Security Concept: Attack Vector

Our last discussion looked at the security concepts of lock down and layered security. Attack vector is another important security concept. Different agencies and organizations have different words for this but it all comes down to the same concept.

Your adversary wants to attack you and they will attack you through some perceived weakness, a vector. Vector means a pointy little arrow. You can think of the arrow going through the path they’re trying to attack you. If a burglar kicks in your front door, the attack vector is the front door. Burglar crawls in through window, attack vector is the window.

In our last post, ThoughtfullyPrepping correctly said the best “lock down” to your PC being hacked over the Internet is pulling the connection to the Internet. The Internet is the primary attack vector hackers use to get into your system. We can subdivide this into smaller attack vectors. Some of the most common computer hacker attack vectors:

1) Your web browser
2) Your e-mail client
3) JAVA installed on your system
4) Flash player
5) Acrobat Reader

Some attacks go through one thing and then use another: A web browser attack taking advantage of flash player. These last three items have had tens of thousands of vulnerabilities over the years. How can you nullify attacks through these popular attack vectors?

If you don’t need it, uninstall JAVA. You could go without flash player, but how then would you play sheep dash or online flappy bird? Too great a sacrifice. Inside your browser you can install an add on (flashblock) that blocks flash content from automatically playing. This give you control over which flash content is allowed. Keep flash player updated. Visit the Flash Player Settings Manager website to check your settings and choose stronger settings than the defaults.

You can replace Acrobat Reader with a less targeted and less bloated pdf reader like Sumatra PDF.

For an e-mail client, choose one that doesn’t support scripting or one which can turn it off. Avoid Outlook and anything that supports Active X on Windows platform. Don’t open attachments in e-mails from strangers. Just delete them.

You could run your web browser sandboxed, using the free program Sandboxie. It will break many sites, but you can install browser add ons like NoScript which keep javascript and other scripts from running. Turn the extension off when you need scripting. For privacy, add Ghostrey to your browser.

By looking at known attack vectors you can reduce your vulnerability to attacks. By listing possible attack vectors you can get a good idea of how you can be attacked. It gets you thinking about how you can secure each line of attack.

The greatest weakness is entirely missing an attack vector. You’ve secured your home. The doors are bullet proof. The windows, impenetrable. A tiny burglar crawls through your dog door. A missed attack vector.

In the book, I devoted a page to securing window air conditioners. Why? It’s an overlooked burglar attack vector. Most ACs just sit in the window frame, held in place by a few tiny screws at the top. Burglars can easily push the AC into the home and crawl through the window. If you have a window AC, spend some time to secure it.

Securing your garage door from having the traveller disconnected is another overlooked home security attack vector.

When you secure anything, be it your home, computer, survival retreat, vehicle, anything, make a list of possible attack vectors. Don’t be overwhelmed. If you’re on the ball, you’ll see a huge amount of attack area. You can’t bulletproof everything. You don’t need to. The vast majority of attacks look for easy vulnerabilities. Something as simple as a locked door discourages break ins. A reinforced door makes a kick in difficult. Most burglars will move on to the house down the road when confronted with a few hardened attack vectors.

The same is true with computer hackers. Unless you’ve pissed off the NSA, when a hacker finds their favorite attack vectors closed, they’ll move on to hacking somebody else.

Two Important Security Concepts: Lock Down & Layered Security

Two important security concepts are Lock Down and Layered Security. These concepts apply to personal home security and online computer security.

Lock Down means different things to different people. A prison lockdown is different from a school lockdown during the threat of a crazed shooter. Lock down implies containment of things as they are. It denies harmful forces the chances to make progress and advance. It keeps things as they are, allowing the white hats to ride in and save the day.

A computer user can “lockdown” his computer. This means the computer is hardened against malicious attempts to change it. There are commercial programs (AppGuard) which prevent malicious code from changing your software. There are free programs like Microsoft’s EMET which help you “lock down” weaknesses.

The simplest things can be the most powerful. Any computer user without adding any special software to his PC can tighten security with the simple “lock down” procedure of creating non-administrative user accounts for daily use. Limited user accounts have limited ability to change your operating system and install software. You can still browse the web, check your e-mail, and spend way too much time on youtube with a limited user account. What you can’t do is make fundamental changes to the operating system. You need to log in as administrator to do that.

If a hacker gets control of your limited user account, his rights are limited. His ability to compromise your system is limited. Researchers have shown 92% of the malware out there can’t overcome being contained in a limited user account.

Limited user accounts are an example of the concept of allowing the minimum access and rights and privileges needed to a person. Don’t let strangers walk through your house.

An intruder entered the White House. The news said the White House is the most secure house in the country. O Contrair. MY house is the most secure house. I keep my door locked and I don’t have tourists. “Ah, that’s my stack of dirty underwear. I’ve been meaning to wash it. Moving over here, we see…”

Layered Security is just what it sounds like. It’s layers of defense to stop an intruder. A pit bull behind a locked door is layered security. If the intruder gets past the door, he must still deal with the dog.

A good example of layered computer security is using a DNS name server like Norton DNS Connect Safe to complement your firewall and virus protection.

DNS is like the phonebook for the Internet. DNS works as follows: When you want to visit a website, your computer needs to find the IP address of the site you want to visit. It gets this information from your DNS, which is a computer usually run by your Internet Service Provider (ISP).

A secure DNS will look at the IP address you want to visit and check if the site hosts malware or viruses. If the site is malicious, the secure DNS will let you know and won’t connect you to the site.

If a virus/malware got past your antivirus protection and past your firewall, one thing it would try to do is “phone home” to connect to a malicious web server to download more viruses or to send your private information to hackers. When it tried to make this connection, if your DNS were secure, the secure DNS would likely deny this connection.

I don’t recommend Google’s DNS because of privacy issues. Google likes keeping personal information way too much. You can layer your anti-virus with Google’s VirusTotal website which checks downloads for viruses.

Give some thought to these two security concepts as they relate to your personal security. What layered defenses have you? What is your daily “lock down” and what is your emergency “lock down”?

***

For airgun shooters, there’s some great information over at ThoughtfullyPrepping.

A great essay about where to start prepping. Not about fighting zombies, but about reality.

Just Sharing Links, Cheap Harbor Freight Flashlight

I wanted to share some links.

It helps acquire supplies if we can get them cheap. Here are some things survival mom says keep an eye out for at garage sales.

With no law enforcement, society could deteriorate into chaos if we lack the physical ability to prevent it. Some people take advantage of situations to exploit others. Chaos and rampant misbehavior can even reign at garage sales. Too many people don’t think they must follow rules of civilization if no one enforces order. This is a horrible story of how miscreants ripped off a 93 year old lady at a garage sale. In WROL most people would be just like that poor lady. Incapable of protecting access to their home.

Speaking of cheap. There are Harbor Freight coupons in papers giving a free LED flashlight with any purchase. Get a 50 cent brush. These lights are nice. Just replace the batteries. HF ads/fliers appear in many newspapers.

Here’s a really good article about protecting your eyes. UV light is too easily overlooked.

Why Preppers Should Be Do-It-Yourselfers

I suspect the vast majority of serious preppers are big into Do It Yourself (DIY). Preppers want to be self reliant. Being able to maintain your own household systems is part of not being dependent upon others. It can save a ton of money.

Not everybody can repair their own systems. It’s not permitted by law. Here’s an example. In England residents aren’t permitted to do their own electrical wiring.

In America we’re allowed to do our own residential electrical wiring (there could be exceptions). If we own rental property where others live, we’re not allowed to work on those electrical systems unless we’re electricians.

The lawmakers will say this is to protect people from shoddy repairs and to enhance safety. Maybe. Trade groups push for these laws to drive up their profits. They don’t want people to be self sufficient. They want to feel loved and needed. And get us to cut them a big check.

Make no mistake, building code is partly based on safety and it’s partly based on special interest politics. In Minnesota we had a kerfuffle about AAVs for plumbing vents. Air Admittance Valves (AAV) are one-way check valves which allow air to enter a drain pipe. This keeps a vacuum from impeding the drain flow. The check valve prevents sewer gasses from backing up into the home.

The traditional way of venting is to run vent pipes through the roof. This lets gasses from the sewer vent above the home and it allows air to flow into the drain pipe to remove waste. No check valve is needed, just open pipe. Every home should have one vent which terminates above the roof.

What if you add a sink and drain somewhere and it needs venting? AAVs allow you to vent the fixture without running pipes through the roof or connecting into the existing vent system.

In Minnesota we have our own plumbing code. Many plumbing codes exist. There is a uniform plumbing code, an international plumbing code, and others. A maker of AAVs lobbied to allow these devices in Minnesota. The building code was changed. Not so fast. The pipefitters objected to the change. AAVs were disallowed. With AAVs there is less pipe to fit.

My point isn’t to argue the pros and cons of AAVs. Just to show industry politics plays a role in determining building code. The government deciders don’t always only care about your best interests. They care about pleasing the folks who butter their bread.

I could picture a future where no homeowner was ever allowed to do anything in their home. You’d need to call in the professionals.

What DIY things should a person learn?

1) Plumbing
2) Electrical Wiring
3) Appliance Repair
4) Basic Auto Repair
5) Understand the basics of your HVAC system

Look around your home and life. What systems do you rely on? The more you understand those systems and the more capable you are to fix and maintain them, the more self-sufficient you are.

American Poor Eating Less Healthy

The poor in America are eating less healthy.

This isn’t surprising. Made apple crisp last season with store-bought apples. Expensive! Makes me want to plant an apple tree. No room for one.

In times of trouble if you’re struggling with “food insecurity,” here’s my advice:

1) Shoot something. Anything. It’s likely edible. Seriously, go deer hunting and fill your freezer.

2) Plant a garden. You’ll have real “organic food.”

3) If allowed in your jurisdiction, look into raising chickens. You’ll eat better than most.

The good thing about these three things is that you’ll learn to secure food without needing to spend a lot of cash. They work even if paper money ceased to exist.