How To: Secure online shopping and Windows security

The online thieves want your money and identity
Windows users are the target of a lot of malware. A large part of that malware gathers personal data, like name, address, credit card data, bank accounts, usernames and passwords for all sorts of sites, online banking accounts and other types of information.

Those Windows users who suspect their PC might be infected or simply think it may not be safe to buy something, make payments or transfer money from a web browser running on Windows should continue reading this article. Even if you don't believe that, you should keep reading the article.

We will not be discussing what antivirus/firewall/anti-malware software is better.

Note 1: The term PC will be used for laptops, netbooks and desktop PCs
Note 2: Macs which run Windows are exposed to the same risks as regular PCs

Windows, its security, its settings and its firewall

While hundreds or even thousands of security issues have been fixed in Windows, there aren't so many persons out there who can be sure their machines which run Windows aren't being monitored one way or another. While some persons would say "Windows is safe now", that is far from the truth. Even more people believe Vista is virus proof or that it includes antivirus protection.

It is well known there are some individuals who work on making trojans and all sorts of malware that is undetectable by antivirus software. Moreover, there are some who can be paid to make malware undetectable. Even if this undetectable malware becomes detectable after an antivirus virus signature update, the harm can be done by the time that happens.

Windows XP and Windows Vista have integrated firewalls. Some people believe this makes their PCs 100% safe, however, this is not the case as you can find better firewall software and many other measures are required in order to make the PCs more secure.
Some persons who play online games or use some more exotic apps disable the firewall. There's no need to detail that, it's obvious it's a very bad thing to do (unless you know what you're doing, e.g.: you've installed better firewall software and need to disable the builtin one)


The "I have an antivirus, I'm safe" story

The big (and the smaller) companies which preinstall "trial" antivirus software are doing a rather bad thing. The end user buys the PC, is told his computer comes with the X antivirus software and he doesn't have to buy and install one. In most cases, they're not told they're supposed to buy that antivirus software (or another antivirus app) because it's a trial version which expires after a period of time (15/30 days, 2-6 months, one year).


Some antivirus applications aren't very good at telling if a file contains or not a virus or another type of malware. Files which the antivirus thinks they have viruses in them and they actually don't have viruses in them are called "false positives". Because such an antivirus software brings up false positives, realtime scanning might be disabled by some users of that software.

The other situation is even worse, not detecting a virus, is even worse. Paying for an antivirus which doesn't detect viruses and other types of malware isn't good at all.

There is also a high number of antivirus applications which do not pick up additional malware by the actions they perform in the running system. Some malware types go undetected until they are "well embedded" into the OS and then it's either too late to remove them or the removal process is too complicated.

"Your PC is infected!!", "you're rich now" and other "wonders"

There are lots of websites out there which simply pop a window up and say "your PC is infected, click here to get our antivirus" or simply tell you to download an antivirus nobody heard of before.

The common sense rule says that legitimate companies which sell antivirus software or offer it freely do not display pop-ups on your screen while browsing to convince you to buy or just download their software. This is how many people get their PCs infected, even if they weren't infected before.

Therefore, respect the following rules to help increase Windows' security:

- NEVER click on links from emails which tell you that something happened to your credit card or bank account ( no matter what it says). If you really think that might be real, then check the official bank website (not from the links in that mail) for a phone number to contact the bank

- NEVER share sensitive data with anyone (like your credit/debit card's PIN, online shopping three-or-more digits code, social security number, etc)

- NEVER give your credit card's PIN number to any page under (no matter what the circumstances are) , nor any bank account to sites you do not know. you should better check and triple check everything is legit before trying to buy something

- NEVER click on banners / pop ups which promise to let you download free antivirus software or some magic application which "will make your PC run 999999 times faster", tell you that you're the nth visitor and you won 9999999999 billion dollars, tell you that you have won the lottery

- NEVER click on links from emails which tell you that you need to send X USD/EUR to get your 999999 USD/EUR prize

- NEVER click on links from emails which tell you to buy "cheap Rolex/Rolex replicas/etc watches" or anything like that

- NEVER open attachments from email addresses you do not know (some mails promise to show you some pornographic content, photos from someone's holiday, offer you something)

- NEVER trust something which seems too good to be true (generally speaking, e.g.: you just won a car, but you need to give them your social security number, send them some money or anything else before they can give you the car)

- NEVER click on links from emails which promise to show you pornographic content or promise to help you improve something related to your body


While these things may be well known by some people, I've come across people who believed a few of the things I told you to avoid were legit and real.

The magic fixes

Please take care: these fixes are meant to protect you from theft of data via malware installed in Windows on your PC, NOT from sites which aren't legitimate bank sites, legitimate secure online shops, legitimate secure tax payment sites or some other legitimate site which you're supposed to give money to

Ubuntu for secure shopping

You can use an Ubuntu LIVE CD. You can boot into a graphical environment and browse the pages of the shop and order safely from Firefox running from the CD.
This live cd doesn't touch your HDD, your PC will still run Windows when you reboot and everything will be the same.

While some people may find this silly or believe it's not worth using, please remember Windows can have some "Big Brother" (malware, trojan) who knows everything you type (credit card data, online banking account's username and password, online shop's data account data - where information regarding your credit card data may also be found, etc) and your antivirus/firewall/anti-malware applications may not even detect.

Therefore, using Ubuntu is a safe way to shop online. You simply download it from the official website, www.ubuntu.com, burn it to a disc and boot your computer from that disc with "try Ubuntu without any change to your computer" boot choice, start Firefox once it boots and that's it. Some users may have to set up their network, if they do not use a router with DHCP.

OpenDNS for safer browsing

www.opendns.com is a free service which makes your Internet browsing experience better.
Using this free service, you can filter a lot of unwanted types of sites, thus ridding yourself of a few worries related to some local DNS server being compromised, hacked or unavailable.