Security Guide Writing Help Requiered

Bethrezen · Aug 10, 2004

Hi all

I'm wondering if anyone can help me out here coz I'm really running in to a brick wall with this I'm trying to write a guide to help people secure there system but I'm having some real problems mostly with how IE, OE and WMP should be configured

Here are the 2 pages I have used to help me write what I have so far

http://www.lavasoftsupport.com/index.php?showtopic=14537
http://boards.cexx.org/viewtopic.php?t=957

My only trouble is that I'm having a few problems following them especially the one on the lavasoft board as you will have no doubte noticed if you read everything that I have written

My other problem is that I don't have an instructions list for media player and how that should best be configured for maximum security

Any way here is what I have so far I was wondering if you all could look this over for me and help me out suggest any improvement anything iv missed also point me in the direction of the needed information so I can finish writing this and get it posted

Helping To Keep Your System Clean After Cleansing

The first stage in this process is cleaning instructions on how to do this are given above. Once you have read through and carried out the instructions above and we've finally gotten your system clean you'll want to keep it that way right ?? of course you do !! however in order to achieve this we are going to have to lock down your system because when Microsoft ships there system they are trying to make it "easy" for you to surf the web, NOT SAFE !!!

Now in order to maintain good system security there are several things you should do

The First most important thing you should do is to make sure you have all the correct security software the minimum you should have to maintain a healthy system is a good Firewall, Anti-Virus, Anti-Trojan and Anti-Spyware here are a few recommended ones

Firewall: Zone Alarm, Outpost, Sygate
Anti-Virus: AVG, AntiVir, Avast
Anti-Trojan: A², Ewido Security Suite
Anti-Spyware: Ad-Aware, Spybot-S&D

Another program you may want to consider is Spyware Guard

SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware!
Click to expand...

The Second most important thing you should do is to always keep as current as possible with all the latest bug/security fixes not only for Windows but for all your programs this is especially important when it come programs like your Anti-Virus, Anti-Trojan and Anti-Spyware

The Third most important thing is to secure your system by locking down all of Windows BIGGEST security holes these includes Internet Explorer, Outlook Express, Windows Media Player and File And Printer Sharing among others

A good way to eliminate a lot of these problems is to simply get rid of Microsoft’s inferior technology all together and use one of the many safer Freeware/Open source alternatives because by doing so you will be saving your self from all the current and future security vulnerabilities created by these programs a good place to find many Freeware/Open source programs is The Source Forge or Openwares

The Forth and most important thing you should do is watch what you download !! Many Freeware and P2P programs like Grokster, Imesh and Kazaa come with an enormous amounts of spyware that will eat resources, slow your system or clash with other software, possibly causing your Software, Browser or even Windows itself to crash

The fifth most important things you can do is to is to be informed subscribe to security news letters to keep up to date with all the latest threats read and learn as much as you can because knowledge is power the more knowledge you have the safer you will be below is a few links to resources that will help you do just that

http://www.tom-cat.com/security.html
http://www.dslreports.com/faq/security

Ok so recommendations over its time to get to work and start locking things down

First its recommended that you Disable file and printer sharing if you don't need it as it will enhance security and give attackers 1 less way into your system Complete instructions for Windows 98 and Windows NT can be found Here Instructions for Windows XP and Windows 2000 can be found Here

Next we need to lock down 3 of windows other big security holes Internet Explorer, Outlook Express & Windows Media Player in order to make these safe from attack by Viruses Trojans drive by install and other such vulnerabilities we are going to have to reconfigure there security settings as follows

Internet Explorer

Open Internet Options either through control panel or by opening Internet Explorer and then clicking Tools\Internet Options

Next click on the Security tab and select Internet Zone then press the Custom Level button and re-configure the settings as follows

ActiveX:
Prompt, Disable, Disable, Prompt, Enable

Downloads:
Enable, Prompt

Miscellaneous:
Prompt, Enable, Prompt, Disable, Enable, Prompt, Disable, Enable, high safety, Enable, Disable

Scripting:
Enable, Prompt, Prompt

Authentication:
Prompt

You may also see settings for Net Framework if you have it installed if so then configure them as follows

Net Framework:
Prompt, Prompt

Once done hit ok to close the window then click apply to save the changes

Next select the Advanced tab and configure as follows

Accessibility:

Browsing:

HTTP 1.1 Settings:

Multimedia:

Printing:

Search From The Address Bar:

Security:

You can also further secure Internet Explorer down by installing the following

IE-SPYAD: Restricted Sites List For Internet Explorer Found Here

IE-SPYAD is a Registry file (IE-ADS.REG) that adds a long list of sites and domains associated with known advertisers, marketers, and crapware pushers to the restricted sites zone of Internet Explorer. Once this list of sites and domains is "merged" into your Registry, most marketers, advertisers, and crapware pushers on the Net will not be able to use cookies, ActiveX controls, Java applets, or scripting to compromise your privacy or your PC while you surf the Net. Nor will they be able to use your browser to push unwanted pop-ups, cookies, or auto-installing programs on you.
Click to expand...

ActiveX Spyware Block List One Can Be Found Here

Tired of all that Spyware and Adware crap being installed by ActiveX ?
But don't want to lose out on functionality?

We have created a system that blocks all known "bad" ActiveX controls from running inside Internet Explorer by setting the "Kill bit".

When a page tries to install a component from our list, it will fail.
When a page tries to use a component from our list that was already present on your system, it will fail too!

Other, "friendly" components are not affected.
For a full technical explanation how this works, look at this Microsoft article.
Click to expand...

After downloading and installing these Open Internet Options again either through control panel or by opening Internet Explorer and then clicking Tools\Internet Options

Next click on the Security tab and select Restricted Zone then press the Custom Level button and re-configure the settings so that everything is set to Disable or Prompt (setting it to "High" is not enough) once done hit ok to close the window then click apply to save the changes

Next we need to Enable active scripting for trusted sights like windows update because you may find that the above settings will brake sights like windows update that require active scripting this can be done as follows

Open Internet Options either through control panel or by opening Internet Explorer and then clicking Tools\Internet Options

Next click on the Security tab and select Trusted Zone then press the Sights button and either cut and paste or type the URL of the trusted sight and hit the add button then ok the change and exit internet options then just refresh the page when you are done

Ok next we need to configure Internet Explorers Cookie settings

Open Internet Options either through control panel or by opening Internet Explorer and then clicking Tools\Internet Options

Next click on the Privacy Tab and select the Advanced Button

Check the Override Automatic Cookie Handling box then Select Block under both First & Third-party Cookies and check the Always allow session cookies box

Click Ok and exit Internet options

If you find that there is a sight that requires the use of cookies such as logging in to your on line banking, email, forum boards Etc then all you need to do is go back in to your cookie settings press the edit button then type in the appropriate URL and press allow then ok the change clear your cashe reload the page and you should now be able to log in

Outlook Express

Start Outlook Express

Click View & Select Layout

Uncheck Show Preview Pane

Hit Apply to save the change then hit ok and exit

Click Tools & Select Options

Select Read Tab

Uncheck automatically download messages when viewing in the preview pane

Check the Read All Messages In Plaintext

Click the Send Tab

Place a dot next to Plain Text for Mail Sending Format

Place a dot next to Plain Text for News Sending Format

Click the Security Tab

Place a dot next to "Restricted Zone"

Check the Warn when other applications try to send email as me
Check do not allow attachments to be saved or opened that could potentially be a virus

Note: Please be aware that with the Do not allow attachments to be saved option enabled your ability to receive attachments is almost zero

Now hit apply to save the changes and that should be Outlook Express nicely secured

Windows Media Player

Instructions Here

After following these instructions you my also want to apply this patch by Java Cool

Windows Media Player Scripting Fix

Windows Media Player, by default, supports a dangerous feature that allows scripting to be embedded within media files. Windows Media Player will then execute the scripting when the media file is played. The Windows Media Player Scripting Fix is a small application that disables Windows Media Player scripting simply, and easily, with the press of a button - scripting can also be re-enabled at a later date with this same program.

So why is scripting in WMP dangerous? because Windows Media Player scripting functions can be used to execute programs, open web pages, and much more when you open any media file that has them embedded.
Click to expand...

Ok now that we have locked down Internet Explorer, Outlook Express, Windows Media Player and File & Printer Sharing its time to cover a few OS Specific problems

First you should apply these 2 patches from the creators of BOCLEAN

HTA Stop 2003

It's now possible for a "rogue" website to actually embed Trojans, worms and/or viruses directly into a web page. In the past, pages that offer seemingly attractive downloads which contain such malware required you to click to start any download to your computer. Now it's become automatic, using features in the Windows operating system known as scripting. These scripts can load programs without you knowing, and then they run immediately. All you have to do is visit the site, without doing anything besides viewing the page. HTAstop acts as a brick wall against these scripts, disabling them so the download doesn't occur
Click to expand...

However Win 2000 And XP users should see this warning before applying this patch

For reasons that only Microsoft can explain, recent Windows updates have changed the functionality of some items in the Control Panel applet. If you select "USER ACCOUNTS" or "ADD/REMOVE PROGRAMS" Control Panel may not respond or will open Notepad with an error message instead. This is because Microsoft has decided to replace the original Control Panel programs with actual HTA SCRIPTING! Since HTA has been stopped, this too will also be stopped because the MSHTA.EXE program which HTAStop stops is not available.

The solution to this problem is to run HTAStop and PERMIT HTA long enough to do what you need to do, then turn it back off again so as to protect your security. Microsoft is using MSHTA for these Control Panel functions now, and HTAStop has blocked MSHTA.EXE from running.
Click to expand...

DSO Stop2

The "DSO Exploit" (Data Source Object) was first reported by GreyMagic Software of Israel on February 27, 2002 and a "workaround" for Microsoft's defective code was provided by Axel Pettinger and Garland Hopkins on March 3, 2002 involving the editing of the Windows registry to alter values contained within Internet Explorer's Internet Zones configurations. Because many computer users are extremely nervous (and justifiably so) about manually editing the Windows registry, owing to years of warnings and advisories as to the dangers of editing the registry, Privacy Software has provided this FREE utility to safely do it for those who do not feel confident running and editing "Regedit." We have provided this software to the general public to solve a problem since no one else has stepped up to the plate to solve a serious problem as of the time of this release.
Click to expand...

For toughs of you that are still using Win95/98/ME you should apply these 2 excellent patches from DiamondCS

Anti-Polymorphism Patch

This patch prevents Windows Scripts (such as VBScript and JavaScript) from being able to read/write to themselves, making Windows Script polymorphism nearly impossible through conventional means. This can prevent polymorphic worms from executing.
Click to expand...

Saved Passwords Lock Patch

Safely Disables the WNetEnumCachedPasswords function in MPR.DLL, stopping Trojans and other malicious programs from obtaining your passwords. A demo program is included that shows you which password information is available on your system.
Click to expand...

Toughs of you that are using WinXP should grab a copy of XP Antispy

Note: However please be aware that if you are using Ewido Security Suite you do not need this as Ewido Security Suite already includes XP-Antispy

XP Antispy

MS has integrated some tools and services into the system, that can automatically connect to the net without your permission and with out you knowing about it. Nobody knows what's possible being transferred to and from your computer via these services so if you want to stop this behaviour download XP Antispy this program will let you safely Disable and re-Enable XP's "Phoning Home" services
Click to expand...

Toughs of you that are running older systems like 98/ME/2000 should grab a copy of Safe XP this app is very similar to XP Antispy but will not only work with XP but will also work with 98, ME & 2000

Safe XP

Safe XP allows users to quickly tweak various security and privacy related settings in 98/ME/2000/XP. The options include Media Player settings, Services settings (error reporting, time synch, remote registry etc.), as well as an option to remove items from the Start menu, network security settings and more. Safe XP improves your system performance and makes Windows run faster, more secure and reliable! And is suitable for beginners and experts alike!
Click to expand...

Ok now you have secured your system you we need to test your defences effectiveness below are a few sights that provide security validation services to allow you to do just that

http://cybercoyote.org/security/tests.htm

And finally if you have any questions comments suggestions maybe iv missed something important that you think should be included or maybe I’ve given instructions incorrectly or in a confusing manor and you cant follow it what ever the case if you have any problems feel free to contact me and ill see what I can do
Click to expand...

ronjor · Jul 28, 2004

Ewido includes xp-antispy as part of the suite.

Bethrezen · Jul 28, 2004

hi

i didnt know that ill be sure to add a note that users of Ewido dont need xp antispy

ronjor · Jul 28, 2004

Bethrezen

Good luck with your instructions. I'm sure a lot of people will help.

That is not easy.

Tips

More tips

Bethrezen · Jul 28, 2004

hi

thanks for the links looking now

Bethrezen · Aug 1, 2004

hi all

im suprised that i have so few responces to this request for help normaly it wouldnt matter but in this case it does coz im trying to do somthing that could be really worth while

i know there are alot of places around that cover stuff like this but i want to go one step further i want to compile all this infomation in one place and to be ad detailed as possable covering as much as possable and i want to do it in a easy to follow format so that even the none computer savie amoung us can take advantage of all of the wisdome of the security comunity the way i have

when i first got a computer i know almost nothing about them but over the years comming here and eles where reading and asking lots of questions and experimenting i have learned a grate deal and i want to do my part to give a little back

SO COME ON PEOPLE HELP ME OUT PLEASE !!!

Blackspear · Aug 1, 2004

This site seems to be the best that I can find on securing your PC:

http://www.tom-cat.com/security.html

And this isn't too bad as well:

http://www.dslreports.com/faq/security

See this thread for what I have on my home system:

https://www.wilderssecurity.com/showthread.php?t=43117

Hope this helps...

Cheers

Bethrezen · Aug 1, 2004

hi

Thanks for ya reply updating

Justhelping · Aug 2, 2004

The problem is that I can think of a zillion things to do to secure your computer. But I don't know which is really more critical.

Bethrezen · Aug 4, 2004

hi

well what im trying to do is to covers the fundimentals sure there is loads ya could do but not all of these things would be sutable for everyone for one resion or another so what im tryin to do is just covering the basics that apply to everyone these are things that every computer user on the net today should know and do in order to keep there comp safe

so neway with the above in mind try to thinks of anything that i may have not covered like critical vunribilities that allow attackers to do nasty things like deleat a persions whole hard drive

or read over what i have writen already and let me know if i have made any mistakes or missed anything

failing that give me links to sights that contain useful relevent infomation that i can link to in order to help educate people

Blackspear · Aug 4, 2004

Bethrezen said:

...read over what i have writen already and let me know if i have made any mistakes or missed anything
Click to expand...

Two realy important ones that you have missed are:

Spyware Blaster (free) - Spyware prevention
Spyware Guard (free) - Browser Hijack prevention

Both by Javacool here at Wilders Security.

Hope this helps...

Cheers

bigc73542 · Aug 4, 2004

I am not sure but you might find something here you can use.

Bethrezen · Aug 10, 2004

hi

thanks for ya replies i'll have to try and work out a way to work in the additional suggestions but definitely useful

thanks

Bethrezen · Aug 13, 2004

Hey

What gives why have you disabled my ability to edit my post ?

What ever limit you have placed on editing posts I would appreciate it if you would remove it and restore my ability to edit this post because I have put a lot of time and effort in to writing this and I need to be able to edit it in order to update as new info becomes available to me the other thing is that there is a lot of html coding gone into this as well where I have pointed to various different places and there is far to much to remember so if I cant get in to edit all that's going to be lost

This isn't an unreasonable request I already email about this but have had no reply so now im posting in case my email wasn't received

come on people help me out here

please

Infinity · Aug 17, 2004

everybody can edit his own topics. I did that too some time ago.

the reason why: maybe you made your "helpkit" just too good...

maybe you can only edit once or twice.

to add something more: some imaging software can help you out in some cases like powerquest/symantec or True Image.

the a2 anti trojan , a free one with an upcoming resident guard however this is not for now.

Log in or Sign up

Security Guide Writing Help Requiered

Bethrezen Registered Member

ronjor Global Moderator

Bethrezen Registered Member

ronjor Global Moderator

Bethrezen Registered Member

Bethrezen Registered Member

Blackspear Global Moderator

Bethrezen Registered Member

Justhelping Guest

Bethrezen Registered Member

Blackspear Global Moderator

bigc73542 Retired Moderator

Bethrezen Registered Member

Bethrezen Registered Member

Infinity Registered Member

Log in or Sign up

Security Guide Writing Help Requiered

Bethrezen Registered Member

ronjor Global Moderator

Bethrezen Registered Member

ronjor Global Moderator

Bethrezen Registered Member

Bethrezen Registered Member

Blackspear Global Moderator

Bethrezen Registered Member

Justhelping Guest

Bethrezen Registered Member

Blackspear Global Moderator

bigc73542 Retired Moderator

Bethrezen Registered Member

Bethrezen Registered Member

Infinity Registered Member

Useful Searches