p1: Security when using a public computer

What are social bookmarks?

Last updated: October, 2008

Computer privacy matters to everyone - lock up now!

The "Dirty Toilet" Problem

When you go travelling, you'll probably want to keep in contact with home by using email from Internet cafés - that is, unless you decide to take your own notebook computer with you, trust to snail mail, or try to hunt down an elusive fax machine. What's wrong with Internet cafés? While you can't see the crop of bugs on the machine, public internet shops are rather like public toilets. Even worse, they're like public toilets where everything you do is revealed for the world to see...

Bugs are smeared all over the innards of every computer! Wiping the mouse and keyboard with a damp tissue won't clean those bugs off. Previous users, either through a "drive-by download" or a deliberate action, have probably caused worms, viruses, key loggers, Trojan horses or rootkits to become resident in the machine you are happily typing away on. Check here to see what these words mean. There is a real risk that anything you type on a contaminated public computer will be recorded and stolen. All of this can happen without your knowing (or even suspecting) a single thing. You could, of course, use Internet cafés only with "throwaway" email addresses (that means you set up a Yahoo! or Gmail account for the duration of your trip and then forget it when you are finished). You would avoid typing any sensitive information into the public computer except the password from that email account. You wouldn't do anything so brash as enter online banking pass codes or credit card numbers, not ever. Or is there a way to be safe(r) online in a cybercafé?

Look here to see some of the spyware I found installed on one computer while using an Internet café on a recent trip to India.

You probably won't bother to do such a spyware scan unless you're already a computer enthusiast. Why should you have to? - you only wanted to send a few emails and check your online banking balance. One huge problem with Internet cafés is that they are often lax at updating the software running on their computers. In poorer parts of the world, this might mean you surf and send critical messages on a Windows 98 machine running Internet Explorer 5, wide-open to all types of malware exploits of either other patrons of the café or external hackers. Even Windows XP platform machines might be poorly updated as they either were installed using a blacklisted key, blocking access to the Windows Update site and all critical security updates, or the downloadable patches and service packs are too large to manage with the slow Internet connection the café has (some security updates are 100MB, and 20MB updates are normal - almost impossible on a telephone line if you have more than one computer to update).

Some definitions first:

Backdoor As implied, a way into the computer which is not clearly visible to the operator. Many computer worms, such as Sobig and Mydoom, install a backdoor on the affected computer which allows remote execution of code on the machine;

Botnet A collection of security compromised computers (each a "zombie" or "bot") running stealth programs - which could be worms, Trojan horses, or backdoors - under a common command and control infrastructure. In 2004, the Dutch police found a  botnet with 1.5 million personal computers conscripted to it, while in the same year the Norwegian ISP Telenor disbanded a 10,000-node botnet. It has been estimated that up to one quarter of all personal computers connected to the Internet are part of a botnet. The so-called "Kraken" botnet (2007), an army of over 400,000 bots, has been spotted in at least 50 Fortune 500 companies and is undetectable in over 80 percent of machines running antivirus software. The number of bots around the world is thought to be increasing exponentially each year;

Compromised Server Servers are computers which store and serve out web pages. You probably connect with over a dozen different servers during one session in an Internet cafe. Yet servers can be compromised by hackers planting code which will execute and either directly install something or redirect the visitor to a site where the install happens. For instance, when you visit the site with a browser which has some software vulnerability, the planted site code runs and your computer is infected with a trojan or virus. All of the major browsers (Internet Explorer, Firefox, Safari) need regular "patches" or fixes for their discovered vulnerabilities, and some flaws are known about weeks before they are patched. Hackers often work to compromise servers within 24 hours of a browser flaw being made public. Think the code-planting hasn't happened to your trusted website? According to security firm Websense, sixty of the 100 most popular websites either hosted malicious content or linked to malicious websites at some point during the first six months of 2008. The proportion of compromised servers is set to rise rapidly in the years ahead, making this mode of delivery the most common method of picking up an infection;

"Drive-by" download Snooping software which installs on the target computer simply by a webpage opening which contains hidden code. The page might not even have been requested by the user - it was probably an unwanted pop-up window. The expression comes from "drive-by shooting," where the victim knew nothing of their assassin but was simply in the wrong place at the wrong time;

Keylogger/keystroke logger Either software in the computer (possibly from a drive-by  download) or hardware attached to it, which records everything any user types on the machine. The key logger may also periodically capture what's shown on the screen and then email all of these results to a secret address. The software loggers are tricky to detect (especially in an Internet café), the hardware ones will require you to dismantle the keyboard or get down on your knees and examine its plug;



Pharming You probably heard of "phishing" - in fact, if you've been using email more than a few months you've almost certainly received emails urging you to log-on to your bank's website and enter vital information. The emails, of course, are fake, and the site you go to is a carefully-crafted replica of the real thing which steals any passwords you enter. "Pharming" exploits don't even need you to click on an email link - the redirect happens within the computer you are using, or - more rarely - by falsifying something called the DNS records in a master computer somewhere. You end up at a site which looks like the one you want but is nothing to do with the bank or email site you thought it was;

Rootkit A snooping and/or control program running at the kernel/user mode level in the computer, invisible to normal "running processes" investigative tools such as Task Manager. Many current spyware scanners are unaware of rootkits;

Screen Capture Effectively a "digital photograph" of what is showing on the monitor at any particular time. These photographs are recorded electronically inside the computer and may be taken each time the screen changes, or upon something like a mouse click or keystroke triggering a new character in a box. This way, even if you are protected from keystroke loggers, a criminal can still steal your password or credit card number. Another (very unlikely, yet still plausible) possible screen capture method would be a real camera somewhere in the cybercafe, aimed at the screen or keyboard;

Trojan horse Sometimes installed through an apparently useful and innocent program containing additional hidden code which allows the unauthorized collection and exploitation of data. Some downloadable games contain Trojan horses, many file-sharing programs (eDonkey, eMule, BitTorrent) are suspect, as are some files shared through P2P. A Trojan horse can also arrive as an email attachment, or be downloaded through an Internet link you clicked on;

Virus, worm A virus is a string of code which needs to "infect" a file on the computer before it can replicate itself. The file it infects provide the rest of the code needed for the virus to work, just like a cold virus needs a warm throat to begin its action of replication. A worm is a complete bundle of code and simply takes up residence, often inside the system folder of your machine, assuming an innocent name like "kernel32.exe". Interestingly, the first worm ever written didn't target Windows, it was sent in 1988 before that operating system appeared. Viruses and worms these days are capable of various exploits. Many aim to turn the target computer into a "zombie" which can be remotely controlled by a criminal to send more viruses, worms, email spam... you name it.

 

If you have a USB flash drive (called variously pen-drive, thumb-drive or USB memory stick), you have a partial solution to the infected-with-spyware Internet café problem. USB flash drives are really cheap these days ($10/ €8 will get you one large enough for carrying your own portable cleaning application, password safe and - if you want - browser and email applications wherever you go). You can download a complete package of portable software from this site, or assemble your own collection. Read on for my recommendations...

Internet café bug cleaner prepackaged

Download this package of programs to use on a USB stick when you travel. It will make surfing and entering passwords a more safe and secure venture. You will also save time when it comes to cleaning up your tracks and traces at the end of an Internet session. There are two versions; the basic one is suitable for people with little technical knowledge.
 

cafeKlysm is a collection of portable programs with the focus on security while using public computers. The basic version will fit on a 256MB or larger flash drive. cafeKlysm is totally free to use and free of any advertising or spyware. The basic version includes the Firefox browser, KeePass secure password store, an onscreen keyboard and CCleaner computer cleanup application, which is all you'll need to enter passwords safely and clean up your tracks after browsing on a cybercafé computer. There is a "safely remove the USB drive" feature which allows easy removal of the USB drive even when Windows complains some file is still in use, something you're sure to need at least once on your travels.


the basic version of cafeKlysm


The full version contains all those programs, plus Mozilla Thunderbird, Pidgin instant messaging client, KeyScrambler keyboard encrypter, ClamWin portable antivirus, a Hosts file editor and a network analyser tool which is rather more convenient to use than the built-in Netstat program. Read more about cafeKlysm and download it here.

Internet café bug cleaner DIY style

Assemble your own bundle of programs to aid with cybercafe privacy.

You can of course load the portable programs separately yourself, although you'll miss the convenience of cafeKlysm's launcher (so needing many more clicks to start each program), the 16 page (in PDF) help file included with either version and the "safe eject" feature.

If you do want to download the separate programs, here are my recommendations:

1. Mozilla Firefox, Portable Edition takes up a tiny 4.7MB space and can easily be run on an Internet café computer instead of Internet Explorer (it does not need an administrator account to run it), giving you many advantages in security. All of your settings will be saved to your USB drive, so you can travel with an extensive stack of bookmarks, for instance. Firefox is a fast, full-featured web browser that's easy to use. It boasts many features including popup blocking, tabbed browsing, integrated search, improved privacy features and anti-phishing. Get the Mozilla Firefox, Portable Edition (it's free) here.

2. Mozilla Thunderbird, Portable Edition. You can access your email by Firefox through Yahoo/Gmail/Hotmail/your local email service's web interface, or you can go one stage further and use a proper email client. This way, all passwords are stored on your USB key - there's nothing you have to type into a text box on the screen. This is good, because it means key loggers can't steal your passwords. Mozilla Thunderbird is a safe and fast email client that's free, and as simple to use as MS Outlook Express. It has an excellent feature set including quick message search, customizable views, support for IMAP/POP email, RSS support and more. Plus, the portable version leaves no personal information behind on the machine you run it on, so you can take your email and address book with you wherever you go. Get the portable version of Thunderbird (6.7MB) here.

3. KeyScrambler Personal. To give at least some safety against key loggers (hardware versions are excepted, as I state above) when you enter name and passwords into sites, download KeyScrambler Personal. This free software (1MB) is a browser plugin which works with Internet Explorer, Firefox and WinVista to encrypt data as it passes from the keyboard driver through the operating system to the browser you are using. You don't have to understand how it works, but it does offer protection. KeyScrambler works with all keyboard layouts and it shields you on all websites: your login credentials, credit card numbers, passwords and search terms. You will need to pay for versions of KeyScrambler which will safeguard other browsers such as Opera, Maxthon or Safari and email clients like Thunderbird and Outlook. You'll need to be using an administrator account on the computer you are using, as KeyScrambler has to be installed. It is the only application listed here with this requirement - all of the others will work in a limited or guest account.

You are protected by KeyScrambler on all the "input fields" (places you can type) of the page, but don't let that feature make you over-confident. The information you enter has to leave the browser to travel to the target server, and unencrypted communication between your browser and a website is as public as writing your information on a postcard and mailing it the traditional way. Even encrypted communication can be reconstructed if the trojan in the computer uses something to capture the actual packets leaving the system, but that's a risk you'll either have to swallow or inspect with NetStat to eliminate it.

4. KeePass Portable Edition. Typing passwords into an onscreen window if you don't use Key Scrambler (above) runs a risk that password stealing malware will log your keystrokes. A way around this is to copy and paste the passwords from a secure password store. The KeePass program does exactly this in a portable version (about 1MB) which you can add to your security collection on a USB drive, iPod or CD. This way, one master password unlocks the password database and you insert the password with a single key action, making it harder for key loggers to capture anything (controls for the copy and paste of user name and password are on the application). Completely free, you can download KeePass here. It's so useful you may want to adopt it to remember passwords on your home computer.

5. CCleaner Portable Edition. Have you ever wanted to spend more time in an Internet cafe doing useful things like reading your email messages and less time deleting all the temporary files, cookies and history left over from your surfing? With one click you'll be able to clean your tracks using CCleaner. It's just 800kB to download from here.

6. Neo's SafeKeys. An onscreen keyboard which changes its position and dimensions each time you launch it (to fool mouse loggers), and which you type your passwords on before dragging them to a box on your login page. It's vastly more secure than using the Windows in-built keyboard. A very small download (40kB) here.

 

Basic hygiene in an Internet café

The tips in this section won't protect you from keyloggers or other spies on the computer. They are merely elementary precautions which will prevent the next user in the cybercafé from being able to see the sites you visited, or - worse - log in to your email account.

There are three things you absolutely must do when using a public computer:

• Stop the browser (Internet Explorer is the most common one)
  recording the history of the sites you visited,

• Prevent it from saving your passwords and

• Clean up any traces of your surfing before you leave.