Tuesday, August 16, 2011

Should I turn my computer off when I'm not using it?

                                                        photo courtesy of www.freepixels.com
Q: Should I turn my computer off when I'm not using it?
A: Yes, but probably not for the first reason to spring to mind.


     Most people these days are more conscious of the energy their household is consuming, for both environmental and economical reasons.  But turning your computer off (and indeed unplugging those nasty little "wall warts") has not only energy benefits, but network and security benefits as well.

     In this day and age of "Always On" broadband connections, the concept of "always on" seems to have carried over to the power switch in the mind of most computer users these days.  Most of us think nothing of leaving a room with the computer running, even when we turn the overhead light off and intend to be gone for long periods of time.  The problem with this is that the digital underworld have noticed this trend too.

     Who is using your computer when your not home?

     Have you ever heard the acronym "DDOS"?  This stands for Distributed Denial Of Service attack, and is become the most common form of denial of service attack on the web today.

     We won't go into the long and boring details of exactly what a denial of service attack is, suffice it to say that it is simply a method in which an attacker floods the communications ports of a chosen server with junk traffic, causing the real traffic to get lost in the flood.   This means that during a DOS attack, legitimate users are essentially blocked from getting in.  Imagine a flash-mob outside the door to your favorite resturant. They have no intention of actually ordering anything, but thier presence clogs the entrance so you can't get in to buy either.

     So what is the difference between a denial of service attack and a distributed denial of service attack?  Well, a simple DOS is usually someone flooding one system from another system, but a distributed attack comes from many computers at the same time.  The client is embedded on numerous systems on the internet and triggered to activate simultaneously. 

     DDOS clients are often embedded into trojans and other malware.  Often the unsuspecting computer user will download these without ever knowing it, either by downloading a program that they think is something else, connecting to an infected webpage, clicking on a popup that say's "YOUR COMPUTER HAS VIRUSES" (It didn't but if you click on something like that it will), or by simply failing to turn on your Windows firewall or by turning off your virus detection program.  (an unprotected open port is a hackers dream).

     Even if you have done everything right though, firewall on, virus program running, many of these malware programs can infect your computer without you ever knowing it, and many can go undetected by virus scanners.  You won't know your infected until your computer slows to a crawl and you start digging around in your hard drive to know the reason why.  There are literally millions of infected computers on the internet today who's owners have no idea they have malware on their systems, and a likely majority of those systems are infected with a DDOS client just waiting to be activated by the hacker that put them there.

     So now a hacker has distributed his DDOS client to a whole host of computers.  If your computer is infected, and you don't know it, and you leave your computer turned on and on the internet 24/7, you have just provided someone with a method of attack.  As someone said on Twitter recently "There are plenty of kids out there that leave daddy's laptop turned on all the time".

    So why should you turn your computers off when not in use?
  1. Save Electricity
  2. Save Money
  3. Save the planet
  4. Prevent hackers from getting into your computer while your away
  5. Prevent hackers from USING your computer while your away
     You also don't necessarily have to "flip the switch" every time you walk away either.  Most operating systems have built in "Power Settings" which will automatically turn your computer off if not used for a specified period of time.  For example, I use Windows 7 on one computer and Windows XP on another.  Both of these will turn themselves completely off if not used for 1 hour.

In Windows 7, this can be found in the Control Panel under System and Security > Power Options.

     DDOS attacks are only ONE example of the myriad of methods hackers use.  Some hackers attempt to break into your system to garner your personal information, others to send spam and other malicious emails. Ironically enough, the most effective methods of securing your computer consist of just plain common sense.  Good "Cyber-hygiene" as it were.

  1. Invest in a good active virus scanner such as McAfee Virus Scanner
  2. Keep your operating system up-to-date.  When your OS askes to update files, let it!
  3. Invest in a good Malware scanner such as SAS Super Anti Spyware, Malwarebytes and/or Microsoft Security Essentials
  4. Turn your computer off when not in use.
  5. Scan your computer at least once a week.
  6. Never store credit card information online or in "auto complete" fields.
  7. Never store important personal documents (such as scans of your drivers license, social security card, etc.) online or on your hard drive. Use a USB flash-drive instead.
      Simple steps to protect yourself, your family, and the internet from those who have other ideas for your stuff.