A Defensive Computing Checklist by Michael Horowitz
This is a list of both things to be aware of and specific defensive steps that we can take in response to the common threats of 2019. No list like this can ever be complete, nor would anyone want it to be complete as that list would never end. I tried to limit this to the most important issues, still its long (10,000 words). Techies will find some of this obvious but they are likely to learn something nonetheless. Non techies may find some of it too advanced; if so, please let me know (see bottom of page).
Some parts of this page are not displayed until you click a button. To see everything (perhaps for printing?), click this button:
Many times, perhaps most of the time, the first step in a company getting hacked is an email message.
You never know who sent an email message, so think carefully before taking action based on a single message. It is fairly easy to forge the FROM address of an email. Techies can look at the hidden email headers to get an idea who really sent a given message, but this is not a skill taught in nerd school. Be especially careful about doing anything involving money, passwords or personal information based on one lousy email message.
In light of the above, we might be tempted to trust that an email was legit, if it knew something about us. However, our personal information has leaked time and time again, so including information about you, specifically, is no indication that the sender is who they claim to be or that the message is legit. For example, Starwood was hacked, so an email about the time you stayed at the Westin hotel in Cleveland in the summer of 2018, may not be from Starwood. Bad guys know you stayed there too.
The more urgent the plea for you to take action, the more likely it is to be a scam. Bad guys don't want you to have a chance to think
about the issue or check with others.
Email attachments: Word documents and PDF files are often hacked to install a virus on a Windows computer. It is best to open any file sent to you by email in a safe environment such as a Chromebook (more below). Or, if you know a techie, have them review it first. Or, download the attached file and go to VirusTotal.com to scan it with many different anti-virus programs before opening it. Excel and PowerPoint files can also be dangerous. While those are the most common, any type of attached file can be dangerous.
Terminology: "Phishing" means scam. A phishing email is lying to you about something. "Spear Phising" is a scam specifically targeted at you. The bad guys will have researched you and then use that information as the part of lure in their scam.
Attachment defense: The only safe way to open a file attached to an email message is on a Chromebook running in Guest mode. There is more on Chromebooks below. An email with a password protected attachment, that has the password in the body of the email message, is surely malicious. This is a trick bad guys use to prevent anti-virus programs from detecting malicious software. If you try to open an attached file and it fails to open, you can still get infected with a virus (except on a Chromebook in Guest mode).
Taking a step back, it seems to me like we are living in a time much like the one before seat belts were required in cars. The current risky behavior
is reading email on a computer with sensitive or important files (or LAN based access to such files). Everyone does it, yet everyone is wrong. Too risky.
Fake websites are a common scam. To identify the fakes, you need to understand the rules for domain names. Some domain names are: google.com, columbia.edu, irs.gov and RouterSecurity.org. Many scam website names look legit to someone who does not know the rules. Here are the rules.
A domain name usually consists of two parts separated by a period. Sometimes a domain with a country code, such as UK for the United Kingdom, consists of three parts. An example is the British newspaper the Daily Mirror at mirror.co.uk.
Domain names are not case sensitive. GOOGLE.com and Google.com and google.com are the same thing.
The full web page identifier (URL to techies) consists of sub-domains on the left, a domain name in the middle, a slash, and finally, the unique name of the web page on the website. For example, if you visit the IRS website and want to work for them, you end up at
www.jobs is the subdomain irs.gov is the domain name, and application-process/application-process/how-apply is the specific web page at the IRS website.
Some web browsers, such as the desktop version of Firefox, help you identify the domain name by highlighting it in the address bar.
Sub-domains help a big organization logically chop themselves into smaller pieces. Technically speaking, the classic three Ws to the left of the domain name is a sub-domain. Any string of letters, dashes and numbers can be at the left of the domain name. No matter what's there, it is all part of the same domain. Sub-domains are optional. Three examples:
The math department at Columbia University might be math.columbia.edu or www.math.columbia.edu or nerds.math.columbia.edu. They are all part of the Columbia.edu domain, so they all belong to Columbia University.
This website is DefensiveComputingChecklist.com. The name Defensive.ComputingChecklist.com (with a period between Defensive and Computing) is not me. It is the "Defensive" sub-domain of the ComputingChecklist.com domain. Likewise, Defensive.Computing.Checklist.com (periods between each word) is the
"Defensive.Computing" sub-domain of the Checklist.com domain.
The domain citi.com belongs to Citibank. Simple rule: anything that ends with ".citi.com" (note the leading period) is also Citibank. For example: secure.citi.com, jobs.citi.com, online.citi.com, a.b.c.d.e.citi.com, some-thing-else.citi.com, any.thing.at.all.citi.com.
The flip side of the last example is that just having "citi" in a domain name means nothing. For example, these domain names have no relationship to Citibank: citionlinebanking.com, citi-online-banking.com, citi.onlinebanking.com, citi-thebank.com, citibank-online.com, citibankingonline.com, secureciti.com and TrustUsWeAreCitibank.com. When I go to citi.com, I end up at online.citi.com. Perhaps the best fraudulent domain is onlineciti.com. If you ignore the one missing period, it looks legit. Sadly, this domain is available today (April 3, 2019) for bad guys to buy. Oh, and citibankonline.com is really Citibank.
Another way people are fooled is by using a legitimate domain name as a sub-domain. For example: citi.com.badguy.com is part of the badguy.com domain, and citi.com.securebanking.com is part of the securebanking.com domain. See, it's important to know the rules. In spatial terms, "citi.com" on the far left is a scam, "citi.com" on the far right (just before the first slash), is Citibank. In May 2019, Eset reported thatupdate.asuswebstorage.com.ssmailer.com was pretending to be part of the Asus Web Storage system. Repeating myself, the domain name ends at the first slash.
Still another trick involves a scam site on a legit domain. For example, the Microsoft Azure system lets customers create websites addressable as a subdomain of their legitimate windows.net domain. Bad guys abusing this have used names like
office43l2v3rgq5y3xpy.z13.web.core.windows.net. Read more and see an example.
Some real life domain name scams:
---------REAL LIFE DOMAIN NAME SCAMS-----------
In April 2019, Brian Krebs wrote about a service called Land Lords that creates Airbnb scams. A key piece of these scams are domains that look like airbnb.com, but, are not. The scam domain in the article was airbnb.longterm-airbnb.co.uk
It looked exactly like the real Airbnb website and requested victims to sign. The fake site forwarded the legit Airbnb credentials to the real Airbnb, but only after recording them. Other domains used to scam Airbnb were: airbnb.longterm-airbnb.co.uk
airbnb.pt-anuncio.com airbnb.request-online.com airbnb-invoice.com A reader of the article claimed to have also seen airbnb.com.longterm-listing.com. For another defense against this scam see the topic below on verified website identities. The real www.airbnb.co.uk has this extra verification.
When, also in April 2019, Krebs wrote about Wipro being hacked by phishing/scam email messages, the phony domain name he cited was securemail.wipro.com.internal-message.app
Who even knew that a legitimate domain name can end in dot app? The bad guys loved using their internal-message.app domain so much they also may have used securemail.capgemini.com.internal-message.app to scam employees of CapGemini and secure.rackspace.com.internal-message.app to phish people at Rackspace.
In May 2019 Eset foundwww.google.com.dns-report.com being used by bad guys.
Arguably the biggest domain name screw-up ever, was by Equifax in 2017. I say this not because they were hacked, but because of their reaction. The Equifax domain is equifax.com. To post their response to the hacking incident, they created a new website: equifaxsecurity2017.com. They should have named their response website something like security2017.equifax.com or equifax.com/security2017. A techie exposed Equifax for the fools they are by registering a scam website securityequifax2017.com. In the ultimate irony, the official Equifax twitter account, sent people to the scam site. You can't make this stuff up. And, now that you have read this far, you know more about domain names than the techies at Equifax.
Spectrum is my ISP. Recently an email arrived from firstname.lastname@example.org warning of something. Is this really from Spectrum? I knew it was,
because I created an email address that only they have. More on this tactic in the Extra Credit section at the bottom of this page.
And, of course, dot com is not the only thing that website/domain names end with. Sure, apple.com is the company that makes iPhones, what about apple.net, apple.org, apple.gov, apple.me, apple.us, apple.cn, apple.jobs, apple.app, apple.site, apple.edu, apple.biz, apple.name, apple.io, apple.theater, apple.talk, apple.tv and apple.movie? Assume nothing. They may belong to the iPhone vendor, they may not. Some of these do, some do not. Citibank customers, accustomed to online banking at citi.com, should not assume that citi.somethingelse also belongs to their bank. That's not he way the system works.
Finally, some good news. You may be able to see who owns a domain.
Companies that register domains are called "Registrars" and they are required to make information about domains public. This database is referred to as "Whois" and, in the Whois system, the domain owner is referred to as the "Registrant." Some Registrars offering a Whois lookup are:
pair Domains, eNom and
Tucows Domains. DomainTools also offers a Whois lookup. Other useful information provided by Whois, is a technical contact, an administrative contact, the name of the Registrar and, for techies, the authoritative DNS servers. That said, a domain owner may not want their contact information public. If you look up this domain (DefensiveComputingChecklist.com) for example, you will not find my home address. While people may want to hide, legitimate companies have no reason to do so. Needless to say, a bad guys hide their identity. However, law enforcement can always knock on the door of a registrar to see who paid for a domain.
Everyone is told there are two types of websites: secure (HTTPS) and not secure (HTTP). In fact there are three types of websites. The third type is a "secure" site that has gone the extra mile and offers proof of its identity.
In another type of attack, a web browser may display the correct something.citi.com, and yet, the website could still be a fake. To prevent this, companies that take this stuff seriously pay extra to have their identities verified. You can see this extra identity validation at, for example, citi.com which says "Citigroup Inc. (US)" just to left of online.citi.com in the address bar (see example). Bank of America does the same thing as you would expect any financial company to do. In contrast, my dinky websites, such as this one and my personal site (michaelhorowitz.com) do not have identity verification (see contrast). If the website of your financial institution has this extra identity protection, get in the habit of looking for it. If this information is not provided, take that as a bad sign about the company and its website. In techie terms, my websites are Domain Validated (DV), the Citigroup and Bank of America websites have Extended Validation (EV). The home office of incompetence, Equifax, does not offer identity verification. Not a surprise. What is surprising is that neither does Amazon.com (shown in the screen shots). Sadly, there is a trend in web browsers to suppress the visual indication of sites offering identity verification. If your browser does not show the difference, use a different browser.
As with email messages, the content of a fake website can look exactly like the real thing. Anyone can copy images and text and fonts from the real site and use them to make a fake site.
The concept of secure websites, indicated by HTTPS or a lock icon, is, in many ways, a scam. The security that people tout refers to a small piece of a large pie. Specifically, it refers to in-flight data; data being transmitted back and forth between your computer and a website. If, while traveling over the Internet, the data/web page is encrypted, then the entire site is said to be secure. Fact is, dozens of things can still leak your sensitive data. Take the just-discussed EV/DV validation of websites. Without real identity verification (EV), you could "securely" send passwords to bad guys. Another scam is that encryption is a binary thing, that it is either on or off. In reality, it is quite complicated. So much so, that there are security rating websites (next topic). Perfect Forward Secrecy (PFS) is another factor, one that is hardly every discussed. Without PFS spy agencies can very likely (no one knows for sure) decrypt the encrypted data traveling over the Internet. Another factor is keeping private encryption keys private. If they leak (its just a string of bits), encrypted data can, again, be decrypted. No one knows how well any website protects its private keys. Then too, many websites continue to support older security/encryption protocols with know flaws (TLS 1.0 and 1.1). And, websites have different sections, each section has its own security profile; one section may be more secure than another. For example, in 2016, I blogged about how www.ssa.gov was secure while secure.ssa.gov was not (since fixed). And, nothing about encryption in transit tells you anything about the strength of the security on the back end (think Facebook storing passwords in plain text) or
whether software running on the back end is being updated with bug fixes (think Equifax), how good their defenses are against attacks, who they share your data with or whether the data is left publicly available to anyone who knows where to look, no attacking needed (this happens a lot). I could go on. Anyone who tells you to trust a website because it is secure, is either un-informed or lying on purpose because it serves their needs.
A great website for evaluating the encryption used by a website is the Qualys SSL Server Test. Ironically, it does not have extended identity protection. Still, it offers both a ton of technical information about encryption and a simple letter grade at the top. I suggest testing your most important sites: banking, email and any website holding your sensitive information. Every site should get either and A or A+. Anything else is a failure. The orange horizontal stripes under the letter grade are security failures. To be thorough, you need to check each section of a website. For example, at the US Social Security Administration, you would check both www.ssa.gov and secure.ssa.gov. To put this in perspective, again, encryption is a small piece of a large pie. Nothing about the strength of the encryption used to send/receive data tells you anything about whether passwords are stored in plain text, or whether bug fixes are applied to the software running the website, or any other aspect of security.
Any website that you can access with just a userid/password is not really secure. There are many ways companies can increase the security of websites by making it harder to logon. The official term for this is two factor authentication (2FA). One approach is that the company sends customers an email message with a temporary code that the customer has to enter, after, they already entered a userid/password. Another common technique is to send a temporary code as a text to a phone. Or, a normal phone call with some type of response that proves a human answered the call. Or a normal phone call where a computer tells you the temporary code. There are also mobile apps (such as Authy and Google Authenticator) that can generate temporary secondary codes. The most secure option involves a physical thingy you connect to a computer/tablet/phone that verifies your identity. Most systems, however, do not support this. Two factor authentication is overkill for many websites, but it is something you really want to have on any banking or financial sites you use. Perhaps for email too. To see if the companies you deal with offer this, go to twofactorauth.org. This is also known as MFA, Multi-Factor Authentication. More: Two-Factor Authentication Keeps the Hackers Out by Leo Notenboom (June 2016).
Some websites use secret questions as a way to identify you should you forget your password. Never answer these truthfully. You don't want
the answer to be anything that someone could either guess or learn about you. In fact, don't even give reasonable answers. If it asks for the name of a person, make the answer the name of a place instead. You never know if the answers are case sensitive or not, so it is safer to only use lower case. In my opinion, it is also safer to avoid spaces and special characters too. Just like passwords, these questions and answers need to saved somewhere that you can find them later. Nothing wrong with paper and pencil.
Never re-use passwords. We all need dozens or hundreds of passwords, yet we can remember just a few. Nonetheless, this is a very important rule. Companies are hacked all the time, leaking passwords that bad guys then try at other systems/websites.
Almost every computer nerd recommends password management software. I disagree. Techies that say this are thinking inside the box and over valuing
the need for randomness in passwords. They also underestimate the hassle of new software for non techies.
Try using a formula to generate your passwords. A simple formula is to start every password with the same string of characters. Then, you can chose very simple passwords to append to the constant beginning. For example, a baseball fan might start every password with "BaseballRules!" Then, if "jungle" was their password for Amazon.com, the actual password is "BaseballRules!jungle" And, all you would have to remember would be that your Amazon password is "jungle". Pretty easy. Amazon. Jungle. And, the miserable password "book" for Barnes and Noble, becomes a good password ("BaseballRules!book") when run through the formula. Perhaps the worst password is the word password. But, as Leo Notenboom points out, "1234 password 1234" is a pretty good password. It's also easy to remember. There's a formula: start and end every password with "1234". Love your dog? Start your passwords with "rover-" or "fido/"
You can check if any of your passwords have leaked in a data breach at haveibeenpwned.com/Passwords. Of course, someone else may have been using the same password. The best passwords have never leaked and a formula (above) should produce globally unique passwords fairly easily.
Storing passwords: Using a formula lets you write down just the easy/right part of the password and still be secure. If someone saw your password list and read that "book" was your Barnes and Noble password, it would be useless without the formula. Passwords written on paper can not be hacked; just be sure to xerox the list every now and then in case you lose it.
Traveling passwords: Paper passwords work everywhere, no matter the device, the Operating System or the software being used. I use a password manager and its useless on a Chromebook running in Guest mode which is where I do my sensitive transactions.
All that said, no single approach is appropriate for everyone. And, some passwords are much more important than others.
You never know who calls you on the phone. Callerid can be spoofed just like the FROM address in email, so the same advice holds: think carefully before taking action based on a single phone call, especially any action involving money, passwords or personal information.
Apple does not call their customers out of the blue. Some scammers pretending to be Apple make calls that display an Apple logo, address and their real phone number. More here and here. Contact Apple at
Unwanted calls can be reported to the US Government. Probably a waste of time.
Considering the many data breaches of personal information, along with the legal sharing of it, ID theft is all too likely. Here are some things to do to in preparation.
Bad guys might try to open a credit card in your name. To prevent this, you can get a credit freeze with
Bad guys might use your credit card to buy themselves stuff. You can be alerted to this by having your credit card company notify you, in real time, about charges on your account.
Americans should open an account with the IRS (irs.gov) to prevent bad guys from opening an account in your name and getting your tax refund.
Even if you never use this account, it is safer to have it. Brian Krebs: has more (January 2018).
Americans should also open an account with the Social Security Administration (ssa.gov) regardless of their age. This prevents bad guys with your stolen information from opening an account as you, and, for many people, is the only way to verify that their earnings are correctly reported.
When you logon to the My Social Security website, it reports the last time you logged on. If you can track this yourself, then you can be sure no one has stolen
your identity and logged on as you.
According to this article, the Social Security Administration has greatly curtailed the number of paper statements it mails. It now mails statements only to people over 60 who are not yet getting benefits and who have not set up digital accounts.
After an account is opened, you can block all electronic access to it. Of course, this blocking is only as good as the defenses against bad guys unblocking it and I don't know what those defenses are.
The phone number of the Social Security Administration is 800-772-1213
The Social Security Administration does not threaten to arrest people. Social Security numbers can not be suspended. These are common scams.
Neither the IRS nor Social Security does a good enough job of identifying people. They both know where you live, they could send a code via postal mail to verify who you are ... but, no. The Social Security Administration uses Equifax data to verify your identity and we all know that Equifax was hacked in 2017 and lost their crown jewels (our personal information). If you have a credit freeze with Equifax, then you can not open a Social Security account. You can't make this stuff up.
Bad guys may try to impersonate you to get your cellphone number assigned to their telephone, a process known as a SIM swap. They do this because a phone number is often used to prove identity, with things like forgotten passwords. To defend against this, you can create a security code with your cellphone provider. This code needs to be provided over the phone, or in person at a store, before account changes are made. T-Mobile calls it an Account PIN. Verizon calls it both an Account PIN and a Billing Password. AT&T calls it a Security Passcode. The defense, however, is far from perfect. Brian Krebs wrote in Nov. 2018 that there is no defense against malicious employees of the cellphone company. He also wrote about lazy employees who ignore the system. Much of the world has fixed this problem, but the US remains vulnerable. More:
Why Phone Numbers Stink As Identity Proof by Brian Krebs March 2019.
A free annual credit report, available at annualcreditreport.com can't hurt. However, two things about the site are a sham. For one, it says that
you can order reports online. When I last tried this in December 2018, it was not true, reports had to be ordered via postal mail, and, I was not told this until
after I entered all my personal information. Also, the site has not opted for extra identity validation for itself (see topic on VERIFIED WEBSITE IDENTITY).
Requests on paper are the way to go.
Choosing: Web browsers are one area where the wisdom of the crowd does not apply. In the old days, the crowd used Internet Explorer, now it's Google's Chrome browser. Don't use either one. Or Edge. I am not a big Apple user, so I don't have an opinion on Safari. I suggest using either Firefox or the Brave browser. Brave has ad blocking and tracker blocking built in. It is based on Chrome, supports all Chrome extensions and runs on Windows, macOS, Linux, Android and iOS. See I protected my privacy by ditching Chrome for Brave–and so should you (Michael Grothaus March 2019) and How I'm locking down my cyber-life (Larry Sanger Jan. 2019). The HTML pingback feature is but one of hundreds of features in a web browser. But, we can use it to judge which browsers care about our privacy (Firefox, Brave) and which do not (all the rest).
See this article by Lawrence Abrams for details.
Track me not: If the websites you visit are determined to track you it is all but impossible to prevent it. Still, you can fight back. One approach is to use private/incognito mode in your web browser. For background, see What Does Private Browsing Mode Do? by Martin Shelton July 2018. Another option is to manually delete cookies and other tracking data in your browser. In Chrome and Brave, enter
chrome://settings/siteData in the address bar, then click the Remove All button. In Firefox, enter about:preferences#privacy and click on the Clear Data button. Perhaps bookmark these URLs. Firefox can automatically delete cookies when the browser shuts down, something Chrome and Brave do not support. Using the same Firefox URL, turn on the checkbox for "Delete cookies and site data when Firefox is closed". The biggest hammer in the toolbox to avoid being tracked is Guest mode on a Chromebook.
Install an ad blocker in your web browser. I say this not because it makes web pages load faster (it does) but because ads have been
abused too many times to install malicious software or take you to scam websites. Even Chromebook users can be scammed at websites (no malware though). One highly recommended ad-blocker is uBlock Origin by Raymond Hill. I realize that this prevents sites from earning revenue to which I can only say that the ad blocker can be disabled on sites you wish to support. However, no website can be trusted to only show non-malicious ads because the website itself does not choose the ads. It's a mess.
Web browser extensions can, if you let them, read and modify the contents of every displayed page. This is necessary, for example, with an ad blocking extension. However, it can be abused to, so when installing extensions pay close attention to the permissions it requests. It is a good idea to periodically review the extensions installed in your browser and remove any you really don't need. I have seen non-techies be tricked into installing malicious extensions. To display the installed extensions, use these address bar URLs (perhaps bookmark them): In chrome
chrome://extensions, in Brave
brave://extensions, in Firefox
about:addons. I blogged about potentially dangerous extensions here and here and here.
Public Wi-Fi is always dangerous, whether a password is required or not. It is best to keep your main/regular computing devices away from public networks. If possible, use a Chromebook on public networks. Regardless of the computing device:
Anyone can name a Wi-Fi network anything. As a result, bad guys can create wireless networks with the same name (SSID) as a
legitimate network. The official term for this is an Evil Twin network. Non techies can not distinguish an Evil Twin from the legit network it is
pretending to be. Neither can a computer/phone/tablet which will happily connect to the evil network. Techies can look at the MAC address of a wireless network, but even that can be spoofed if the bad guy knows how.
Use either a VPN (not a free one) or Tor on a public network. Both hide your activity from the router creating the public network which is a good
thing whether the network is an Evil Twin or not. More in the Networking topic below. If this is too much, then on mobile devices, use the Cloudflare 220.127.116.11 app available on Android and iOS.
After connecting to the network, and starting the VPN or Tor or Cloudflare, check the DNS servers actually in effect. If using a VPN, the DNS servers should be from the VPN provider. It is very dangerous to use unknown DNS servers.
Even with all the protection in the world, there are some things best avoided on any public network. You never know who is watching over your shoulder.
Disable Wi-Fi when not using it. It is not sufficient to simply disconnect from the public network.
If you must use your regular devices on a public network, then have a techie check them for open TCP/IP ports. This probably will be done with the nmap utility. Check for all 65,500 TCP ports, looking especially for file sharing ports. If file sharing is enabled, then learn how to disable it and verify that its ports get closed when its disabled.
One way to avoid public Wi-Fi with a laptop, is to use the 4G/LTE connection on a phone for Internet access. That is, make the phone into a hotspot and connect the laptop to the phone's Wi-Fi network. One, or both, of the devices should be connected to a VPN.
Another privacy issue with Alexa is that the devices phone home to Amazon and to others, even when they are not being used. No one knows why.
Article: Alexa has been eavesdropping on you this whole time by Geoffrey Fowler May 2019. Amazon keeps a copy of everything Alexa records after it hears the wake word. Fowler listened to 4 years of his recordings and found that dozens of times it recorded when it should not. It even picked up some sensitive conversations. There are instructions for deleting these recordings via the Alexa app. Hear your archive at www.amazon.com/alexaprivacy.
Also from Fowler: Amazon collects data about third-party devices even when you do not use Alexa to operate them. For example, Sonos keeps track of what albums, playlists or stations you listen to and shares that information with Amazon. You can tell Amazon to delete everything it has learned about your home, but you can not look at this data or stop Amazon from continuing to collect it.
SIRI: Apple records Siri queries and you can not delete them (also from Fowler article). However, Apple says they are not linked to you when saved.
Again from Fowler article: Google used to record conversations with its Assistant ("Hey Google") but in 2018, they stopped doing so by default on new setups. You can check the settings of your Assistant at myaccount.google.com/activitycontrols/audio. Look to Pause recordings. This How-ToGeek article adds instructions for deleting the previously saved recordings.
The Nest thermostat, made by Google, phones home every 15 minutes, reporting the climate in the home and whether there is anyone moving around. The data is saved forever. (also from the Fowler article)
For iOS version 12, do Settings -> Privacy -> Location Services to see a list of apps. Each app is assigned one of three rules: never see your location, always see your location or only see it while using the app. Also here is a link to System Services and their location usage.
Does a weather app really need your current location? Maybe just give it a couple zip codes where you often are instead, and only give it access to your current location when traveling.
The second approach, on Android, is to disable two different location history features while leaving the Location feature enabled. That is, let the phone know where you are now, but not keep a history of where you have been. This can be done on the phone or on the web.
This article says to turn off "Location History" at myaccount.google.com/privacycheckup and turn off "Web & App Activity" at myaccount.google.com/activitycontrols
This article says to go to myactivity.google.com, select "Activity Controls" and turn off "Web & App Activity" and "Location History"
Android 8 and 9: Settings -> Security and Location -> Location -> Use Location is the master on/off switch for Location services. On Android 7, do Settings -> Location. From here, on all three versions, you can click on Google Location History to pause it. Note: this is done for a Google account, not for the device. From there, click on Show All Activity Controls to see the Web and App Activity and pause that too. From Google: Manage your Android device's location settings. The article states that, with Location disabled, you can still get local search results and ads based on your public IP address. You can test this with a VPN.
Yet another click-path: Android 8: Settings -> Users and Accounts. Android 9: Settings -> Accounts. Select an account, then click on Google Account. Find the Data and Personalization section, then the Activity controls section. Again, look for Location History and Web and App Activity. Lots more here too, such as Ad personalization.
My advice is prevent iOS and Android from knowing your location in the first place. To do this:
Turn off 4G/LTE Internet
Turn off Wi-Fi
Turn off Bluetooth
Turn off GPS by disabling "Location" (Android) or "Location Services" (iOS)
With these four things disabled, a phone can still make/receive calls and text messages. However, your location can be still tracked by the cell tower the phone is talking to, but, this only provides a general idea of where you are rather than a precise location. The next step would be to enable airplane mode and the step after that is to turn the phone off. A dedicated GPS app can be used to confirm the status of GPS. A side benefit of having this stuff disabled is better battery life.
Note that even with Bluetooth and Wi-Fi disabled, an Android device may still use either or both to determine your location. For more, see the topic on Mobile Scanning and Sharing.
Taking a step back, consider who is the enemy here? That is, who is it we don't want tracking us. Some people/articles focus on apps. But, it also the Operating System vendors, Apple and Google, that learn our location. And, of course, the cell phone companies, who are being being sued for selling location data. Another reason for my approach to defense.
Background: This December 2018 article in the NY Times, documents the tracking, but not defense. Same for this
article. Google has a history with location tracking.
Networking equipment (router or combination modem/router) provided by Internet Service Providers is typically insecure and low quality. Anything you buy at retail is likely to be more secure. It may also be cheaper in the long run and makes you a lesser target (a million people are not using the same router model). I have a whole website devoted to Router Security. At the least, try to make the router configuration changes in the short list on the home page. Comcast customers see this.
Ethernet is more secure than Wi-Fi, so whenever possible connect via Ethernet for sensitive work. It's also faster. USB to Ethernet adapters cost about $15.
Use a Guest Wi-Fi network both for visiting humans and for IoT devices. Better yet, if your router supports it, use VLANs to further segregate devices (requires a techie). More here.
At this point, it is common knowledge that Wi-Fi encryption should use WPA2 rather than the ancient WPA or WEP. If given a choice, WPA2 AES is more secure than WPA2 TKIP. Note that a long Wi-Fi password can prevent a brute force guessing attack; passwords should be 14 characters or longer. More here.
When it comes to making router changes, the first step, logging into the router, is likely to be the hardest. To make this easier, I suggest writing down the necessary info (IP address, userid, password) on a piece of paper and taping it to the router face down. Maybe include Wi-Fi passwords too.
A VPN prevents spying on your online activity by anyone you an see (anyone on the same local network) and by the ISP connecting you to the
Internet. In the US, ISPs are allowed to spy on their customers and sell that data. A "secure" website prevents others on your LAN and your ISP from reading the content of web pages. However, they can still tell which websites you visited. In some cases, just the website name gives away too much information. VPNs hide everything. Picking a VPN provider is mind bogglingly difficult. Even agreeing on the criteria to judge them with is impossible. See one attempt and another and another. I have my opinions on good/trustworthy VPN providers, email me for my suggestions.
One of the Privacy Settings in iOS v12 is Bluetooth Sharing. Apps that are enabled for Bluetooth Sharing can share data even when you are not using them.
Both Android and iOS want you to keep Wi-Fi and Bluetooth enabled for a number of reasons. Android may well use them both even if they appear to be disabled. And, if they really are disabled, each Operating System has a number of ways to automatically turn them back on. I suggest checking an Android device by searching the Settings for the words "scan" and "scanning". Plus, there are many other options for sharing data, that you might want to disable, at least as a starting point, to reduce your attack surface.
SCAN EVEN WITH BLUETOOTH OFF
Android 9: Settings -> Security and Location -> Location -> Advanced -> Scanning -> Bluetooth scanning. Description: "Allow apps and services to scan for nearby devices at any time, even when Bluetooth is off. This can be used, for example, to improve location-based features and services.".
Android 8.1: Settings -> Connections -> Location -> Improve accuracy -> Bluetooth scanning. Description: "Improve location accuracy by allowing apps and services to scan for and connect to nearby devices automatically via Bluetooth, even while Bluetooth is turned off."
Android 8.1: Settings -> Security and Location -> Location -> Scanning -> Bluetooth scanning. Description: "Improve location by allowing system apps and services to detect Bluetooth devices at any time."
Android 7.0: Settings -> Location -> Scanning -> Bluetooth scanning. Pretty much same description.
Nearby Device Scanning: I have seen an Android 8.1 Samsung tablet use Bluetooth scanning to find nearby devices, again, with Bluetooth seemingly disabled. The feature was called Nearby Device Scanning and it was enabled by default. The description said "Scan for and connect to nearby devices easily. Available devices will appear in a pop-up or on the notification panel. Nearby device scanning uses Bluetooth Low Energy scanning and the microphone. Bluetooth Low Energy scanning can be used even while Bluetooth is turned off on this device." The path to the setting was: Settings -> Connections -> More connection settings -> Nearby device scanning.
iOS 12 does not seem to have anything like this.
SCAN EVEN WITH WIFI OFF
Android 9: Settings -> Security and Location -> Location -> Advanced -> Scanning -> Wi-Fi scanning. Description: "Allow apps and services to scan for Wi-Fi networks at any time, even when Wi-Fi is off. This can be used, for example, to improve location-based features and services."
Android 8.1 Samsung: Settings -> Connections -> Location -> Improve accuracy -> Wi-Fi scanning. Description: "Improve location accuracy by allowing apps and services to scan for Wi-Fi networks automatically, even while Wi-Fi is turned off."
Android 7.0: Settings -> Location -> Scanning -> Wi-Fi scanning. Pretty much same description.
Android 6 in the Advanced WLAN section, look for Scanning Always available. Description: "Let Google's location service and other apps scan for networks even when WLAN is off."
Android 9: Network and Internet -> Wi-Fi -> Wi-Fi preferences -> Turn on Wi-Fi automatically. Description: "Wi-Fi will turn back on near high quality saved networks, like your home network." This requires both Location and Wi-Fi scanning to be enabled.
Android 8.1: Settings -> Connections -> Wi-Fi -> Advanced -> Turn of Wi-Fi automatically. Description: "Turn on Wi-Fi in places where you use Wi-Fi frequently".
iOS 12 has two ways to disable Wi-Fi; one sticks one does not. Swiping up from the bottom of the screen disables Wi-Fi for bit. Exactly how long? None of your business. The message is "Disconnecting nearby Wi-Fi until tomorrow." When tomorrow? Doesn't say. And, "nearby"? There is no such thing a near and far Wi-Fi. Turning Wi-Fi off in the Settings app keeps it off until you manually turn it back on.
Android 8.1 AT&T phone: Settings -> Connections -> Wi-Fi -> Advanced -> Auto connect to AT&T Wi-Fi.
Android 8.1 AT&T phone: Settings -> Connections -> Wi-Fi -> Advanced -> Hotspot 2.0. Description: "Automatically connect to Wi-fi access points that support Hotspot 2.0"
Google Nearby, aka Nearby Device Scanning
is designed to seamlessly let two Android devices talk to each other.
I found this enabled by default on an Android 8.1 Samsung tablet. The description said "Scan for and connect to nearby devices easily ... Nearby devices scanning uses Bluetooth Low Energy scanning and the microphone. Bluetooth Low Energy scanning can be used even while Bluetooth is turned off on this device.". The path to the setting was: Settings -> Connections -> More connection settings. I have read that this also uses Wi-Fi and audio to find nearby Android devices. Creepy. More here, here and here.
NFC (Near Field Communication) is yet another wireless option for sharing data, but only between devices that are two inches apart.
On Android, search the Settings for "NFC". On Android 9, its at: Settings -> Connected devices -> Connection preferences -> NFC. The description is "When this feature is turned on, you can beam app content to another NFC-capable device by holding the devices close together. For example, you can beam web pages, YouTube videos, contacts and more. Just bring the devices together (typically back to back) and then tap your screen. The app determines what gets beamed." NFC is the basis for Android Beam, yet another sharing protocol. Not every Android phone supports NFC.
On iOS, NFC is used for Apple Pay and reading NFC tags. iOS 12 added background tag reading, where the system automatically looks for nearby tags whenever the screen is illuminated. In Settings, tap "Wireless and Networks" then "More" to see the NFC option. More here and here.
Wi-Fi Direct allows two Wi-Fi devices to directly communicate without a router in the middle. I have checked a few Android devices and they all enable Wi-Fi direct without a way to disable it. It seems, however, that Wi-Fi direct scanning does not happen until you ask for it, so no big deal. Its popular on HP printers and some smart TVs as I always see some of each, when scanning from an Android device. HP printers create SSIDs like "DIRECT-xx-HP OfficeJet 4650"
Android 9: Settings -> Network and Internet -> Wi-Fi -> Wi-Fi preferences -> Advanced -> Wi-Fi Direct
Android 8.1: Settings -> Connections -> Wi-Fi -> Wi-Fi Direct
Android 8.1: Settings -> Network and Internet -> WLAN -> WLAN Preferences -> Advanced -> WLAN Direct
Android 7.0: Settings -> Wi-Fi -> Advanced -> Wi-Fi Direct
Air Drop on iOS uses both Bluetooth and Wi-Fi. Bluetooth is used to find partners and Wi-Fi, because it's faster, is used to transfer large files. The Wi-Fi is a form of Wi-Fi Direct, thus the two Apple devices do not have to be on the same Wi-Fi network to exchange data. In fact, they don't have to be connected to any Wi-Fi network or to the Internet. See a How To. The important thing to be aware of is whether an iOS device can receive data from anyone or only from people in the Contacts. Apple does a bad job with this.
Android Direct Share: Description: "Share content with specific people directly from the sharing panel in any app. The Direct Share icons will appear at the top of the sharing panel if an app supports this function." Find it on Android 8.1 with: Settings -> Advanced Features. Not sure if this uses Bluetooth, Wi-Fi or what.
The most secure Operating Systems in widespread use are iOS and ChromeOS (the system on Chromebooks).
Do not use Windows. Windows is a cesspool of hacking, ransomware, bugs and vulnerabilities. Has been for decades. With Windows 8 Microsoft lost all credibility. With Windows 10 Microsoft spies on you and has taken control over the installation of bug fixes.
Windows 10 makes it clear that the corporate mind set at Microsoft has changed - they view Windows 10 as their computer, not yours. It is crammed full of junky software that very few people care about, much of which can not be removed. And, even the removal is a scam, as the crapware comes back if you logon with a different userid. Likewise, the spying (aka telemetry, customization) can only be partially disabled. Home edition users are forced to beta test bug fixes and even Professional edition users have limited options for delaying or preventing the installation of bug fixes. Microsoft know whats best for you and its bug fixes all the time. Only the largest of corporations can fully opt out of the spying, junky software and forced "updates" in Windows 10. How? Microsoft has a clean version of Windows 10 called LTSC (or LTSB) that the public can not get. See a screen shot of the difference.
Then too, there is incompetence. Examples abound. Consider the monthly bug fixes for Windows that were released in April 2019. As documented by Woody Leonhard,
nine different Windows patches conflicted with four different antivirus products, leading to multiple problems. Quoting Woody: "...whoever made the decision to release the six (now nine) problematic Windows patches either: Didn't know they'd wreak havoc on millions of computers, or Didn't care. You can choose which one's worse."
And, Windows is fractured, in that there are many interfaces to the underlying system. For example: .NET, ActiveX and Silverlight. Windows 8 introduced Tile World apps (aka store apps, Metro apps, Universal Windows Platform apps, and a dozen more names). Few Windows developers bothered with Tile World and now (May 2019), it appears to be on the way out. See Woody Leonhard and Paul Thurrott for more. Tile World apps are just another example of incompetence. Microsoft does not know what their developers or their customers want.
Everyone knows that an Apple Mac computer (macOS) is safer than Windows. This is true, but not drastically so. Both are ancient and the world has changed dramatically since they were designed.
On both Windows and macOS, it is safer to logon to the computer as a restricted (a.k.a. limited, standard) user rather than an unrestricted (i.e. administrator, admin or root) user. In each system, restricted users are limited in the changes they can make to the system without approval from an unrestricted user. This limits the damage that malicious software, that makes its way onto your computer can do. Any computer with a single userid is just asking for trouble. On a new Windows or macOS computer, consider creating two users based on your first name: MichaelAdmin and MichaelRestricted, for example. On an existing computer, create a new admin user, logon to it and then modify the existing userid to be restricted. This does not apply on a Chromebook.
Start using a Chromebook. Chromebook laptop computer are drastically safer than Windows and macOS. Their operating system, ChromeOS, is the newest available system and the most advanced. It was designed, by Google, with security in mind. They are a revolution in computing in that they don't need any care and feeding. No viruses. End users (you) can not screw them up. Chromebooks are not for everyone and not for every purpose. They are perfect for kids, seniors and non techies. More people should be using them, they are the home office of Defensive Computing. You normally use a Google account to logon to a Chromebook, but there is also a Guest mode that anyone can use without logging on.
---------ADDITIONAL CHROMEBOOK INFO-----------
Guest mode starts and ends with a totally clean version of ChromeOS. That is, when Guest mode starts, there is no visible history of anything. Factory fresh if you will. When Guest mode ends, all activity is removed. Downloaded files, for example, are deleted. It's as if it never happened. Guest mode uses the Chrome browser, but without extensions. You can't even install an extension in Guest mode. It is the most secure environment available to non techies. It is perfect for online banking, opening suspicious email attachments and avoiding any and all website tracking.
Originally, Chromebooks just ran the Chrome web browser (simplifying a bit). Later, Google added the ability to run Android apps, and, just recently, added Linux apps too. With an Android based emulator app, some Windows programs can also run on a Chromebook (requires an Intel CPU). Every computer company that makes Windows laptops, also makes Chromebooks.
Low end models are roughly $200. High end models are roughly $500 to $1,000. Most, but not all models have a touch screen. I suggest going for a touch screen.
Chromebooks have a full range of remote control options where they are the controller. However, options are limited for the Chromebook being controlled remotely.
The only option for full remote control that I know of is the Chrome Remote Desktop extension from Google. It's a pain to setup. There is a Team Viewer Quick Start
app for Android that, once its installed, is very simple to use. It gives view-only access to the entire Chromebook (not just to the Android side) to a remote person.
For more see:
-- The Handiest Chromebooks For Hardworking Students -- Wake up and smell the Chrome -- Defensive Computing for online finances: Go with Chrome OS. ---------------------------------------------------------------------
Linux: Linux on a desktop/laptop computer is pretty safe, but, nonetheless, not a realistic option. For one, getting it installed is too difficult for non-techies. And, the few laptops that ship with Linux pre-installed are fairly expensive. Also, where does a non techie go with their inevitable questions and problems? And, the many distros and package managers make almost every Linux install unique, which makes it even harder to get help when needed.
FYI: We can see the progression of Operating Systems in how they handle software updates. On ChromeOS all software is updated automatically. It is king of the hill in this regard. On Android and iOS, the apps can update automatically, but not the OS itself. On Windows, macOS and Linux, it's chaos.
Use Windows? Use the OneDrive feature? Then Microsoft can read the files you store there. Likewise, Apple can read anything stored in iCloud. And Google can read files stored on Google Drive (used by Android and ChromeOS), Dropbox can read your files too, and Amazon can read files stored on their Drive offering. And, if they can read your files, think what the US Government can compel them to do. To evaluate any file storage/backup service ask what happens if you lose/forget the password/key? If the answer is that they can't help you, and you have lost access to your data, then the vendor can not read your files. Me? I encrypt my files before sending them off-site.
There are at least a dozen or more software programs that claim to offer secure communication. Amongst techies, Signal is worshiped like a religion despite its using phone numbers, which obviously identify you, as userids. Nerds seemed focused on encryption while ignoring anonymity. My suggestion for secure communication is to use email from one ProtonMail user to another. ProtonMail can not read your messages. They offer free limited accounts. And, for the Proton Mail webmail system (which is where anyone should start) you can use your web browser to verify the encrypted connection between your computer and protonmail.com. Their website is usable on a Chromebook running in Guest mode - you are much safer if the operating system can not leak any information about you because it does not have any information about you. I am out of step here with every techie in the world, yet, they are wrong.
It is common knowledge that Apple iOS devices are safer than Android. For example, read this.
My only advice for iOS users is to hold off installing new versions of iOS for a few weeks. However, do not wait to install the inevitable bug fixes that follow .
Also, see This ingenious new iPhone app is a powerful way to foil data snoops (by Glenn Fleishman March 2019) about the upcoming Guardian Mobile Firewall which combines a VPN and tracking protection. Seems like a unique product.
The main reason for Android's security problems are the lack of bug fixes. Most Android devices are shamefully vulnerable both because fixes are late in being issued (if they are ever issued) and then late in being installed. Here's an idea: before buying an Android phone try to find out when bug fixes for it will be released. Lotsa luck. The correct answer is once a month. Better still, try to find out when the last bug fixes for the phone will be issued, that is, when the software will be abandoned. You probably won't get an answer to either question. The only Android phones that I am aware of, for which bug fixes are issued monthly, is the Pixel line from Google.
If you use Google for searching, then minimize the tracking it does by not being signed in to Google when making queries. You can tell if you are signed in by checking the upper right corner of the screen (see screen shots). A single letter in a circle means you are signed in, a blue "Sign in" button means you are not.
If you have Nest Cam or Nest thermostat be aware that according to this April 2019 article in the Washington post, Nest security is sub-optimal. The article suggests using a unique password (always a good idea) and two factor authentication with the device.
Taking a step back ... Google? Really? In a camera in your home? Really?
Google hides the privacy settings for Google Pay. The settings can block the sharing (which is on by default) of your creditworthiness, personal information and account information. This May 2019 article by Lawrence Abrams in Bleeping Computer reveals a special URL that makes these settings visible.
Use multiple email addresses. Far too many systems use an email address as their unique identifier, so when one system gets hacked, bad guys are halfway to hacking into your other accounts. Having multiple email addresses avoids putting too many eggs in one basket. At the least, use one email address for business and one for personal messages. The next step would be to create a sacrificial email address for things you don't really care about.
The ultimate goal is to use a different email address with every service that requires one. Of course, no one wants to check multiple inboxes, and you do not have to. Email forwarding allows multiple email addresses to end up in one inbox. Gmail offers email forwarding as a free service. Gmail also lets you add a plus sign at the end of your Gmail userid to make unique email addresses, but some (too many, in my experience) websites consider an email address with a plus sign to be invalid.
Having dozens of email addresses, yet just one or two inboxes, is an achievable goal, but it requires a nerd to set up. It can be done in two ways: you can own a domain that allows email forwarding or you can use an email provider that offers aliases.
As a side benefit, using many email addresses helps you detect who shared your email address with their "business partners" (spammers).
Need some motivation for creating multiple email addresses? See how often your email address(s) have been included in a data breach at haveibeenpwned.com
If you opt for using your own personal domain as the mechanism for having multiple email addresses (great choice) then you can use the Domain Search feature of haveibeenpwned.com to subscribe to your domain and be notified when any of your email addresses have been stolen in a data breach. Way cool.
If you are working on sensitive documents, then consider not using Word, because it makes many connections to assorted computers on the Internet, even when its just editing a file on your computer. From my blog: Is Word 2016 spying on users?
There is a chance that the camera on a computing device could be activated without your being aware of it. The defense is old school: cover the camera lens with something opaque (band-aid, tape). Try to avoid adhesive directly over the lens.
At dehashed.com you can search for your physical address, email address, userid and/or phone number to see if they have been leaked in a data breach.
I read an article that said victims of Identity Theft should go to ftccomplaintassistant.gov and I wondered if that site was legitimate. That is, is it really from the Federal Trade Commission, a division of the US Government? We have already seen that just having "FTC" in the name means nothing. The FTC has their own website at ftc.gov, so why the need for another domain name? Instead of a new domain, they could (read should) have used complaintassistant.ftc.gov or ftc.gov/complaintassistant. Both leave no doubt that they are from the FTC.
On thing pointing to its being a scam is that the home page of ftc.gov has a link to identitytheft.gov for reporting identity theft. There is no link on the FTC home page to ftccomplaintassistant.gov. And, identitytheft.gov has its own assistant (identitytheft.gov/Assistant) which does not link to ftccomplaintassistant.gov.
Looking at the ftccomplaintassistant.gov site, the first thing to notice is that it does not have the extra identity assurance. If it is legit, that would be pretty ironic, eh? In techie terms the site is Domain Validated (DV) rather than having Extended Validation (EV).
All domains have to be registered and whoever pays for the registration can chose to make their identity public, or not. Looking up this information is called a Whois search and every company that registers domains offers a Whois search. However, this turned out to be a dead end. I could find no Whois information for any .gov websites.
A couple things point to the site being legit. There is a page on ftc.gov with consumer information about Identity Theft and it has a link to "File a Consumer Complaint" that goes to ftccomplaintassistant.gov. And, while the home page of identitytheft.gov has no links to ftccomplaintassistant.gov, an examination of the underlying html (i.e. page source) showed that pulls in a script from chat.ftccomplaintassistant.gov.
So, is it legit? I would have to call the FTC on the phone and ask them.
On a related note, ftccomplaintassistant.com is definitely bad news. That was an easy call.
The items below are defensive measures that apply to just one website or just one system.
Quoting ProPublica:"TurboTax uses deceptive design and misleading advertising to trick lower-income Americans into paying to file their taxes, even though they are eligible to do it for free." More here. (April 2019) The free tax filing site is
MetroPCS customers can take one of two defensive steps against a sim swap attack made far too easy by poor security at MetroPCS. April 2019
The Jumbo privacy assistant is an iOS app to increase your privacy on Facebook, Twitter, Google and Alexa. It was released in April 2019. It adjusts the 30-odd Facebook privacy settings to give you the most private version possible. It deletes old tweets, erases Google Search history and deletes the voice recordings stored by Alexa. Future plans are for an Android app and to deal with Instagram and Tinder. More.
This May 2019 article by Sergiu Gatlan for Bleeping Computer has defensive steps for Office 365.
Protecting Yourself from Identity Theft by Bruce Schneier May 2019. No good news here. Quoting: "there's nothing we can do to protect our data from being stolen by cybercriminals and others." True, but nonetheless, an easy out for anyone too lazy to do the things suggested here.
Whew! Seems like a lot, it is a lot.
All the credit/blame for this site falls on me, Michael Horowitz. If I left out anything let me know at defensivecomputing -at- michaelhorowitz dot com.
Created March 2019
May 18, 2019
Total Page Views:
7,715 Last Page View: May 19, 10:34 PM ET