How often have you had issues with your computer and called tech support, only to be told you have a virus or that spyware has been installed on your computer? Even people who are careful sometimes end up with malicious software on their computers. This is due, in part, to the nature of how a computer communicates.

There are 65,535 available ports, or points of entry, that can be accessed on a computer and many of them have to be open by default to perform normal Internet communications, such as Web surfing, sending e-mail, and using various programs. Hackers can exploit this to send self-installing malware to your computer through an open port. In addition, unscrupulous people called “social engineers” and “phishers” use various methods to extract information, such as passwords or personal information, from unaware users.

The bulk of this lesson covers malware – a general term for spam, spyware, viruses, and other malicious software. However, this first section covers some of the other, less-obvious security threats you might face while using today’s Internet-connected technology devices, such as notebook and desktop computers, PDAs (personal digital assistants) and smartphones.

Social Engineering

Social engineering – also called pretexting – plays on human behavior and how people interact with one another. It involves getting information under false pretenses. Here are some examples of social engineering scams:

• The scammer visits your office and claims to be from the IT department. He says he needs to fix your computer, and asks for your account name and password so he can log onto your account.
• The scammer plays on your sympathy, pretending to be a new employee who has forgotten the code to get into the secure part of the building, and says he’ll get fired unless you help him out by sharing the code.
• The scammer calls, pretending to be one of the “big bosses” in the company, and tries to intimidate you into giving information.

To protect yourself, never feel that you have to give out sensitive information to someone you don’t know. If someone asks you for these types of information, there are several pieces of information that you should be gathering instead:

• Ask for the correct spelling of the person’s name.
• Ask for her employee number.
• Ask him to tell you your account number.
• Ask her which transactions have been processed and you’ll either verify or deny the transaction.
• Who does the person claim he or she is representing?

If the caller is not legitimate, asking these questions will usually let you know. Remember that social engineering plays on human behavior and willingness to help and trust others. To protect your confidential information, you must not be so willing and trusting.

Phishing

When this type of information gathering is done via e-mail, it’s called phishing, because basically the person is fishing for information.

Here’s how it works: You receive an e-mail that appears to be from your bank stating that the bank is having some trouble processing some automatic payments. The e-mail explains that to clear up the problem, you need to click the provided link and log in to the Web site using your user name and password. If you do, you’re directed to a fake Web site where your information is captured.

You can often spot these scams by hovering your mouse pointer over the URL (uniform resource locator) in the e-mail message. Usually, the link that appears in a pop-up tooltip is different from the diplayed link. For example, the displayed link shows www.xyzbank.com; however, when you hover your mouse pointer over it, something similar to www.badguy.ru/xyzbank appears in a tooltip. Many of these sites are on foreign servers, as indicated by .ru (for Russia) as the top level domain.

The fake Web site, which looks exactly like your bank’s real Web site, has been set up for the sole purpose of stealing personal information. Unsuspecting people are often fooled into entering credit card numbers, bank account numbers, passwords, and other details. Approximately 5 percent of e-mail recipients respond to phishing messages, but that’s enough to make it worthwhile for the phishers because they may be able to clean out those people’s bank accounts or run up credit card bills for thousands of dollars.

You should never respond to an e-mail asking you to verify any kind of personal information. Reputable companies don’t ask their customers for passwords or account details in an e-mail or phone call. Even if you think the e-mail or phone call may be legitimate, don’t respond. Instead, contact the company by phone or by visiting their Web site directly. (The one you have bookmarked; not the one sent to you via e-mail.)

Identity Theft

Identity theft occurs when someone gains access to some or all of your personal information — name, address, Social Security number, driver’s license number, birth date, and bank or credit card account numbers — and uses them without your permission. A thief can clean out your account, or run up a balance, within hours without you being aware of it until well after the crime’s been committed.

Identity theft is a serious crime that’s punishable by law in most states. However, it’s up to you to minimize the threat of identity theft by keeping your confidential information private. If you believe you’re a victim of identity theft, contact your bank or credit card company and local law enforcement office immediately to report the crime. You can also get further assistance from your state’s identity theft Web site. Just go online and search for identity theft your state to find the appropriate Web site and phone numbers.

Identity theft can also occur when a thief steals a device that contains personal information. Notebook computers are easily stolen or lost, along with whatever data is stored on them. You can — and should — use file encryption to protect sensitive data stored on a notebook computer. New technologies, such as the BitLocker feature in some editions of Windows Vista, can encrypt the entire drive. You can also buy software that causes your stolen notebook to “phone home” if the thief gets on the Internet without entering the correct passwords.

Today, in addition to a cell phone, many people carry a PDA or full fledged handheld computer. A personal organizer often contains a large amount of important personal information — and not only your own, but also that of other people in your address book.

Minimally, you should require a password to even access the handheld device or PDA. Every device is different, so be sure to read your owner’s manual to find out how to password protect yours. For better security, some devices now come with biometric security, so you must swipe your fingerprint to start the device.

Just like junk mail clogs your regular mailbox, spam clogs your e-mail inbox. Spam is a term that refers to the sending of unsolicited commercial e-mail. Most spam is commercial advertising, often for products such as get-rich-quick schemes, physical enhancements, adult Web sites, and cheap medications. Spam costs the sender very little to send because the actual costs are paid for by the carriers rather than by the sender.

E-mail spam targets individual users with direct e-mail messages. Spammers create their e-mail lists by scanning newsgroup postings, stealing Internet mailing lists, or searching Web sites for e-mail addresses. Spammers use automated tools to subscribe to as many mailing lists as possible so they can capture the lists of addresses, or use the mailing list as a direct target for their attacks.

Spyware is computer software that collects personal information about a computer user without the user’s informed consent. Spyware is often installed through “drive-by downloads” from malicious Web pages running code or along with another legitimate program you intended to install.

Spyware may also be advertising-supported software, called adware. Adware enables advertisers to make money from a product without directly selling it to the users. The companies also install additional tracking software on your computer, which continuously keeps in contact with the company over your Internet connection. It reports data to the company, such as your surfing habits and which Web sites you’ve visited.

Although adware companies state there will be no sensitive or identifying data collected from your computer, the fact remains that you have software on your PC that’s sending information about you and your surfing habits to a remote location.

Adware is not an illegal type of software; however, there are certain privacy issues involved. Legitimate adware companies disclose the nature of data that’s collected and transmitted, but there’s almost always no way for the user to actually control which data is being sent. Plus, this technology is capable of sending more than just banner statistics.

Another type of spyware is surveillance software that’s designed to collect much more than just information about what Web sites you visit. Keystroke loggers, screen capture programs, chat loggers, and similar programs can enable someone else to see every character you’ve typed or what has appeared on your monitor. This type of spyware is used for genuine spying purposes — by suspicious spouses, worried parents, private detectives, and even government agencies (with a warrant). Although these tools are perfectly legal in most instances, if they’re abused, they can violate your privacy. So what can you do about spyware?

How do I know if my computer has a spyware

Here are some indications your computer may contain spyware:

• The computer is slower than it used to be, especially when browsing the Internet.
• It takes a long time for the Microsoft Windows desktop to come up.
• Clicking a link does nothing or goes to a different Web site than expected.
• Your browser home page changes and you may not be able to reset it.
• Web pages are automatically added to your Favorites list.