Tips for Avoiding Computer Crime
Copyright 1999-2000, 2002, 2004, 2012 by Ronald B. Standler
Table of Contents
2. Anti-Virus Software
attachments in e-mail
4. Avoiding Harassment and Phishing
6. Other techniques
Disabling Features in Microsoft Windows
7. Wireless Networks
8. Links to other sites
These suggestions are a companion to my separate essay on
computer crime in the USA.
These suggestions are like installing high-security deadbolt locks
on doors of an office or home.
There is no warranty that following these suggestions will prevent
one from being a victim of computer crime, but at least one can make it
a little harder for a criminal,
and maybe the criminal will find an easier target.
This essay contains only my personal opinions on the general problem
of computer security,
and is not intended as advice on your specific problem.
You should hire a competent expert in computer security to review
your situation and then advise you.
To access an online computer service or Internet service provider (ISP)
one needs both a user name and password.
ISPs typically select a user name that
is the same as the last name of the subscriber. This means that
user names are easy to guess, therefore one must be especially
careful with the password.
Select a good password:
- Make the length of your password at least five characters.
It is too easy for automatic programs to sequentially try
all combinations of characters in a password of
only 1, 2, 3, or 4 characters.
- In short passwords,
use at least one upper-case letter, at least one lower-case letter,
and at least one digit, for example, c5U3rN
A five-character password composed of only random lower-case letters has
about 8×106 possible combinations,
but a five-character password composed of both upper- and lower-case
letters and the ten digits, all chosen randomly, has about 776×106
possible combinations, i.e., about one hundred times harder to guess.
- To make a long password, use a concatenation of two unrelated words,
each with at least five characters, perhaps separated by at least one digit
(e.g., airplane5style). By having a longer password,
it is no longer as desirable to include a mix of upper- and
- Avoid obvious passwords e.g.,
Also avoid any of the above spelled backwards, and any of the
above either preceded or followed by a single digit.
- your name,
- anyone's first name (especially bad are your spouse's first name,
your child's first name, your dog's or cat's name)
- your nickname (e.g., "Flash" or "Buzz"),
- your home telephone number,
- your date of birth,
- your astrological sign,
- your mother's maiden name,
- your wife's maiden name,
- license plate number of your car,
- exact sequences of letters on a keyboard (e.g., QWERTY or ASDFGH)
- sequences from the alphabet (e.g., ABCDEFG or ABCABC)
- or any other publicly available information.
- There are about 8×106 possible combinations
of a string of five lower-case letters that are chosen randomly.
In comparison, there are only
about 0.15×106 entries in an English dictionary for
college students' desks. Therefore, it would make sense for
a hacker to use a word list from a spelling checker, instead
of generating permutations of characters. In response, you should
make the hacker work harder by choosing a password that is not
in the dictionary of your local language.
For a given number of characters, the strongest password
is a random sequence of lower- and upper-case
letters and digits.
However, such a password can be difficult to remember.
My suggestion is to choose a unusual foreign word that does not appear in
the dictionary of your local language. If you are tempted to use
foreign characters (e.g., ö, é) in the password
on a computer in the USA, first ask the system operator if
those characters are allowed in a valid password on the system,
as most operating systems in the USA are limited to using only the
first 128 characters in the ASCII set (i.e., no foreign characters).
Of course, you don't need to limit yourself to official languages.
<grin> You can invent your own words, e.g.,
garkle6snerkle. Such words are much easier to remember than
unpronounceable clusters of characters, e.g., c5U3rN.
Having chosen a good password, do not write it down, and
do not tell anyone what it is. (Get a separate account for
your spouse, each of your children, each of your co-workers, ....
so that no one shares passwords.) This rule can create a problem
if you die or are incapacitated, so perhaps you should write it down
once: on a sheet of paper that you keep in a bank's safe deposit box
(for your personal account) or in a safe in the corporate office
(for the company's computer).
When you get a new computer account, it will come with an initial
password, which password was probably randomly chosen.
Follow the instructions from the system administrator for choosing
your own password, and change the password.
The initial password may have been seen by someone who gave
or mailed it to you.
Use a different password at each website, service provider,
or computer account.
Changing your password every few weeks is standard advice from
computer security experts. However, changing
your password every few weeks also makes it easier for you to forget
your password. You need to decide if it is worth the bother of
changing passwords every few weeks.
If you do forget your password, you will need to contact a system
administrator, prove that you really are the official user, and get
a new initial password assigned.
Many users store their user name and password in a logon script
on their hard disk in various programs: e-mail (e.g., Eudora),
webbrowser (e.g., Netscape), terminal emulator (e.g., Procomm),
and modem control programs (e.g., Trumpet Winsock).
This storage of user name and password is convenient,
as it automates the logon process. However,
if you store your user name and passwords in logon script(s), then:
- You should definitely enable the password setting in the
BIOS of your computer, so that a password is required every time
the machine is switched on. You might also enable a password
setting in Windows98 or other operating system, to give an additional
layer of protection against unauthorized use of your computer.
- If other people have access to your computer when your machine is running
and you are away from your desk,
you should install screen saver software that requires a password
to return to the operating system or applications software.
- If your computer is stolen, it is possible for the thief to logon to all
of your accounts.
Therefore, it is essential that you logon to each
of your online accounts and change the password
for each account immediately after the theft of the
computer is discovered.
This remediation includes changing your passwords at online stores (e.g.,
amazon.com). The information stored on your computer in the
cookies.txt file that your webbrowser accesses identifies
you to each online store, and could make it possible for a thief
to impersonate you and to charge items to your credit card.
Nearly everyone has private data (e.g., medical and financial data
on a home computer; business secrets on a computer in the office) on
their machine. The same suggestions about a password in BIOS and
a password in a screen saver apply if you have confidential or
proprietary information on your computer. However, unlike changing
online account passwords, there is no easy way to destroy the value
of confidential data in files on a stolen computer.
Users with very sensitive data (e.g., military secrets, major trade
secrets) should encrypt all of their data files.
2. Anti-Virus Software
In the 1980s, computer viruses were generally passed from one user
to another user via floppy disks. Hence, users in the 1980s did not
need anti-virus software if they both (1) only purchased software
from reputable sources and (2) never copied programs from floppy disks
provided by their friends and colleagues.
Three developments in the 1990s made anti-virus software essential for
all computer users:
Since everyone uses e-mail and nearly everyone will download executable
software from the Internet, everyone should have a good anti-virus program
running on their machine.
- It became common to distribute software and updates
via downloads from the Internet,
- hackers developed viruses that were delivered inside macros for
Microsoft Word, which malicious macros could be hidden
inside a document sent by e-mail, and
- hackers developed malicious computer programs that were commonly
distributed as attachments to e-mail: clicking on the attachment
executed the malicious computer program and infected the victim's
Because an anti-virus program will likely object to the installation of
any new software, the user should disable anti-virus program before installing
new software. Of course, before temporarily disabling the
use the anti-virus program to scan the distribution files (e.g., CD-ROM,
floppy disk, or *.exe file downloaded from the Internet) for viruses.
Do not forget to enable the anti-virus software after you install new
It is not adequate to purchase anti-virus software with a new
computer, install the anti-virus software, and forget about that software.
The virus definition file for the anti-virus software should be
updated periodically, because new viruses are discovered every day.
How often you should update your virus definition file is a complicated
question: the answer depends upon your tolerance for risk,
how you use your computer (i.e., receiving e-mail or downloading
software from bulletin boards is risky),
and which operating system you use.
Of course, when there is an epidemic of a new virus reported in
the news media (particularly a virus spread by attachments in e-mail),
it would be wise to update your virus definition files
as soon as the developer of your anti-virus software revises their virus
definition files to recognize the new virus, and daily thereafter until
variants (copycats) of the new virus stop appearing.
- If your computer runs a 32-bit Microsoft Windows operating system
(e.g., Windows 95 or later), then I suggest that you update your
virus definition files at least once every day.
- If your computer runs an Apple operating system or Linux, then
I suggest that you update your virus definition files at least
once every month.
I have seen estimates that, as of the year 2001, there are
only about 80 known viruses or worms that are specific to the Macintosh operating system.
(Compare this to more than 61000 viruses and worms for Microsoft Windows
known in May 2002.)
An exact number of viruses and worms is not possible,
because of uncertainty about how to count variants of a virus or worm.
As a consequence of this relatively small number of viruses for the Apple,
it is probably adequate to update the anti-virus definitions
for anti-virus software on an Apple computer every month.
This suggestion is in contrast to advice for users of
the Microsoft Windows operating systems, where daily updates of anti-virus definitions are prudent.
Owners of an Apple computer who also use Microsoft Word wordprocessing
software (versions Word6 and higher) are vulnerable to macro viruses
that use Visual Basic for Applications, which also affect computers
running a Microsoft Windows operating system.
attachments in e-mail
As a virus, worm, or other malicious program can be transmitted via
an attachment to e-mail, one should rigorously follow three rules:
- Never open an executable attachment
(e.g., an attachment with a file name ending in .exe or
.vbs, amongst many other types)
in e-mail without first knowing the contents and source of this
file. There is no harm done in waiting a few hours or a few days
to contact the person who sent the e-mail and learn the contents and
source of the attachment.
The Melissa and ILOVEYOU incidents, on March 1999 and May 2000,
emphasize that you can receive
malicious programs from a person who you know and trust, since that
person could be a victim of a malicious program that automatically
sent e-mail in his/her name.
- Never open any attachment from an unknown source.
Simply reply to the e-mail and request that the sender send the
attachment as plain ASCII text in the body of the e-mail.
Or, if the e-mail is obviously junk,
delete both the e-mail and the attachment.
- Be cautious of any attachment that has a double file extension,
especially when the rightmost file extension is an executable file type.
(A file extension is a three-letter code at the end of
a filename [e.g., .htm, .doc, .exe,
.txt, etc.], that indicates the type of file.)
Examples of dangerous double file extensions are:
where "filename" can be any sequence of letters and numbers.
Files with such dangerous double file extensions are executable programs
(perhaps malicious programs) that are pretending to be a picture,
a document, text, or a webpage.
This list of dangerous double file extensions is not complete,
because there are many different permutations of a nonexecutable
file extension on the left with an executable file extension on the right,
and because there are more than sixty executable file extensions in
Note: the text of e-mail containing malicious programs
often contains ungrammatical text,
punctuation errors, or misspelled words,
because the author is a non-native speaker of English.
Such mistakes in English text in an e-mail apparently from a native speaker
of English should alert the reader to the possibility of e-mail
from a forged address, which may contain a malicious program.
It is good practice to erect a "firewall" between parts of a computer system
that an external user can access
(e.g., via modem or Internet or voice mail)
and parts that are supposedly accessible only by a local user.
Many hackers run programs that randomly search the Internet and
probe ports on computers that are connected to the Internet.
If the hacker finds a port that is "open",
the hacker might be able to access that computer and view/alter/delete
files on that computer. Worse, hackers may also hijack the victim's
computer and use it to launch their illegal attacks on other computers.
Some hackers randomly search the Internet, probing ports controlled by
a malicious program called SubSeven. When the hacker finds a
computer that contains SubSeven and is not protected by a firewall,
the hacker can access the victim's computer through the backdoor
provided by SubSeven. The SubSeven program was first detected
in June 1999, and there are many similar programs in existence,
for example, the Back Orifice program that was
first detected in August 1998.
When I first installed firewall software on my computer that I use only
for e-mail and webbrowsing, just 14 minutes later,
someone in Atlanta, Georgia tried to probe the FTP port on my
computer in Concord, NH.
During 21 hours of my use of the Internet
at the end of February 2002, there was an average of approximately
1½ attempts/hour to probe a port on my computer.
That statistic convinced me that firewall
software is prudent on every computer connected to the Internet.
In March 2004, there was an average of 57 attempts/hour to probe
a port on my computer. This dramatic increase in the number of attempts per hour
to access my computer shows that the Internet is becoming a more dangerous
place and that firewall software is necessary for a secure computer.
Now that computers are relatively inexpensive (e.g., less than US$ 1000),
I believe that it also makes sense to have totally separate and isolated
machines for external access.
The cost of having a separate computer that is dedicated solely to
receiving incoming modem connections and requests from the Internet
(i.e., e-mail and webbrower software)
is offset by the increase in security with minimum inconvenience to
authorized users inside the building.
When a secure computer and a computer for external access
are in the same building, communications between them
should be via floppy disk or rewritable compact disk,
not via wire or cable.
For example, this document that you are reading was obtained via the
Internet from a computer in Pittsburgh, which provides webhosting
service, for which I pay a monthly fee.
I wrote this file, and the current archive version resides,
on a computer in my office, which is 750 km from Pittsburgh.
Whenever I make a revision to one of my essays, I upload a
new copy from my office computer to the webhosting computer
in Pittsburgh via file transfer protocol (FTP) on the Internet.
Here are some hints about how to make a computer secure from
- Set terminal emulator software so that the modem either
- never answers an incoming telephone call or
- answers on the 99th ring and
also connect a telephone answering machine to the modem's line to
pick up on the fourth ring, so there is never a 99th ring.
- Do not install any software that allows even an authorized user
to access the computer remotely, via a modem.
more important to have firewall on computers
During the 1980s and early 1990s, communications between computers in
different places were made by an analog modem that connected to an ordinary
voice-grade telephone line. The state-of-the-art analog modem in 1998
(i.e., using the V.90 standard) could download data at
56000 bits/second and upload data at 36000 bits/second.
With compression (i.e., using the V.42bis standard), effective download
data rates of more than 120000 bits/second were possible on
an ordinary voice-grade telephone line.
Each time the user wanted to connect to the Internet, the user
would need to have the computer's modem dial the local access
number of the Internet Service Provider (ISP) and establish
a connection, a process that takes about 30 seconds.
The ISP then assigns the user a numeric IP address for that one
Internet session. This IP address is known as a "dynamic IP address",
because it is different for each session.
If the user does not send/receive some data over the Internet
during some period of time (e.g., ten minutes), the
ISP will automatically disconnect from the telephone line and
sever the user's connection to the Internet.
with wideband Internet connection
Beginning in the late 1990s,
it became common to connect computers to the Internet via
cable television lines or on DSL telephone service, which have
a much higher download data rate, so-called "wideband" service.
The cable or DSL service is always connected to the Internet,
unlike the modem on an ordinary voice-grade telephone line.
Specifically, the ISP assigns the user an IP address
that is either constant or rarely changed, a so-called "static IP address".
Cable or DSL makes a user more vulnerable to intrusions by hackers
in two different ways:
For these reasons, firewall software is more essential if one uses
either cable television or DSL for an Internet connection.
- The static IP address allows a hacker to return to the victim's computer,
once the hacker has found that victim's computer has no firewall or an
- If a computer is on all the time, hackers have continuous
access to that computer, since cable or DSL is always connected
to the Internet.
4. Avoiding harassment
For casual on-line activities, you can establish a free e-mail account
at Yahoo, HotMail, or some other provider, and use an alias for that
account. If someone harasses or stalks you, then you simply
close that account and chose another alias. In other words,
you adopt a disposable identity for your life in cyberspace.
Never give out your real name, address, city, telephone number,
or other identifying information to a stranger in a chat room,
computer bulletin board, or other public place.
Obviously, this simple solution has disadvantages.
I use the Internet to post essays and I hope
attract clients who need my services as an attorney or scientific consultant.
I wouldn't get many clients if I used an alias like "CyberRocket"
or "Wolverine" at my website. <grin>
The only connection between phishing and computers is that modern
phishing uses e-mail and a bogus website to get a gullible person
to disclose personal financial information to criminals.
That having been said, it is worthwhile to alert people to the
existence of phishing.
People first encounter phishing when they receive a fraudulent e-mail
that typically purports to be from a bank, credit card company, or
other financial institution. The e-mail might mention something about
your account is suspended until you "verify",
"update", or "validate" some information.
The e-mail invites you to click on a link in the e-mail.
The link typically takes you to a webserver
located in a foreign country and operated by criminals, who display
webpages with the logo and trademarks of
a bank, credit card company, or government agency, which makes the
webpage appear legitimate. (It is trivial for people familiar
with HTML and webbrowsers to download some webpages from a legitimate
financial institution, make some changes to the text,
then upload those bogus webpages to a criminal's webserver.
The bogus webpages really do appear legitimate because much of each bogus webpage
is an exact copy of the real institution's webpage.)
The bogus webpage asks you to supply your account numbers,
passwords, and other personal information (e.g., Social Security number,
date of birth, mother's maiden name) that can be used to fraudulently access
your financial accounts and perpetrate identity theft crimes.
Citibank has been a popular target for phishers. In response,
Citibank posted a
on some specific phishing e-mails.
The U.S. Federal Trade Commission (FTC) also has a consumer
on the subject of phishing. There is also an industry
antiphishing working group.
If a computer virus or an invading hacker deletes your files,
or either one corrupts your files,
the easiest way to restore your computer may be to reformat the hard drive(s)
and then copy files from a recent backup.
Backups also offer protection from more common (and less exotic) threats
such as accidental deletion of a file by an authorized user or
failure of a hard disk drive.
Because making a backup is a chore that takes anywhere from a few
minutes to more than an hour (depending on the amount of files
copied to the backup medium and the speed of the backup device),
and because backup copies are rarely needed, most users do not
make backups as frequently as they should.
The interval between backups should be determined by the amount
of data files that you can afford to lose.
One should carefully choose a backup medium that will be readable ten or twenty
years in the future. For example, in the mid-1980s,
a common backup medium was either 5¼ inch floppy disks or
— less commonly — a tape cartridge.
Floppy disk drives for 5¼ inch floppy disks became obsolete
in the early 1990s. The Windows98 operating system, and subsequent Microsoft
operating systems, have no support for such floppy disks.
There are many different kinds of tape cartridges and different
formats for each of them. If one purchased a tape drive in 1991, and
that computer and tape drive were destroyed in 1998, there is no assurance
that one can find a compatible tape drive in 1998 or 1999 that will read one's
Since the year 2000, I have used backups to CD-R, and more recently to DVD-R,
optical disks. For archival backups, I use recording speeds of 2X or 4X,
and high-quality disks (e.g. Imation "Business Select" or
JVC/Taiyo Yuden Archival Grade DVD-R with Hard Coat).
There are a number of other methods for making
backups that are mentioned in instruction manuals for backup devices
or backup software, or in comprehensive computer user manuals
sold at bookstores.
For users with large numbers of files,
or with backups to media with a small capacity,
it is useful to make three kinds of backups:
- A full backup of all files at least twice each year,
and immediately after completing a major project (e.g., writing a book).
- An incremental backup of only those files that were changed since
the previous incremental backup.
After I make a full backup, I reformat the disk that I use for
- An archival backup: a full backup of all files to
newly formatted virgin media. Activate the write-protect feature
on this disk or tape cartridge and never write to it again.
Use a permanent marker to label this archival medium with
the date of the backup and name of the computer.
However, most users can simply do a full backup of all of their data files
(e.g., wordprocessing documents, e-mail, downloaded documents, photographs, etc.)
once or twice a month.
If the only threat was a computer virus or attack by a hacker,
it would be adequate to store all of the backup media in the
same room as the computer. Because there are also threats of
fire, burglar, tornado, etc., one should also make a backup for offsite storage,
such as in the safe deposit box at a bank.
Archival backups are particularly well suited to offsite storage,
since they are rarely needed.
Most backup strategies involve reusing the media that are used for
full and incremental backups in some kind of rotating scheme.
Suppose some problem (e.g., corruption
of file by a computer virus or malfunction of hardware or software)
occurs with old, infrequently used data or document files.
One might not detect the damage to these files until after copies of
recently corrupted files had replaced all of the earlier copies of
good files on the rotating backup media.
That is why archival backups are necessary:
one can then restore files from an archival backup medium that was
recorded several years ago, prior to any damage.
The cost of backup media is so low (e.g., typically less than US$ 0.75
for one recordable CD or DVD) compared to the
value of the data, that it is reckless behavior not to make an
archival backup several times each year.
6. Other techniques
Because Microsoft bundles an e-mail program, Microsoft Outlook Express,
with their operating system, this e-mail program is commonly used.
Hackers write malicious programs
(e.g., the Melissa virus that struck on 26 March 1999)
to use the victim's e-mail address book in Microsoft Outlook,
knowing that such a malicious program will cause
havoc on most personal computers, because of the popularity of Outlook.
Similarly, hackers have written macro viruses that affect
the Microsoft Word wordprocessing program.
One can avoid being a victim of many malicious programs simply by
refusing to use any Microsoft applications software, but
instead installing software from other companies
(e.g., Eudora for e-mail, WordPerfect for wordprocessing).
Avoiding Microsoft applications software makes
sense, because of both features of Microsoft products and
the immense popularity of Microsoft's applications software, which
makes Microsoft's application software a tempting target for
hackers who design malicious programs.
Prof. Dorothy Denning, an expert on computer security
at Georgetown University, agrees that avoiding using Microsoft applications
software provides some immunity from malicious programs and she
personally follows that practice.
Despite the known vulnerability of Microsoft Outlook to attacks
like the Melissa virus that struck on 26 March 1999
and the ILOVEYOU worm that struck on 4 May 2000,
Microsoft waited until 16 May 2000 before beginning to release
a patch to their Outlook program that fixed some defects in security.
While it is possible to write malicious programs to attack
users of the Apple Macintosh operating system,
only about 5% of desktop computers run the Apple Macintosh operating system,
which small market share discourages hackers.
In the Windows98 operating system, the default location for
most applications programs is a subdirectory inside
A hacker designing a malicious program to use a victim's e-mail address book
or document files could simply assume that the victim used the default
location for these files. One might frustrate such hackers by installing
applications programs in a nonstandard location, for example,
put WordPerfect in D:/wordproc and put
Eudora in D:/mailprgm.
(An additional benefit of partitioning a disk drive into
C: D: E: before installing the Windows operating system
is that one can put the operating system on the C: drive,
all applications software on the D: drive, and all data files
(including the disk cache for the Netscape browser) on the E: drive.
One can make daily backups of the E: drive, because files change or are added
to the E: drive every day that the computer is used,
and less frequent backups of the C: and D: drives.)
Declare your computer and software on your homeowner's or
business property insurance policy.
Use the latest version of e-mail and Internet browser software,
operating system, and anti-virus software. Install the patches
that are released between versions, to avoid security holes and other
Before disposing of an old computer, by donation or sale:
- delete all data and document files.
- delete all application programs (to avoid software piracy).
- run WIPEINFO, in Norton Utility for DOS version 8
(or the corresponding version for the Apple Macintosh),
to overwrite all of the free space on the hard disk,
thus making it difficult to recover your data and document files.
WIPEINFO is necessary, because the delete command only changes the first
character of the file name in the file allocation table (FAT) on the disk; the
delete command does not remove the information in the file
from the disk.
If you are tossing an old computer or hard disk drive in the trash,
first disable the hard disk drive. You can use a hammer and chisel
to remove some of the integrated circuits from the disk controller
that is attached to the hard drive, or you can remove the hard drive
from the computer and smash it with a hammer.
The design of a logon screen should include a notice that
unauthorized use is prohibited by law.
One might refer to the state (or federal) statute and
mention the maximum penalties, in an attempt to deter people.
On the other hand, making the notice too strong
(i.e., reference to secret, proprietary, or private information
inside the computer) may be a double-edged sword,
in that it may entice a hacker by increasing the thrill.
Disabling Features in Microsoft Windows
Some optional parts of the Microsoft Windows 95, and later, operating systems
make a computer vulnerable to harm by malicious programs.
For detailed instructions on how to disable some of these parts, see:
There are two separate issues:
- The Computer Emergency Response Team
at Carnegie-Mellon University has links to their webpages on
showing normally hidden file extensions,
and disabling ActiveX.
an anti-virus software company in Finland, has instructions for
how to uninstall Windows Scripting Host
in Windows 95, 98, 2000 and NT.
This uninstall provides immunity from any malicious program that uses Microsoft
Visual Basic Script, such as the ILOVEYOU worm.
Symantec, who distributes Norton Anti-Virus software,
has similar instructions: go to their
search webpage, and
enter the search query "uninstall Windows Scripting Host".
I have never used any Microsoft applications software.
And, in May 2002, with the above two points in mind, I abandoned
the Microsoft Windows operating system too.
Instead, I now use an Apple computer for my websurfing and e-mail.
- There have been an alarming number of security flaws in both
Microsoft Windows operating systems and
Microsoft applications software (e.g., Internet Explorer web browser,
Outlook e-mail program),
as well as macro viruses for Microsoft Word.
- Prof. Fred Schneider in the Computer Science Department at Cornell University
of a "monoculture". When nearly
everyone uses the same operating system and same applications,
then nearly everyone is vulnerable to the same viruses and worms,
which makes these viruses and worms propagate more rapidly.
A monoculture exacerbates security vulnerabilities in software,
as well as stifles competition (i.e., the usual economic arguments
7. Wireless Networks
A local area network is popular in businesses, because it
allows computers to share files without using a modem
and because it allows multiple computers to use a single printer.
Conventional local area networks in the 1980s required
coaxial cable to be strung between computers and printers on the network.
Recently, it has become popular to use a so-called "wireless network",
in which computers and peripherals communicate via low-power radio
However, wireless networks have an obvious security problem.
Radio transmissions do not magically stop at the exterior
walls of the building. Anyone with an antenna and amplifier
can intercept communications on a wireless network,
which raises the possibility of both privacy violations and
industrial espionage. It is easy to imagine someone sitting
in a van in a parking lot with a high-gain Yagi antenna and
a laptop computer, intercepting communications from a
wireless network inside a nearby building.
If you want to use a wireless network, at least:
Personally, I refuse to use wireless networks, as I don't want
to risk my clients' confidential data on such networks.
- enable encryption on all transmissions and
- locate the transmitters as far as possible from exterior walls,
and especially far from windows.
In the year 2002, a new kind of malicious computer program appeared, which is
automatically installed when one visits certain websites (e.g., file-sharing
services), click on some pop-up adverts, or click on some attachments in e-mail.
The more benign spyware programs track the websites that you visit and
send you adverts that are considered appropriate for your interests, which
is an invasion of your privacy.
The worst of the spyware programs record your keystrokes, particularly
looking for your passwords, user names, credit card numbers, and
other confidential information. Your information is then available to
whoever controls the spyware.
There are many computer programs that are designed to search your computer
and remove spyware. Unfortunately, reviews in computer magazines show that
none of these anti-spyware programs are successful in removing all
A better way to avoid spyware is simply to chose an operating system that
is not 32-bit Windows
(i.e., avoid Microsoft Windows 95/98/NT/Me/2000/XP/...).
8. Links to Other Sites
I have moved the links that were formerly here to a separate
I no longer provide links to sources of anti-virus software, firewall software, and spyblocker
software for the Microsoft Windows operating systems.
Every computer that is connected (even temporarily) to the Internet should
have both current anti-virus software and firewall software installed.
Nearly all computer viruses, worms, and spyware target operating systems in
32-bit Windows family (e.g., Microsoft Windows 95/98/NT/Me/2000/XP/...).
Choosing an operating system that is not 32-bit Windows
gives immunity from most of these viruses and worms.
I have moved the links for anti-virus software and firewall software
for the Apple computer to a webpage at my personal website:
After you install a firewall, you will probably be curious about
who is probing the ports on your computer.
You can type either the numeric IP address or the domain name
into one of the WhoIs databases.
Dorothy E. Denning, Information Warfare and Security,
Addison-Wesley Publishing Co., 1998.
Dorothy E. Denning and Peter J. Denning, Internet Besieged,
Addison-Wesley Publishing Co., 1997.
Peter J. Denning (editor), Computers Under Attack,
Addison-Wesley Publishing Co., 1990.
A collection of reprinted articles from computer software journals,
mostly from the 1980s.
Peter G. Neumann, Computer-Related Risks,
Addison-Wesley Publishing Co., 1995.
A collection of terse anecdotal reports in book format.
Dr. Neumann moderates the online Forum on Risks,
the current issue of which is posted at
An archive of issues back to 1 Aug 1985 is available at
Lindsay Marshall's website
at the University of Newcastle upon Tyne.
True stories of detecting hackers:
- Cliff Stoll, Cuckoo's Egg, 1990. (Pursuing a German
hacker, who conducted espionage for the KGB.)
- Tsutomu Shimomura, Takedown, 1996. (Pursuing Kevin
Mitnick, a fugitive career computer criminal who made the mistake of
hacking into Shimomura's personal computer.)
When a criminal perpetrates a crime, his attorney is
likely to say that the criminal did everyone a favor
by calling attention to lapses in security of computers.
It is a criminal defense attorney's job to put the best possible spin
on the client's horrible activities.
However, recognize that "blaming the victim" for the crime is a cheap
shot. Even if the victim behaved in an imprudent way, a victim never
invites a crime.
I want to make clear that there are two completely separate issues:
(1) prosecution of perpetrators of computer crimes and
(2) steps that a computer user can take to avoid being a victim.
Most of the really effective steps that a computer user can take
to avoid being a victim of crime make the user's computer less
convenient to use. Each user must balance for himself/herself how
much security is enough, especially when faced with daily inconvenience
of high-level security measures vs. the rare occurrence of attacks.
Further, the user must be aware that a determined and creative criminal
can defeat nearly any security measure, so complete security is
this document is at http://www.rbs2.com/cvict.htm
created May 1999, last revision 27 Aug 2004, links updated 25 Nov 2007,
backup section revised 18 Jan 2013.
My essay on computer crime.
return to my homepage