Internet Security Vulnerabilities

Windows Weaknesses - Web Browsers Weaknesses
E-mail Weaknesses - More About Security Issues

Web Security Affects You

Web security is not a new issue, but increasing e-commerce and the fact that more folks are using broadband (always-connected) Internet services are creating the necessity of improving security. There are serious flaws in some browsers, which is further aggravated by security holes in the Windows operating system itself.

While the information on this page may not be light reading I recommend that you peruse it. To ignore it is to do so at your own peril.

Windows Security Weaknesses

While this page discusses issues with Windows 95, 98/SE and ME operating systems, all fall short of what is desirable.

Upgrade to Windows XP SP2 Immediately

I recommended that you move immediately to Windows XP with Service Pack 2 or to an alternative operating system. While Windows XP is far from perfect, it offers greater protection than older versions of Windows afford.

Microsoft doesn't offer updates to XP systems not running Service Pack 2 or later (Service Pack 3 is now available).

Support Discontinued for Older Windows

Microsoft discontinued support for Windows 98/98SE/Me on July 11, 2006 and Windows XP with SP1 or earlier on October 10, 2006.

If you are running Windows XP with only Service Pack 1, upgrade immediately—Service Pack 2 is a free update.
If you are running a bootleg (illegal) copy of Windows XP the new Genuine Advantage program will deny updates to you. Obtain a legitimate license from Microsoft or see your vendor to rectify the issue.
If you are running an earlier version of Windows, check to see if your computer hardware will support Windows XP with SP2 (although these requirements seem very minimal if you want to run anything but Windows XP.

Personal Choices are Important

There are a multitude of choices that you make (or can make) that will affect how secure your computer is. These can affect your privacy and the safety of your children while on-line.

You will find Bruce Schneier's discussion about Safe Personal Computing informative.

There are Windows Alternatives

Other operating systems such as Linux and Apple Macintosh offer fewer problems when it comes to virus propagation and other security issues. This is partly due to their relative smaller footprint in the computer world and partly due to better design.

For instance, Linux offers a breakdown of what is permitted when the system is being run under the root (administrator) password and what is permitted for other users. Having to login as root (or superuser) to do installs and settings changes is one reason why Linux is perceived to be "harder to use" than Windows.

Be Aware of the Trade-offs

The trade-off is between security and ease of use. While some of this control of functionality is included in Windows XP (and Windows 2000) there are some decisions that have been made that increase overall risk. Also, many standard XP home computers have only one account, which includes all the administrator privileges. Typically Linux users are much more aware of these dangers and tend to create a separate user account from the administrator account.

While Windows is less secure than Linux this allows for easier installs, upgrades and exchange of information. Linux also has it's vulnerabilities, but these are fewer in number.

An Analogy

Windows was built to be easy to use, with security apparently a casual afterthought. Consider the following analogy when deciding that "easier is better" in your computing experience:

Using Internet Explorer in Windows is like leaving your car parked downtown overnight with the doors unlocked, the windows rolled down and the keys in the ignition, then wondering why your car is gone in the morning.

While it may be inconvenient to install updates and use alternatives to the tightly intertwined (and therefore mutually vulnerable) Microsoft programs, you might consider why your car has those inconvenient locks and seatbelts. Cars once had neither, yet they were installed for a very good reason.

Always Install Windows Critical Updates

This section discusses some of the areas that you can address to improve the security of your Windows system.

To protect yourself from many of these vulnerabilities make sure you have the latest security patches for Windows and Office products you have installed:

Windows Update is available for Windows 98 and later (new updates only for Windows 2000 or XP).
Office Update is available for Office 2000 and later.

Weekly Maintenance Routine

This should be part of your weekly maintenance routine. You should maintain the updates to Internet Explorer even if you use another browser since IE is so tightly integrated into the Windows operating system.

Weekly a Bare Minimum

A study conducted by Symantec, best know for Norton Antivirus, determined that the time from release of a patch and the release of malicious code to exploit it is was only 5.8 days in the first half of 2004. This makes a weekly update a bare minimum.

Windows Critical Updates

Windows XP with Service Pack 2 has a Windows Critical Updates notification/installation utility. I'd suggest at least being notified (the downloads can consume a great deal of your bandwidth if you are on dialup or on a low-speed connection of any type) and install them as soon as you are able. Delays can be costly.

Windows Updates Options

There are three sections that show up in Windows Update:

Critical Updates and Service Packs
Windows Updates
Driver Updates

Always install the Critical Updates and Service Packs when available. These are considered vital to the safety of your Windows system.

The Windows Updates can be chosen to deal with particular issues you may be having. If you have no need for the particular updates, don't install them.

Driver Updates may fix a problem with hardware, but I have had some Microsoft driver updates corrupt Windows installations so you might wish to go to the component manufacturer's site for an update. This has been particularly true for some video driver updates but can be fixed in Windows XP (and ME) with the System Restore feature.

Disable ActiveX

ActiveX is a proprietary alternative to Java designed to enhance the performance of programs and to allow for easier upgrades to the Windows operating system. However, the lack of security allows destructive programs to use this feature to access areas of your computer that they wouldn't otherwise be able to attack.

The main difference between ActiveX and Java are the permissions available to the script. ActiveX can essentially access any area of your computer. Java is more restricted in its ability to access critical areas of your system so a rogue Java script can do less potential damage than a rogue ActiveX control.

A June 28, 2000 CNET News article recommended that people disable active scripting or ActiveX functionality. All versions of Internet Explorer and Outlook Express are vulnerable.

Read more about ActiveX and the dangers it can present:

To disable ActiveX follow this procedure:

Windows 95 users

Open the Control Panel, then click on the Internet icon.
Click on the Security tab.
Select the Custom radio button and click on Settings. Change the ActiveX settings to Prompt or to Disable ActiveX controls.

Windows 98/Me/2000/XP users

Open the Control Panel, then click on the Internet Options icon.
Click on the Security tab.
Click on the Custom Level button. Change the ActiveX settings to Prompt or to Disable ActiveX controls.

Note: If you completely disable ActiveX you will need to re-enable ActiveX if you want to obtain technical support or upgrades and fixes on Microsoft's site (including Windows Update).

The Prompt option will give you the option to run or not run the controls for any Web site you enter. This will be less of a bother if you are using another browser (recommended) as your primary Web surfing tool than if Internet Explorer is your primary browser.

Just remember that ActiveX should only be trusted to the extent that you would trust the owner of the site you are visiting. I'd suggest disabling unsigned ActiveX controls and those not marked as safe and be prompted for the rest.

Don't Use NetBUI

NetBUI is a significant weakness in Windows which was removed in Windows Me. If you are using networking only for a dial-up connection, close some security holes:

Windows 95/98 users

Click on Start, Settings, then open Dial-Up Networking. Right click on the icon for your Internet Connection and select Properties.
Click on the Server Types tab.
Ensure that you have only checked the Enable software compression and TCPIP options. The others are unnecessary for most dial-up connections.

Windows Me users

Click on Start, Settings, then open Dial-Up Networking. Right click on the icon for your Internet Connection and select Properties.
Click on the Networking Tab.
Ensure that you have only checked the Enable software compression and TCPIP options. The others are unnecessary for most dial-up connections.

Easier is Not Necessarily Better

Microsoft Office applications (including Outlook Express) use a programming language that allows for tight integration of the Office components and easier data linking than OLE provides. However this code provides a weakness that the Melissa class of viruses and many worm viruses have employed to spread their destruction.

Windows is so "dumbed down" in order not to upset the entry-level user that Microsoft has no right to then expect the level of competence to be higher when a user needs to make a choice of whether to click on an e-mail or not. James Gleick illustrates the power of scripts in an article discussing some of the Windows vulnerabilities exploited by the I Love You virus. Social engineering is such that we are more likely to open an e-mail (or click on a advertising link) that either appeals to our need for approval or to our fears.

One of the methods used by Windows operating systems to achieve this communication between programs is Visual Basic Script (VBS). Not everyone needs to have VBS enabled. You can disable it following the procedures offered on the F-Secure site. There are instructions for removing Windows Scripting Host on Windows 95, 98, 2000 and NT systems.

Return to top

Security Weaknesses in Web Browsers

Web browsers have their own shortcomings. Each browser has different challenges which are often addressed as new versions are released.

Use the Most Recent Browser

Whether you use Internet Explorer or Mozilla/Netscape or another browser, you should always upgrade to the most recent version and install any patches that are available. Newer versions of the same browser offer several advantages:

They are more likely to have earlier security concerns addressed.
Support for newer hardware and operating systems is usually only provided for current-level browsers.
The more recent a browser, the more likely it is that it will display Websites as the designer intended.
Users are driving demand for newer features which is unlikely to be added to older versions, like tabbed-browsing and Really Simple Syndication (RSS 2.0).

Use Browsers with Better Encryption

If you can meet the license requirements for the 128-bit RSA encryption for Mozilla or Internet Explorer Web browsers, this will provide better security than the 56-bit international versions. Most financial institutions will insist on this level of encryption before you can use their on-line services.

Browser-Security Risks

Browser Security Updates

Information is provided on known weaknesses of various Web browsers in use. Sometimes you need to dig to find this information, but the competition may point out the flaws for you.

Check for Internet Explorer Security Bulletins for news about flaws.
If you're unable to upgrade Internet Explorer (some multi-function printers only work with IE 6), check Internet Explorer 6 Security and Privacy for more information.
Check the Security Updates for Mozilla Products including Firefox and Thunderbird.
Check for Security, Privacy and Cookies in Opera.

Other Security Information

You may also wish to correct known potential security risks associated with various browsers found by other parties.

Secunia Research's Online Software Inspector checks for vulnerability in a number of programs including common browsers and e-mail programs. Offline Personal and Corporate Software Inspectors are available.
Georgi Guninski Security Research's report on Internet Explorer security shows the various vulnerabilities.

Older Browser Issues

While many of the issues with older browsers are intricate enough to only interest Website designers and browser technicians, older browsers will often incorrectly display newer Websites, if they can display them at all.

Even if you are willing to put up with increasing difficulties with display issues, you cannot walk away from the security dangers of using older, unpatched browsers.

Assessing Your Risk

The following sites can help you to assess the security risks posed by your current browser, and suggest fixes that are necessary. Be sure to follow the instructions closely, which includes not opening files if prompted to do so.

The Scanit Browser Security Test offers several options in selecting their tests and works with most browsers. The Browser Security Test Statistics are interesting.
Qualys will check Internet Explorer only.

Return to top

Security Weaknesses in E-mail Programs

There are security issues with all e-mail programs but this is most pronounced in Outlook and Outlook Express. Because they are pre-installed in Windows most users continue to use them without checking for any other options.

Outlook and Outlook Express suffer from the same weaknesses as the Internet Explorer family. I'd recommend not using these products but to download and use one of the alternative e-mail programs that meet your needs. I strongly recommend PocoMail/Barca for the ease of use, especially considering that it was built from the ground up with security in mind.

If you continue to use Outlook (especially for the PIM features) or Outlook Express you should reduce your risk with the following changes to settings.

Windows Scripting Host enables Outlook Express to open attachments and run programs without asking first. Since most users don't use Basic scripting this should not compromise functionality for the majority. You can disable Windows Scripting Host by following the procedures offered on the F-Secure site. There are instructions for removing Windows Scripting Host on Windows 95, 98, 2000 and NT systems.

To turn off ActiveX in Outlook Express:

From the Tools menu select Options and click on the Security tab. Set the security zone to Restricted Sites. While less convenient it will
Internet Explorer 6 also has an option which should be checked: "Do not allow attachments to be saved or opened that could potentially be a virus."

To turn off ActiveX in Outlook:

From the Tools menu select Options and click on the Security tab. Set the security zone for Outlook HTML mail to Restricted Sites.
You should click through the other tabs and disable all options for ActiveX Controls and plug-ins and Scripting.
Do not select Use Microsoft Word as the e-mail editor" in Outlook. The scripting is vulnerable to viruses.

Return to top

More About Security Issues

The following related pages offer more information about security:

Security Basics—Preventing Unauthorized Access
Firewalls—Your First Line of Defense
ZoneAlarm Security— Recommended Firewall Products
Your Privacy At Risk—Spyware Detection & Removal
Passwords and Encryption—Protecting Your Electronic Signature
Anti-Virus Protection—Current Alerts, Strategies, Hoaxes & Software
Avoiding Spam & Copyright Abuses—Promote Responsible Net Commerce

Return to top

www.RussHarvey.bc.ca/resources/websecurity.html
Updated: October 2, 2009