Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For a normal computer user following these practices:

  1. Have an up to date anti-virus with a firewall installed (Norton).
  2. Do not install cracked software.
  3. Do not open suspicious links or download software from unknown sources.
  4. Do not install unknown add-ons to browsers.
  5. Windows updates are installed whenever available.
  6. Do not even have a torrent client or similar applications installed.

Extra details:

I open a lot of PDF files and I always knew that PDF files can be infected and cause harm. But I never took this seriously and I never had a dedicated tool to scan them. Not sure if the Anti-Virus I use (Norton) does this job or not.

Q1. What's the probability of having my PC being hacked to steal my documents or private information?

Q2. Are there extra measures to take or tools to install that I am missing?

share|improve this question
    
In Adobe Reader goto Edit/Preferences..., switch to the JavaScript tab and disable JavaScript, you will never miss it... –  martinstoeckli Oct 18 '12 at 10:35
4  
I'm not sure this question is a good fit for the site; "what is the possibility..." requires that the answer is fundamentally a guess based on partial evidence. Your focus seems to be "What are the most important controls for the PDF file attack vector?" Is that true? –  Mark C. Wallace Oct 18 '12 at 10:43
    
@MarkC.Wallace Not true. The PDF thing was just an extra details to help in answering... it is not the main issue here. –  user15119 Oct 18 '12 at 10:45
2  
IMHO, your English skills are better than many of the native speakers with whom I work. That said, I believe this question is a bad fit for SE. The FAQ recommends avoiding any question about which a book can be written, and there are already many books written to answer your question. IMHO, none of them suffice. Having said that I still provided the best answer I could. –  Mark C. Wallace Oct 18 '12 at 12:05
2  
Uninstalling Java, Adobe Reader, and Adobe Flash alone will protect you from 95% of windows viruses. –  ROFLwTIME Oct 18 '12 at 19:44
show 5 more comments

6 Answers

up vote 7 down vote accepted

If you properly follow the recommendations and standards that you've mentioned here, you should be reasonably safe, as long as you also keep your software up to date. It's arguably more important to install updates for PDF readers, Adobe Flash, Microsoft Office, etc. than the OS updates, because those are where most day-to-day attacks are focused.

A few other suggestions:

  • Use a sandbox for read-only stuff, like opening PDFs. That way, even if a document is malicious, the chances of your machine getting compromised is significantly reduced. Sandboxie is nice.
  • Send any suspicious PDFs through VirusTotal. It has some specific exploit detection tools that it runs on PDF documents, which are very good at catching suspicious documents even if the exploit vector is not yet known to AV vendors.
  • Don't ever assume that your AV will catch malware. Studies over the last 5 years or so tend to show that each AV software package catches around 30% of malware. Aggregate tools like VirusTotal have better results, but it's obviously infeasible to run every file you download through it. Keeping your AV up to date helps, but technology is not a panacea.
  • Protect any sensitive documents with TrueCrypt. It won't prevent malware from stealing files from a mounted volume, nor is the password screen invulnerable to keyloggers, but it does reduce your chances of having important stuff stolen as long as you don't open the volume whilst infected.
  • Make regular backups. Getting owned is, sadly, a fact of life. If your machine gets infected, the only way to be sure is to nuke it from orbit and start over. Even worse, ransomware might corrupt your documents and demand a large fee in order to recover them. The cost (time and money) of implementing backups is far less than the cost of recovery when you lose all of your data.
share|improve this answer
1  
I use BitLocker in windows 7 to encrypt the important files, I guess this is enough and I do not need to use TruCrypt... correct? –  user15119 Oct 18 '12 at 14:45
    
Maybe. Malware is more likely to target BitLocker because it's on every machine, and TC has more proven security against some more exotic attacks. You're better off speaking to Thomas Pornin (our resident cryptographer) about the ins and outs of various disk encryption systems. –  Polynomial Oct 18 '12 at 15:33
1  
I disagree with you Polynomila, TrueCrypt is an open source software which makes it easier for hackers to know the vulnerabilities. Not sure of this but this is common sense. –  user15119 Oct 18 '12 at 17:17
4  
That's a backwards argument. Open source software does not make it any more or less secure, and this has been repeatedly proven. In some cases you get a slight benefit, because it's been looked at by thousands of people. TC has been vetted by a large number of professional cryptographers, including Bruce Schneier. It's had a lot more analysis than BitLocker. –  Polynomial Oct 18 '12 at 18:38
add comment

Sounds like you are pretty well covered up. But this is what I can think of: Q1. What's the possibility of having my PC being hacked to steal my documents or private information? A: Depends on if you installed a legitimate version of operating system or not. Looking at the list of softwares, you are a Windows user. Windows versions prior to 2008 R2 are insecure in the sense that they allow drivers (read rootkits/bootkits) to be installed and executed before all your security software programs run to protect you. They are planning to change this with Windows 8. Even if you did install a legitimate OS, with the current security scenario that dictates - Hackers' 'Zero-Day' Exploits Stay Secret For Ten Months On Average - http://it.slashdot.org/story/12/10/17/0434200/hackers-zero-day-exploits-stay-secret-for-ten-months-on-average you might not be safe. Adobe is the bane of all these holes.

Q2. Are there extra measures to take or tools to install that I am missing? A: Most of the tools are already listed by many here - Microsoft EMET, Sandboxie, TrueCrypt, AppLocker, etc. but then again softwares are exploited easily. A recent event being 'Pinkie Pie' Wins $60K for Uncovering Google Chrome Exploit - http://www.pcmag.com/article2/0,2817,2410846,00.asp Other than that, you do pretty much everything that is needed. Not trying to be Anti-Norton, you might want to change it to something better.

share|improve this answer
    
can you suggest a better anti-virus? –  user15119 Oct 18 '12 at 14:21
    
If I were you, I would use a product from the guys at Norman, ESET or Kasperskylabs. –  Metahuman Oct 19 '12 at 7:33
add comment

The most important countermeasure that is omitted is "Do not run with administrative privilege". There are host of other countermeasures; NIST has a published set, CIS has one, and I think the SANS top 20 are probably a critical set - but I'd also consult OWASP. I'd also add to those recommendations that you install a router with a firewall. As @polynomial stated, you also need to keep all the software on your machine up to date. Java, Adobe, Flash, Quicktime, etc. Secunia has a nice tool that assists with that.

You might check VERIS for the most common attack vectors for similar threat profiles, but working from memory, the most likely attacks are

  1. Phishing There is no effective detection; modern adversaries can craft a message that will fool even an expert. You state that you don't open suspicious links, but I believe Moxie Marlinspike has shown that humans cannot identify suspicious vs non suspicious links
  2. Browser Vulnerabilities Attackers suborn websites and you can be infected merely by visiting the website.

In both of those cases there is no effective prevention - the attackers are able to craft attacks that are able to fool even an expert. Your only hope is to interrupt their attack sequence and stop the attack from completing. And that means running without admin privilege.

share|improve this answer
add comment

Answer to Q2 first, you missed a critical point in your list, and that is keeping your PDF reader, java client software, and flash player up to date. Keeping your OS up to date is important, but keeping these up to date is as important as a great deal of malware targets vulnerabilities in those packages.

As for the possibility it's impossible to quantify as it depends on your habits and some of the security settings on your computer. Someone who uses unencrypted, free access points, has poor passwords, and all users are administrators is more likely to get hacked than someone who browses behind a decent ADSL firewall, has good passwords, and uses a non-administrator account.

share|improve this answer
add comment

It sounds like you're relatively safe, but of course, the only way to be 100% protected is not to connect to the internet. There are two considerations, really:

1) Drive by malware attacks, people hoping to infect as many people as possible. Unfortunately, this is not necessarily restricted to suspicious links. It's not unheard of for legitimate sites to be compromised and used to spread malware. Similarly, advertisements can redirect to pages designed exploit vulnerabilities (sometimes in the browser, but more often in some plugin such as java, adobe reader, flash, etc) to execute code on your machine.

2) Hackers targeting you, specifically. This is preeeeeeetty unlikely, unless you stand out as a higher up employee of a company, which increases your value as a target slightly. Targeted attacks are becoming more common, and if you run a company, it's possible that people will attempt to use public information (think LinkedIn profiles, company registries, etc) to socially engineer you into opening that dangerous pdf, or visiting that exploit laden website.

To sum up, it's not just dodgy third party browser addons, naughty sites and cracked software that will get you. Remember to keep your legitimate browser plugins etc patched up, or better yet, disable them if you're not using them. Disable javascript if you're not using it. NoScript is a pretty great extension for Firefox, and there are similar ones for other browsers. It allows you to whitelist sites that require javascript, and you can block everything else. Disable the java plugin if you're not using it. Adobe Reader is the most commonly targeted PDF reader, so consider doing your reading in another PDF reader.

share|improve this answer
1  
There is no such thing as 100% safety. A dedicated hacker can break into your house and infect your non-internet connected computer - which would be an extreme case of category #2. –  emory Oct 18 '12 at 11:13
    
Too true! You are of course correct, I should have said 100% protected from internet borne threats. –  OtisBoxcar Oct 18 '12 at 11:22
    
@OtisBoxcar Even then, that's open to interpretation. What if your smartphone gets owned remotely (sadly relatively easy to do these days) and you later plug it into your machine via USB to charge or copy files? It's internet-borne-by-proxy. –  Polynomial Oct 18 '12 at 19:34
add comment

The possibility of you being a victim of a targeted hacking attack is low. The possibility that your computer might get infected with malware like spyware, spam bots and similar, is medium. I recommend using Microsoft EMET and set it up to protect applications (PDF reader, web browser, Word) which work with documents of outside source (PDFs, web pages, word documents, ...). Second thing you can do is use AppLocker, included in Windows. Set it with default policies. This will prevent your operating system from executing executables (applications) that are not in folders that require administrative privileges to write to (Windows, Program Files, ...). AppLocker allows you to do whitelisting of executables. You could also run web browser and PDF reader in a sandbox (Sandboxie software) for isolation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.