The Web is a fount of information, a busy marketplace, a thriving social scene — and a den of criminal activity. Criminals have found abundant opportunities to undertake stealthy attacks on ordinary Web users that can be hard
to stop, experts say. Hackers are lacing Web sites — often legitimate ones — with so-called malware, which can silently infiltrate visiting PCs to steal sensitive personal information and then turn the computers into “zombies” that can be used to spew spam and more malware onto the Internet.
At one time, virus attacks were obvious to users, said Alan Paller, director of research at the SANS Institute, a training organization for computer security professionals. He explained that now, the attacks were more silent. “Now it’s much, much easier infecting trusted Web sites,” he said, “and getting your zombies that way.” So it is more important than ever to protect yourself. Here are some basic tips for thwarting them.
Protect the Browser The most direct line of attack is the browser, said Vincent Weafer, vice president of Symantec Security Response. Internet Explorer and Firefox are the most targeted browsers because they are the most popular. If you use current versions, and download security updates as they become available, you can surf safely. But there can still be exposure between when a vulnerability is discovered and an update becomes available, so you will need up-to-date security software as well to try to block any attacks that may emerge, especially if you have a Windows PC.
Get Adobe Updates
Most consumers are familiar with Adobe Reader, for PDF files, and Adobe’s Flash Player. In the last year, a virtual epidemic of attacks has exploited their flaws; almost half of all attacks now come hidden in PDF files. Part of the problem is that many computers run old, vulnerable versions. But as of April, it has become easier to get automatic updates from Adobe.
Beware Malicious Ads
An increasingly popular way to get attacks onto Web sites people trust is to slip them into advertisements, usually by duping small-time ad networks. Malvertising, as this practice is known, can exploit software vulnerabilities or dispatch deceptive pop-up messages.
A particularly popular swindle involves an alert that a virus was found on the computer, followed by urgent messages to buy software to remove it. Of course, there is no virus and the security software, known as scareware, is fake. It is a ploy to get credit card numbers and $40 or $50.
Closing the pop-up or killing the browser will usually end the episode. But if you encounter this scam, check your PC with trusted security software or Microsoft’s free Malicious Software Removal Tool.
Poisoned Search Results
Online criminals are also trying to manipulate search engines into placing malicious sites toward the top of results pages for popular keywords. Google and search engines like Microsoft’s Bing are working to detect malicious sites and remove them from their indexes. Free tools like McAfee’s SiteAdvisor and the Firefox add-on Web of Trust can also help — warning about potentially dangerous links.
Antisocial Media
Attackers also use e-mail, instant messaging, blog comments and social networks like Facebook and Twitter to induce people to visit their sites. It’s best to accept “friend” requests only from people you know, and to guard your passwords. Phishers are trying to filch login information so they can infiltrate accounts, impersonate you to try to scam others out of money and gather personal information about you and your friends.