it somewhat difficult to grok how to use it...

The real downside is that I don't know anyone using PGP or a variant, and I think that sending unencrypted e-mail is akin to sending a postcard.  If e-mail encryption was built-in to e-mail apps it might make it easier for average computer users.