|
BOOT CAMP 142
TROUNCING TROJANS
Here’s something scary for you to think about the next time
you’re on-line. When you are connected to the Internet it is possible for others
to gain access to your PC, read files, scan your address book, see which sites
you’ve been visiting, steal passwords, download files and viruses onto your
machine, even wipe your disc, and you won’t know a thing about it!
Fortunately for most users the risk of it happening is quite
small, nevertheless the possibility exists, and in the future when we are using
“always-on” connections to the net, like ADSL, this kind of snooping could turn
into a real threat. In Boot Camp this week we’ll show you how to check your PC
for intruders and protect it against infiltration.
Typically a program called a “Trojan”, which gets onto the PC
as an email attachment, or is deliberately planted by someone with access to the
machine, opens an unauthorised ‘backdoor’ into the computer’s hard-disc. Once
there it remains hidden but will activate whenever you go on-line, and provide
anyone with the necessary “Client” program full remote access to your
machine.
If you connect to the Internet by a normal ‘dial-up’
telephone line connection you are protected to some extent by the fact that your
PC is relatively anonymous. When you go on line most Internet Service Provider
ISP assign an ‘IP’ address to your PC, which changes every time you log on. This
makes it difficult, but not impossible, for anyone to deliberately target your
computer. Some Client programs randomly trawl through IP addresses for infected
PCs but some Trojans automatically report back to the sender your current IP
address as soon as you go on line.
Unlike a conventional virus or worm Trojans are not
necessarily destructive, which makes them hard to detect. Most of the top virus
scanners – if regularly updated -- will find the commonest Trojans, which for
the record have names or go under file and program aliases like Back Orifice,
Netbus, Buddylist, Deep-Throat, Girlfriend and Winsaver. If you feel you may be
under threat you might like to try this rough and ready Trojan detector, which
looks for programs that configure your PC to ‘listen’ for an Internet
connection; be warned that it is really only suitable for stand-alone,
non-networked PCs.
Here’s what to do, switch off and re-boot your PC. This is
important because any running programs or previous Internet connections since
Windows was booted will give spurious results. Next, open an MS-DOS window
(Start > Programs > MS-DOS) and type the following command at the flashing
prompt:
netstat –an >>c:\netstat.txt
Press Return then type ‘exit’ then Return
and the MS-DOS window will disappear. Now open Windows Explorer and in the root
directory of your C: drive there will be a newly created file called
Netstat.txt. Double click on it and it should open automatically with Windows
Notepad. If all’s well it should look pretty much like fig. 1, with nothing
logged under any of the headings. If you see any numbers and entries (fig. 2)
don’t panic, it could all be quite innocent but it should put you on your guard
and you might want to investigate further.
Even if this simple test suggests that our PC is currently
Trojan-free that’s no reason to be complacent and you still might be infected in
the future. In addition to all of the usual commonsense precautions, including
not opening suspicious and unexpected email attachments, you should install
software that prevents anyone from remotely accessing your PC. This type of
program is commonly called a ‘Firewall’, and there are plenty to choose from but
far and away the best and most popular one is ZoneAlarm, and the good news is
that for personal and non-commercial use it’s completely free. The file is just
over 1.6Mb so it should only take a few minutes to download from: www.zonelabs.com
Zone Alarm is very easy to set up and use and can be set to
start automatically when you boot your PC. It operates in the background,
monitoring programs that you have given permission to connect to the Internet;
if a program unexpectedly tries to open a connection without your say so you
will be warned. ZoneAlarm checks incoming email for ‘Love Bug’ type worms but
the most interesting feature is the one that alerts you when any attempt is made
to gain access your PC. What surprises a lot of users is how frequently this
happens; you might get two or three warnings in a half hour session. Usually
most alerts are entirely innocent and are often nothing more sinister than
delayed Internet site responses, if you tired of waiting for a page to download,
or sites calling the previous user of your current IP address. ZoneAlarm blocks
all intrusions, displays the IP address of the site trying to get through and
gives you the option to find out who it is.
In the case of an actual attack Zone Alarm is unlikely to
tell you very much or identify the would-be intruder as any serious hacker will
know enough to cover their tracks. However, it’s worth trying a program called
Neo Trace (a trial version can be downloaded from: http://www.pkware.com/catalog/neotrace.html),
which, in the manner of all good Hollywood spy movies, plots the path of the
connection between you and the suspect address on a map of the world, with
accompanying sound effects.
Next week – Preventative Maintenance
JARGON FILTER
ADSL
Asymmetric Digital Subscriber Line -- high speed digital connection using
existing telephone lines. ADSL has the facility to be “always on”, so there is
no need to dial up a connection
CLIENT
A PC or program used to access files on another PC on a
network
IP ADDRESS
Internet Protocol Address -- unique 32-bit code, represented
by four groups of digits, used to identify web sites and Internet users
TOP TIP
Just how secure is your PC? If you want to give yourself a
really nasty shock there’s an excellent Internet site that automatically tests
the integrity of your machine and its defences – or lack of them… With your
permission it simulates the kind of surreptitious backdoor snooping an intruder
might use to gain access to your system. The utility is called Shields Up! It
was created by Steve Gibson of Gibson Research. It’s free to use and it can be
found at: http://grc.com/. If that doesn’t
convince you of the need for a Firewall on your PC, nothing will!
|
