Quick, is your firewall up? When was the last time you did a virus scan? Do you have a rootkit hiding on your computer? If you know the right answer to each question (yes, within the last week, no) then you're already ahead of the game, and crackers will probably bypass your computer in search of easier prey. You might want to know how crackers and their malware operate, though; knowledge is power, after all1. First, we'll cover the different types of malware, take a look at crackers as a group of people, and then look at how to really secure things with cryptology.
Spyware is considered to be one of the least problematic types of malware, but it's still a big problem, especially if it gets a hold of your financial information.
Viruses used to be a very big problem. A single virus could take out huge swathes of computers back in the day, and those events made the evening news. The standard virus infection took part in the gullibilty of early internet users: a virus would attach itself to an email, and would reach another person's account. The unsuspecting person would then open or download the attachement, which would run the malicious program. Then, the program would coerce the person's email account to send out more emails with attachments of itself while doing dastardly deeds to the infected computer.
Since the advent of savvier computer users, viruses have stopped making such big news. Just make sure you don't open an attachment that looks like a!OI88N123&$$.exe.
Worms are similar to viruses, so much so I had to look up the difference to make sure I got it right (I did). While viruses usually spread by email (you have to be innocent enough to run random things on your computer) while worms need no help. If an analogy helps, a virus only infects those people that get an infected letter, no matter where they are. If you're in the same room, though, and the other person has a worm, it's only a matter of time. Unless you already had a vaccination. The self-propogation of worms makes them hard to battle: they don't rely on educatable humans to spread, just network connections.
While worms are more dangerous than viruses (you can get one while using good surfing habits), they're also a bit more rare, since they have to exploit network holes instead of any sort of hole an OS can offer. Just make sure Windows is up-to-date, and you should be okay.
This piece of malware looks like a legit application or download, but is actually, well, a virus. After you install that new free photo-shop killer, you might discover it's not an image edit program but a piece of malware that is wreaking havoc with your computer. Like email viruses, though, these depend on tricking people to download a piece of software, and with time, users have learned not to trust such things.
Without rootkits, you can easily scan for and delete most viruses. If there's a rootkit, though, you wouldn't know if there's a virus there: rootkits make them 'invisible'. If you read through the tutorial that covers a computer's life, then an advanced rootkit operates by booting before the OS, and then loading an OS on top of itself. Then, the rootkit can manipulate whatever it cares to, including covering up any evidence that there was a virus or piece of spyware. With basic rootkits that don't boot before the OS, there are usually tell-tale signs that the rootkit leaves behind2. With good rootkits, though, it's hard to tell. If something constantly goes awry, though, and the virus scan turns up nothing, there might be a rootkit lurking around somewhere.
As hard as rootkits are to beat, some suites and other standalone programs offer rootkit protection. AVG, and icesword; last time I heard, icesword was one of the best anti-rootkit tools out there, and it recently got an english version3.
So we're starting to move outside of the arena of malware, but phishing is tied up with malware: mentioning one brings up thought of the other. Phishing is social engineering: one common example is an email from a legit-looking address that asks for your bank account number and pin because 'there are problems with your account'. After you give them the information, then the crooks clean out your account and run.
The way to combat phishing is to always check the soure of a message, especially those that ask for personal information. If they ask for your bank account number, then forget about it: no self-respecting bank would ask for your account. Another common phishing scam is the investor from Africa that needs to use your account to transfer money, for which the investor would give you money. Just ask yourself: why would anyone want to use my account?
Just use the same logic you use to throw out junk mail: would my bank ever ask for my account number before sending me a statement? Use your common sense, and you'll be fine.
If you use IE, then you'll want to make sure that Activex doesn't load automatically. Any sort of web browser plugin shouldn't be installed automatically: there should be a dialog that asks you for confirmation of installation. That's why firefox forces you to wait 3 seconds before letting you agree to install a plugin, so you don't just agree automatically to something malicious.
At the same time, there are some sites that force your browser to download their malware, exploiting holes in the software. The technique is known as drive-by downloading, although it hasn't been a very large problem recently. The principles of good surfing apply here, which should safeguard you most of the time.
If you're hooked into a wireless network, then you've just given up a little security versus a wired network. While it isn't terribly less secure, people can 'listen' to your 'broadcasts', and it adds another way to attack your computer: through the wireless network, ontop of threats from the network. Is it worth the slightly less security for convenience and mobility? You're the judge of that.
If you own a wireless router, it would be a good idea to make sure your datastreams are encrypted, or protected. That way, only authorized computers can link into the network, and you can prevent war-driving, which is where people drive around looking for open wireless networks and leeching off of them for free bandwidth. Also, they can use the network to do illegal activites, and the owner of the network would get dinged for it. It'll also protect the users of the network from being easily cracked.
Also known as XSS, this form of 'malware' shows up in forum, whereas the person injects some scripts into the website which might do any number of things, like steal your password as you log into the site, or automatically redirect you to some other site as advertising. As a result, most people don't allow script tags into their dynamic websites.
Recently, attacking computers has become quite a lucrative business. Back in the day, pulling off a crack would be the result of some kid trying to prove himself. Now, it's about cracking as many computers as you can and selling computer time to less-scrupulous business people.
Before we move on to the money making part of the equation, we have to point out that some kids spread malware as a digital age-equivalent to painting graphitti everywhere: it lets them feel power. Usually, script kiddies have minimal talent with computers and download tools from the internet to use in their exploits, just targeting any random computer that doesn't have protection on it. If you don't despise them for being destructive, you'll probably despise them for being too ignorant to write their own tools. They're not too much of a threat, no matter how badly they want you to think they are.
Pros, on the otherhand, crack as many computers as they can to form up zombie networks4. Zombie networks are bunches of computers (largest: above 100,000 computers) that have malware installed which report to the zombie controller5. The controller can sell control of the network for spamming, or attacking systems in DOS attacks.
After getting a zombie network together, a cracker can then direct the network to suddenly make requests from a particular server all at once. With thousands of requests at once, the server than becomes overloaded, and anyone trying to access that server gets a denial of service. Thus, such an attack is called a DOS attack. Large companies can ward off attacks by placing servers on different networks that serve the same thing, so that if one server is overloaded, a request can go to a different server, and there is no DOS. Smaller companies, though, are still vulnerable.
Unless you run a company, you'll probably never have to worry about zombie networks to come knocking: about your own computer becoming a zombie, yes, but not having your computer swamped with requests.
While protecting your computer is all well and good, how do you ensure that the COUGHGOVERMENTCOUGH doesn't read your mail? Or any other person, for that matter. What if you're discussing something private? What if you have secrets? First, I would recommend a life that would shame angels, so you wouldn't need to keep secrets. Failing that, you can use cryptology, or the study of hidden things (secrets), to protect your messages.
Previously, anytime you tried to encode a message, the method you would use would be easy to encode and just as easy to decode. An example is the code breaking that went on in WWII in which the Allies broke the codes of the Germans. True encryption by trap door algorithms came in the advent of the RSA algorithm, which easily encoded messages, but was very hard to decode. It required doing math with very large prime numbers, so we won't torture you with an explanation of how the algorithm works6.
Another feature that RSA was famous for (perhaps more so) was the creation of a public-key system. If you have a very complex algorithm, and tell all your friends how it works, then your messages will be very secure with one small caveat. If one of your friends turns against you, you'll need to distribute a new algorithm, so your new enemy can't read your messages. It's also insecure in the fact you either have to personally deliver the description of the algorithm or risk an enemy reading your algorithm on the way to a friend.
RSA, though, make a system in which a user chose a private key, and made a public key out of that private key. It's easy to make the public key, but it's hard to find the private key that made that public key. Then, the user distributes the public key, and his friends can encrypt their messages to him using that key. Once encypted, his friends can't read the message anymore. Once sent to the user, he can decrpyt the message using his private key, which is the only way to decrypt such a message.
A trap door algorithm essentially makes it easy to compute an answer, but makes it very hard or impossible to figure out what the question was. One good example is alphabetizing the letters in a word: 'an elephant' becomes aaeehlnpt. You can guess what the words were, but there might be several different words you could reconstruct from such a combination, and you might never know which ones are the right ones. That's a true trapdoor - RSA is almost a trapdoor, in which you can reconstruct the data that you've encoded.
Another security model that is used far too often is not really security; instead, it relies on the ignorance of users, the fact that no one has their hands on the code, and that no one outside of the company knows how the program works. Placing a file containing passwords with dozens of fake files, then placing it in a 'hidden' file and hoping that no one will find it is weak example of security by obscurity. Security by obscurity works sometimes, when no one cares about cracking the system. It's not really a good solution, though, as it relies on a lack of knowledge, something that users and crackers can gain if they're determined. No computer, though, will decode a RSA encoded message quickly, though.
While RSA is secure when it uses large primes, it's not especially fast. With larger and larger primes, the security increases, but so does the time needed to decode the message. Thus, most systems use RSA or some equivalent to encrypt the key of another, two-way cipher that was used to encode the message. Blowfish and AES are two such ciphers: they're two way, in that they're not trapdoor algorithms, and can be used in the process described above.
Enough with hiding your secrets; let's move onto a more detailed look at the hardware that run behind the machine.