P2P Security

[John Smith]

Are there any experts out there who want to share information about security for P2P'ers. Like firewall configuration. To help average Joe fileshare and stay spam-free, virus-free and ad-free.

[napho]

There are lots of combinations. Some use a firewall like Norton or Outpost which also block ads. http://www.voodoofiles.com/5955
I prefer AdMuncher to get rid of popups and ads on web pages as well as in programs and a firewall to handle just it's primary job. On top of that you need a good anti-virus program and I also use Trojan Remover for extra protection against trojans and worms. Trial and error is the best way to see which works for you.

[TankGirl]

Welcome to P2P-Zone, John Smith.

For spyware removal I recommend SpyBot Search&Destroy. Ad-Aware is another popular spyware remover.

Many commercial p2p applications come infested with spyware (various programs that spy on your surfing habits etc. and 'call home' to deliver the collected personal data), and keeping your computer spyware free is an important security measure.

- tg

[JackSpratts]

“Danger danger Will Robinson!!!”

“Golly Dr. Smith!”

welcome to nu’s p2p-zone mr smith

depending on your choice of networks it's usually not too hard to find a clean version for it, like fasttrack, gnutella etc. some are adfree to begin with, like soulseek and winmx and some are probably best avoided altogether.

my views on firewalls are pretty straightforward. i feel they don't mesh all that well with p2p's. the majority of help querries are about getting p2p's to work with them and i recommend an inexpensive 2nd pc just for peer-to-peer, running w/out a firewall, but with a good anti-virus/trojan remover to check the contents before burning to disc.

btw, for your browser there are several that come with real working pop-up stoppers and anti-hijack features that are all but immune from takeover even on the worst offending sites. opera is the one i use and it's much faster the i.e. as well. there are several other good ones too.

you might also consider joining a smaller, more private network like waste. you can be comfortable running it day and night without worrying if you're going to receive something unpleasant in the mail. of course it all depends on who else is in the group, but that's the point. unlike a normal p2p - as good as they are - with an invitation only network you can choose your peers.

- js.

[Ðiego]

i recommend an inexpensive 2nd pc just for peer-to-peer, running w/out a firewall, but with a good anti-virus/trojan remover to check the contents before burning to disc..

You were clipping along so well, before you stumbled. Sorry Jack, but all your P2P in a DMZ is NOT the advice to give in a thread topiced for Security.

MBI? Get that second system surely, and stick Linux (might I suggest Debian?) on it and have it guard your fortress. Nothing in the world beats iptables, short of pulling the plug, and it makes one hell of a nice router. Once set up it flys silently along with little attention.

Behind mine I have my 98se system, for what I do, and the rest of my LAN..


Ð

[JackSpratts]

nothing more secure than a sacrificial pc d it's as good as it gets. but to each his own.

- js.

[Drakonix]

Welcome to the forum.

1) Firewall

Wouldn't compute without one. While it is true that some special configuration is sometimes needed, the protection it provides is worth the effort in setup.

If you have broadband internet, a router provides a good start in security by isolating your computer(s) from unauthorized incoming connections. Again, special setup is often needed for P2P applications.

A software firewall such as ZoneAlarm also helps identify unauthorized outgoing connections by applications that "phone home" or exhibit possible trojan activity.

I use both a router and ZoneAlarm.

There is also some special firewall software made for P2P users. One that comes to mind is called PeerGuardian. These special firewalls help reject incoming connection requests from tracking sites and other unwelcome IP addresses.

2) Virus Protection

Virus, worms, and other such evils are out there. A virus protection program like Norton Anti-Virus is a must have. Making sure the virus protection software is kept up to date with the latest virus definition files is an important ongoing task.

3) Adware and Popups

As already mentioned, many P2P clients have advertising built into them, and even ordinary internet surfing subjects you to tracking schemes that monitor where you have been on the internet. I use LavaSoft Ad-Aware and Spybot Search & Destroy for adware removal and Meaya Popup ad filter to eliminate pop-up ads on web pages.

4) Spam

Spam is a problem for everyone. The best thing to do is be careful about giving out your email address. Some ISP's offer spam filters, which work with varying degrees of success. Never respond to a spam message in any way, including responding to "remove me from your list". Just trash the messages.

5) Other measures

Make sure you keep your operating system up to date with the latest security patches.

Viruses, worms, and trojans often come in emails as attachments. Do not open email attachments unless you know who sent it to you. Even then, some of these evil things spread by sending emails to all entries in the address book of an infected computer. Good anti-virus packages scan emails (including attached files) for problems.

Do not play MP3's by double clicking on the file name in windows explorer - use an MP3 player like winamp or musicmatch jukebox.

Be careful when running downloaded executable files from an untrusted source.

[multi]

Internet security


Cookies
A cookie is information that a Web site puts on your hard disk so that it can remember something about you at a later time. (More technically, it is information for future use that is stored by the server on the client side of a client/server communication.) Typically, a cookie records your preferences when using a particular site. Using the Web's Hypertext Transfer Protocol (HTTP), each request for a Web page is independent of all other requests. For this reason, the Web page server has no memory of what pages it has sent to a user previously or anything about your previous visits. A cookie is a mechanism that allows the server to store its own information about a user on the user's own computer. You can view the cookies that have been stored on your hard disk (although the content stored in each cookie may not make much sense to you). The location of the cookies depends on the browser. Internet Explorer stores each cookie as a separate file under a Windows subdirectory. Netscape stores all cookies in a single cookies.txt fle. Opera stores them in a single cookies.dat file.

Cookies are commonly used to rotate the banner ads that a site sends so that it doesn't keep sending the same ad as it sends you a succession of requested pages. They can also be used to customize pages for you based on your browser type or other information you may have provided the Web site. Web users must agree to let cookies be saved for them, but, in general, it helps Web sites to serve users better.


Spyware

In general, spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet, spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties. Spyware can get in a computer as a software virus or as the result of installing a new program. Data collecting programs that are installed with the user's knowledge are not, properly speaking, spyware, if the user fully understands what data is being collected and with whom it is being shared.

The cookie is a well-known mechanism for storing information about an Internet user on their own computer. However, the existence of cookies and their use is generally not concealed from users, who can also disallow access to cookie information. Nevertheless, to the extent that a Web site stores information about you in a cookie that you don't know about, the cookie mechanism could be considered a form of spyware. DoubleClick, a leading banner ad serving company, changed its plans to combine cookie information with database information from other sources to target ad campaigns directly to individuals without their permission. DoubleClick's current policy is not to collect "personally-identifiable" information about a user without their explicit permission or "opt-in."

Aureate Media, which distributes free software on the Web in exchange for the right to gather user information, is another company that has been criticized for not plainly indicating what data it gathers and for making it difficult to remove its programming.

Spyware is part of an overall public concern about privacy on the Internet.



Links

http://cexx.org/adware.htm

Am I infected? http://clients.net2000.com.au/~johnf/spyware

All about spyware on Cnet http://www.cnet.com/internet/0-3761-...61-8-3217791-2

CIAC TECHNICAL BULLETIN 02-004 Parasite Programs; Adware, Spyware, and Stealth Networks http://www.ciac.org/ciac/techbull/CIACTech02-004.shtml



Adware

Adware is any software application in which advertising banners are displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen. The justification for adware is that it helps recover programming development cost and helps to hold down the cost for the user.

Adware has been criticized for occasionally including code that tracks a user's personal information and passes it on to third parties, without the user's authorization or knowledge. This practice has been dubbed spyware and has prompted an outcry from computer security and privacy advocates, including the Electronic Privacy Information Center.

Noted privacy software expert Steve Gibson of Gibson Research explains: "Spyware is any software (that) employs a user's Internet connection in the background (the so-called 'backchannel') without their knowledge or explicit permission. Silent background use of an Internet 'backchannel' connection must be preceded by a complete and truthful disclosure of proposed backchannel usage, followed by the receipt of explicit, informed consent for such use. Any software communicating across the Internet absent of these elements is guilty of information theft and is properly and rightfully termed: Spyware."

A number of software applications, including Ad-Aware and OptOut (by Gibson's company), are available as freeware to help computer users search for and remove suspected spyware programs.

[John Smith]

Thank you my friends for your replies. I like the idea of a dedicated PC which I can crash and burn and rebuild, and put in 'my DMZ' and protect 'my network' but I had in mind average Joe with just one PC and not too much spare dosh. (Y'know, the millions who would go buy real CD's if money was no object). I have settled on Sygate personal firewall (free) with a few advanced rules such as blocking Cydoor and some IP's at ads.mp2p.net (I use Piolet). Alongside Solo anti-virus which costs a few bucks. And of course Spybot S&D. And I haven't seen a single pop-up ad or virus for a while (other than the ones my Doc finds at the men's clinic).

Seriously though, amidst all the controversy about P2P, the moral debates, and the legal action against individuals, for most people, protecting your PC is a much bigger and overlooked issue for which there doesn't seem to be a packaged solution.

Any other suggestions for a quick easy solution for non-techos?

[Ðiego]

John, I'm telling ya. You can slap together a used system for nothing and almost nothing these days. My linux system was 100% free, built with parts no one wanted anymore (P3 866) and firewalls my whole lan. Is brilliant.

Computer shops are doing upgrades all the time and have 'junk' laying about taking up space. They'll laugh at you when you ask for the stuff, as who would ever want it..


Ð