Online banking and online trading have been gaining market share every year. Security breaches make headlines almost daily. With more and more people going online, consumers are worried more than ever about keeping their online banking and online trading safe and secure. In this article, we will help you bank and trade more securely.

Secure your computer, web browser, Internet connection

Follow our guides to secure your Windows PC or secure your Macintosh by installing the right software, firewall, antivirus software, etc. Secure your mobile devices: iPhone, Android smartphone or tablet, iPad. Configure the settings and add plug-ins to you web browser so that it is more secure. Consult our tutorials for: Internet Explorer 9, Google Chrome, and Mozilla Firefox. Secure your Internet Connection: Wireless Network, Public Wi-Fi.

1. Configure your wireless router for optimal security. Consult our article How to set up a secure wireless router for details. For maximum security, do your online banking and online trading when connected by a hardwired connection such as Ethernet.

2. Ensure that your operating system is set up securely. Consult our computer security guides for Windows and Macintosh. For maximum security, you could start off a Linux boot CD or USB key.

Burning Linux Live CD to a write only media such as a CD/DVD or a USB drive with Write protect switch, helps prevent any changes to a virgin Linux distribution. Keep in mind that no bookmarks, password managers, etc would be accessible.

The CD versions do take many minutes to boot up and ask you if you want to try Linux, so the USB route is definitely preferred.

3. Secure your Internet browser. Consult our security guides to Internet Explorer, Google Chrome, and Google Chrome.

4. Make sure you are accessing the online banking or trading website is using a secure connection, look for https:// in the browser’s address bar and a padlock icon in the browser. A broken key, broken padlock, or any open lock indicates it is not secure. If you want to ensure security, see if the bank or brokerage takes transactions over the phone.

5. When creating an account at the online bank or brokerage, we recommend you use a unique password as it is far safer in case the website gets hacked. You would not want hackers to get a password that worked on other websites. Consult our How to create, store and use secure passwords article for suggestions.

6. Sign up for alerts from your bank or brokerage by email or text message. This will allow you to respond to any fraud rapidly. Also carefully check each month’s statement for erroneous or fraudulent transactions. Consider checking your outstanding transactions every couple of weeks via the company’s website.

7. Two factor authentication is available from many banks and brokerage houses. Bank of America, Citi, Schwab, Fidelity Investments, and several other companies have this available, so check with your representative. This technique forces the use of both a password and a number generated by the hardware security token in your position, both are needed in order to log in. Clearly if criminals got a hold of your password, they would not be able to login.

Two factor authentication systems using SMS text messages are not secure, due to hijacking of mobile phone accounts and the weak SS7 routing system. Even Reddit got hacked this way. We suggest only using two factor when you can use a physical token or a time based authenticator like Google’s. Send text messages to a VoIP number such as Google Voice  instead. Do not allow Google Voice to forwards Texts/Calls to your main number.

• A new paper in 2020 from Princeton researchers shows how easy it is to pull off a SIM Swap against AT&T, Verizon, T-Mobile and others.

8. To avoid falling victim to e-mail phishing, never click a link or open an attachment from an e-mail. This is especially true for online banks and online brokerages. Manually type the URL into your browser.

Opening Attachments Safely with Gmail

Forward the email with attachment to a Gmail account.  From there, you can use Google Docs to open Word Processing, Spreadsheets, etc.  No need to endanger your own computer.

9.Internet Explorer Virtual Machine – Designed for web developers to test compatibility with different versions of Internet Explorer, these Virtual Machines for Microsoft’s Virtual PC allow you to run a Virtual computer on your desktop with Internet Explorer pre-installed. If you mess up the Virtual computer, you can just delete it and start fresh from a new image. You can perform your online banking and trading within the virtual machine to increase security.

10. When banking or trading on a smartphone or tablet, using the built in 3G/4G connection is a lot safer than connecting via a local wireless internet hotspot. This warning applies to both apps and mobile internet browsers.

11. Explicitly logout after you are finished.  Do not just close the browser.  This helps terminate your session officially.

Things Not To Do

1. Do not bank or trade when using public wifi hot spots or when using a shared computer in a cyber cafe. Many of these locations provide little to no security and are prone to snooping or malware. This warning also includes smartphones and tablets connected to public wireless internet.

Do these safeguards make sense?

Google’s Android operating system powers many popular cellphones including the popular Samsung Galaxy S10. Most Android Smartphone users as well as most of the pubic at large do not think very much about security.

If your phone is not running the latest Android Monthly security patches or is Android 6 or older, you are open to attack. A recent Wall Street Journal article showed that only 2.8% of Android devices have the latest security patches. Compare that to 79% of iPhones, due to Apple’s more uniform eco-system.

As of February 2019 only Android 7 to 9 receive security updates now)

Most Up to Date Android Smartphones

• Google Pixel 3

This flagship phone runs the latest Android version and is patched regularly. Sold directly from Google or from a couple wireless carriers.

You can check this Google Support page that shows when updates will be available for Google devices and when devices stop getting updates.

Keep in mind that some companies claim to have all the latest security patches but may not.

We will cover some techniques to enhance your Android phone security.

Obsolete Hardware

Most hardware vendors like Samsung stop issuing updates after 3 years of release.  Need a good reason to upgrade to a new phone?  This is it. Incapacitate then recycle your old phone to prevent reuse.

Samsung has a page that lists which devices are still getting updates, as does Google.

Samsung SmartSwitch helps you update phones on Windows or Mac.

If you have an Phone or Tablet that no longer gets updates, we would recycle it and buy a new one RIGHT away. Keep in mind that Android Patch in July 2017 is the first version that fixed a Huge Broadcom Wi-Fi bug. Without that fix, you can get hacked by just having a Wi-Fi signal nearby.

Google Play Protect

• Be sure your device is running Google Play Protect.  It scans for Malware and bad apps. This was release in July 2017 and runs on Google Play Services 11 or higher. This is a unification of Android security systems like Verify Apps, browser protection, and anti-theft measures.

You need to test your Android Device for Vulnerabilities

Here are the major security holes that you need to test your phone against.  If your phone fails any of these, get it updated or buy a new phone.

2/1/2019: Google has patch a major bug in Android where you can get hacked just by looking at a picture in a SMS, Email, or web page!  Update your Android software to Patch Level February 2019 or later, right away.  If your phone no longer gets updates, please consider buying a new one.

QuadRooter – Learn more about this issue. August 2016

DroidJack Remote spying – Learn more about this issue. August 2015

Stagefright MMS Flaw- Learn more about this issue. August 2015

Shellshock – Learn more about this issue. September 2014

Why is Android more susceptible to attack?

• Older Smartphones with unpatched old versions of Android
• Many phones never being given latest updates
• Bigger audience to attack due to market share
• Chipset vendors fixes slow to reach public
• Multiple App stores
• Apps are not thoroughly vetted
• Bloatware, trialware from handset makers
• Malware introduced in production chain

The Android Smartphone is part of Android’s open ecosystem, making viruses and malware more possible than closed platforms like the iPhone. As the Android Smartphone has grown in popularity, the smartphone has become more of a target by hackers and criminals. The DroidDream and Plankton Android malware infected over 250,000 phones before anyone discovered their malware. Google removed over 58 malicious apps from this single malware. A recent survey has shown that only 30% of Android Smartphone users installed security software on their phones. Malware can grab private data or use the phone to communicate externally.
Carrier IQ is a controversial piece of software that can show you what certain Android phones and spyware can do if the carriers allow it.

It is important that Android Smartphone users immediately become more vigilant about smartphone security. Our tutorial covers the Android Smartphones running most versions of the Android operating system.

Android Vulnerabilities.org gives a snapshot of how many devices are insecure.

The NSA and Android

Did you know that the NSA has been programming for Android and has inserted its code into the operating system? This has been happening since 2011 and has been focused on adding code to prevent hackers and marketers from accessing personal data on your Android device. Devices including the Samsung Galaxy S4 and HTC One have NSA code embedded, but not enabled by default. Apple does not accept code from government agencies. Android is open source, so programmers can more easily scrutinize every line of code that is in it. Hopefully the NSA will not add monitoring code in the future.

1. Android Smartphone Software Updates

Google upgrades the Android software for the Android Smartphone all the time. Montly Updates include additional functionality as well as security bug fixes. It is important that users apply updates immediately. Yes, updates take a while to install, but you do need to do it right away. Contact your smartphone vendor for the latest Android software update to your handset.

Some handset makers take their time to release Android updates.  Beware. This is the MAIN reason why millions of Android phones go unpatched.  Buy a phone that use plain Android and can take updates directly from Google, like the Google Nexus or Pixel line.

90 percent of Android devices two years or older have an operating system that’s vulnerable.

Replacing an Android Phone due to Lack of Updates

If you have an Android Smartphone that does not get the latest Android updates, we highly recommend you REPLACE the smartphone with a new one that does. Unfortunately you will need to switch phones every 2-3 years to keep up to date. Recycle the phone, do not give it away.

This Google support page  shows you the status of Google Nexus Software updates and security updates.

These Nexus phones, tablets are have no guaranteed security updates after October 2017!

• Nexus 10
• Nexus 9
• Nexus 7
• Nexus 6
• Nexus 5
• Nexus 4

If you Root your Android Smartphone, you need to be extra careful with regards to security as updates are much more difficult for you. Be careful where you obtain your Android Apps as malware is much more prevalent. Rooting also exposes your device’s internal hardware to software much more so than normal. This is the equivalent of running your PC as Administrator.

2. Android Smartphone App Security

Apple’s App Store reviews all submissions before adding them, but Google does not thoroughly review Apps added to their store. Google does run a security scanner on apps to ensure that they do not include known malware. There have been several occasions where Apps containing malware have entered the Google play formerly known as Android Market.

Neither App Store technique is full proof, users need to be careful when installing apps.

Apps are prone to security vulnerabilities that are fixed by updates. Keep apps updated regularly and remove apps that you do not use. To update applications do the following:

• Tap the Notification menu at the top and drag it downwards. If there are App updates available, they will be shown
• Tap on App updates to bring you to Google play formerly known as Android Market
• Tap the App to be updated
• Repeat the process for all Apps

Google has the ability to remotely remove malicious apps from your Android Smartphone. This is NOT true if you buy from 3rd party App store.

When installing new Apps, we suggest you install well known Apps from Google play formerly known as Android Market or Amazon App Store with positive reviews, and avoid brand new Apps from unfamiliar companies, and unofficial 3rd party App stores like mmoovv.com or samsunggalaxy-s.ru.This becomes a problem when the official App Market is blocked, such is the case in China.

It is fairly easy to repackage free Apps into a clone of the App. Repackaged Apps that also include Malware or Spyware have been encountered on 3rd party Android Markets. Free pirated versions of paid Apps are also found on 3rd party sites. Download only from the official App Market and give new Apps time to build trust and to allow others to help test the App for malware and security risks.

Users also need to be aware that scareware where apps are displaying advertisements for battery saving apps have been tied to malware. If the user taps on the ad, your phone’s browser launches and proceeds to download the apps file. These apps could endanger your privacy by stealing your address book, or cause money to be withdrawn from your accounts via costly phone calls or SMS messages.

3. Suggested Android Smartphone Settings for Security

Below are several suggestions for Android Smartphone settings to increase security on the smartphone. If you use swipe patterns to unlock the phone, make sure you clean your Android devices’ screen regularly otherwise people can see how your pattern looks.  Doing repeated circular or square patterns helps foil thieves.

Enable Passcode

• Open Settings
  
• Select Security
• Select Screen Lock
• Select Password
• Enter a Passcode – Do not select an obvious passcode like 1234a or 1111a

Google automatically encrypts its Nexus smartphones, but other companies are not required to do this. As of 2016, less than 10% of Android phones had encryption enabled. 80% of iPhones had encryption turned on. Android 6 Marshmallow requires encryption to be enabled by default.

Encrypt your Android Smartphone and require a PIN or password to decrypt it every time you power it on. It takes an hour or longer to initially encrypt your Smartphone. Older Android phones many operate slower when encryption is enabled. Launching apps might take a second or two longer. Turning on encyption requires a full battery or the phone connected to a charger.

• Open Settings
  
• Select Security
• Select Encrypt phone
• Click Encrypt phone

Lock SIM card makes your phone require a PIN before becoming enabled.

• Open Settings
  
• Select Security
• Select Set up SIM card lock
  
• Select Lock SIM card

If you are not using any Bluetooth devices, disable Bluetooth to increase battery life and prevent security risks.

• Open Settings
  
• Select Wireless and Networks
• Uncheck Bluetooth

Backing up your Android Smartphone regularly is an important task. If you have a rooted Android Smartphone use the ROM Manager and Titanium Backup root.  Regular Android Smartphones need to pay for backup Apps like MyBackup Pro. There are free Apps to backup individual areas like SMS, images, or Applications.

4. Android Smartphone Email Security

It is important that email accounts accessed from a smartphone are setup utilizing encryption when available. Many email providers including Google’s Gmail, Microsoft Exchange, AOL Mail and Yahoo Mail support SSL (secure sockets layer) when accessing their mail servers. If SSL is not used, your emails as well as your password can be read by hackers. Most major email providers automatically activate SSL if you let Android setup your email account.

If you are setting up a new email account, make sure that you have enabled SSL or TLS in the Security type field for both the incoming and the outgoing mail server.

To check an existing Mail Account for secure SSL access, do the following:

• Open Email application
  
• If Combined Inbox is shown, Select a mail account by tapping Accounts then Select the email account. Otherwise, hit Menu then Account Settings
• Check Incoming settings and Outgoing settings
• Examine the Security Type field
• Verify that it is not set to None

If it is set to None, check with your email provider to verify their SSL support and enable it if possible.

Also, make sure your email account has been cleansed with a good spam filter. This is a basic requirement of any solid email provider. If your email vendor needs spam filtering assistance, consider accessing the email account via POP inside a Gmail account.

OpenKeychain – public key encryption for emails and files, to make sure your emails are only read by who you sent them to and others can send you messages only you can read.

5. Find a Lost Android Smartphone, Erase a Lost Android Smartphone

Andrdoid 5.1 and higher includes a Device Protection feature. This is required on all phones manufactured after June 30, 2015 and sold in California. You can set it up in the Lock screen settings. It requires you be signed into your Google account.

Find My Device is a helpful feature made by Google, so you can locate, ring, or wipe your device remotely.

If you are running an older version of Android, you need a 3rd party app to handle finding a lost phone. Here are some options:

• Android Lost – Locate, wipe, lock, take pictures, and much more
• Prey – Open source, cross-platform, lost phone or tablet protection
• Wheres My Droid – Find your lost phone, password protection, notification of changed SIM card. Paid Pro version includes remote phone erasing

When you lose your device utilize the lost device App you installed. If you cannot access the device, make sure you contact your Wireless carrier so they can disable the device. If you recover your Smartphone, make sure you change all passwords.

Also consider creating a special graphics file with your emergency contact information that can be used as your lock screen. If you are having a life threatening emergency, people could still access this information. If your Android Smartphone is lost and password protected, people could still contact you.

6. Using WiFi securely

When accessing a wireless network outside the home, exercise caution. Any information sent over an external wireless may be subject to eavesdropping. Unless you know the Wi-Fi network is secure, we would recommend against connecting to it.

If you really want to use an unfamiliar wireless connection, limit usage to non-critical apps, email, and web. Do not e-mail, online shop, online bank, or online trade from public wifi hot spots or cyber cafes. Many of these locations provide little to no security and are prone to snooping or malware.

The Android Smartphone can remember wireless networks by name and automatically log into them. This convenience function turns into a security problem because the Android Smartphone will automatically send the same password to a wireless network of the same name. So if you name your wireless router, Linksys, if you encounter another wireless router with the same name, the Android Smartphone will automatically use the password. A hacker could exploit this to obtain your wireless router’s password. We suggest you do not enable any automatic joining to wireless networks. The Android Smartphone is very good at transparently switching from a cellular data network to a Wi-Fi wireless network. You can turn off Wi-Fi auto connect by the following:

• Open Settings app
• Choose Wireless & Networks
• Select Wi-Fi Settings
• Uncheck auto connect

When accessing the Internet on a smartphone or tablet, using the built in 3G/4G connection is a lot safer than connecting via a local wireless internet hotspot. This warning applies to both apps and mobile internet browsers.

The safest way to use a public wireless network is by employing a VPN (virtual private network) which securely tunnels all of your Android Smartphone’s traffic through a secure server. There are many paid services that sell VPN access.

Disable WiFi when you are not accessing wireless networks. This will extend your battery life and increase security.

7. Secure Browsing with Android “Browser”

Force websites to use secure connections – It is important to utilize secure connections or HTTPS whenever possible. Several large websites have configuration options to force these secure connections. Here is more information on configuring HTTPS with: Gmail, Facebook, Twitter, Google. Google.com defaults to HTTPS if you are signed into your Google Account, if you are not, just manually add the s after http to force a secure connection i.e – https://www.google.com

Use a password manager to create, use, and store passwords for websites. See our password manager guide for details.

8. Careful Link Clicking and Attachment Opening

As we have learned on computers, clicking on links in email can lead to viruses or malware being installed. We need to take the same precautions and more, on an Android Smartphone. Avoid clicking links in email, text messages, and websites that are unfamiliar to you.

Email attachments require the same amount of caution. Only open attachments when they are expected. Avoid opening your email provider’s spam folder and do not open any attachments in your spam folder.

Opening Attachments Safely with Gmail

Forward the email with attachment to a Gmail account.  From there, you can use Google Docs to open Word Processing, Spreadsheets, etc.  No need to endanger your own computer.

9. Android Smartphone Free Antivirus and Internet Security Software

Android Smartphone anti virus software is available and highly recommended because of the open Android Market for Apps. Be aware that fake anti-malware Apps have appeared, so stick to brand name antivirus Apps.

Antivirus Free – free antivirus App for Android

AVG Antivirus – free mobile security and antivirus App for Android

DR. Web Anti-virus Light – free antivirus App for Android

Lookout – free mobile security and antivirus App for Android

Norton Mobile Security – free mobile security and antivirus App for Android

Webroot Secure Anywhere Mobile – Free Mobile Phone and Tablet security antivirus protection.

Android Smartphone security Apps

Orbot: Tor on Android – Enhance your privacy, break through firewalls and communicate more safely.

10. Android Market Password and Payment Option

You can delete the payment information in your Google account after making a purchase. You must have a payment method in order to make purchases or make refunds. If you are very cautious, remove payment information when you do not anticipate App purchases.

11. Malicious QR Codes

QR codes are appearing in print and all over the place. Be aware that malicious QR codes that lead the user to download malware have been found. Be sure you check the link the QR code points to before using it.

12. NFC – Near Field Communication

NFC has been touted as using your phone as a contact-less credit card.  It is being hyped up by smartphone manufacturers as well as credit card firms.  This technology opens up a new way of hacking your credit card info.  TURN IT OFF and avoid it.  This recent Defcon presentation shows how a security researching skimmed a NFC credit card and used it.

To disable NFC on the Samsung Galaxy S III and other phones:

1. Tap Apps
2. Choose Settings
3. Scroll down the screen and tap More Settings
4. Uncheck the NFC box
5. Close the Settings app

13. Avoid Huawei and ZTE Android Smartphones

These Chinese companies are drawing a lot of attention. Congress suggests people avoid their products due to possible suspicious equipment behavior.

We have covered many ways to improve your Android Smartphone security. Utilizing our tips will help significantly improve the already good security of the Android Smartphone.

14. Stagefright MMS Messaging Bug

August 2015. A specially crafted MMS message can cause your phone to be taken over. Many old phone may never get updated to fix this.

If you’re using Google Hangouts as your default SMS client, disable automatic downloading of media files sent via MMS:

Settings – SMS – Auto Retrieve MMS uncheck

Here’s how to protect your phone from the if you are using Google Messenger (the default SMS client for Android Version 5.0+):

Messenger – Settings – Advanced – Auto Retrieve OFF

Here’s how to protect your phone from the if you are using Messages (the default SMS client for Samsung Galaxy S6):

Messages – More – Settings – More Settings – Multimedia messages – Auto Retrieve OFF

15. Secure Messaging

Law enforcement and probably the NSA use cell phone tower simulators called Stingrays, IMSI catchers, or dirtbox made by Harris. These fake cell phone towers slurp handset identification information and can snoop on data. They deploy these in small planes to net a ton of intercepts, without getting a warrant. Cell phone users have no right to privacy in public areas.

You can fight back by using secure messaging clients like Signal or Chat Secure. Older Stingrays only support 2G, not 3G/4G included with the Hailstorm upgrade, so turning off 2G will help here.

Disable 2G On Android prior to 5.0 – Stops Stingray
1) Pull up the phone dialer and dial *#*#4636#*#* (that spells INFO)
2) This brings you to the Testing screen where can select “Device information”.
3) Scroll down a little and it should say “WCDMA Preferred” or similiar.
4) Change it to WCDMA Only.

It will now stay on 3G/4G/4GLTE and avoid the old school GSM 2G Data towers, keeping you safe from older Stingrays.

Note: Google removed this option on Lollipop 5.0.

You can detect a Stingray by running the apps SnoopSnith or Android IMSI-Catcher Detector.

16. Public Charging – Video Jacking

Do not use a public phone charging cable, it could be capturing video video HDMI recording while you charge aka Video Jacking. Always use your own charging cable.

17. Secure your mobile phone’s account from hijacking or Port-Out Scams

Hackers have been calling wireless carriers like: AT&T, Sprint, T-Mobile, and Verizon asking them to switch control of mobile phone numbers to themselves.

They will repeatedly call, hundreds of times, and make up all kinds of sob stories to get control. Once they hijack control, they will reset passwords of any device that uses that phone number as a security backup via SMS Text or two factor authentication. IE Google, Facebook, Twitter, Bitcoin accounts, etc.

How do you protect against phone hijacking?

• FTC has details
• Do not use your cell phone number in the first place!
• Use two factor authentication that uses a physical key or Google Authenticator App, not Text
• AT&T – Enable an account passcode
• Sprint – Customers setup a PIN when first signing up
• T-Mobile – Enable a customer care password
• Verizon – Setup an account PIN

T-Mobile customers can also call in to the company’s customer support line and place a separate “SIM lock” on their account, which can only be removed if the customer shows up at a retail store with ID.

Be sure to use Google Authenticator instead of Text messages for second factor authentication when possible.

If your phone stops receiving a signal and says “emergency calls only” or “no network,” even after you restart your phone, contact your mobile carrier to see whether your account has been hijacked.

Conclusion

Android is a sophisticated operating system. Because of the nature of its diverse eco-system, users unfortunately need to be proactive to keep their device secure and up to date.

Do you have any Android Security Tips?

Here are some resources for free internet security software from major vendors. Most of the software is free for home users, while businesses need to purchase a license. We divide the free software into different categories including internet security suites, antivirus, antispyware, and intrusion detection and prevention.

Internet Security Software Downside – Spying on You

Any internet security program needs to watch the sites you visit for malicious activity, this includes secure sites (https://)  To watch your secure browsing activity, security suites need to replace the security certificates with their own, performing a man in the middle (MITM) attack essentially.

Hopefully this snooping is all in the name of security, not in stealing your credit card, banking information, or identity. You can read more about Avast.

Kaspersky Anti-Virus is often free after rebate but no longer recommended.

1. ISP Provided Free Security Software

Subscribers to certain internet service providers get access to free commercial internet security software. There’s no need to pay a dime for top notch security software.

Century link – Free F-Secure suite.

Charter – Charter security suite.

Comcast – Norton Internet for Mac and PC.

Cox – Free McAfee internet security software.

Optimum – Free CA Internet Security Suite.

Road Runner – Free CA Internet Security Suite.

Verizon – Charges $5.99/mo for internet security software, select one of the free options below instead.

2. Free Internet Security Suite

There are very few Free internet security suites. Most users pick and choose programs from the various categories below to create their own free Internet security suite.

agnitum – Outpost Internet Security Suite is one of the few free suites.

comodo.com – Free Internet Security Suite

3. Free Antivirus  Download

Free PC Antivirus Download that both scans and repairs files. Automatic update virus signatures updating is a must, as is scheduled virus scans.

free.avg.com – AVG Free version.

avast.com – avas!! Free Antivirus includes Web reputation feedback.

avira.com – Avira Antivirus Personal – We like this one.

bitdefender.com – Bitdefender Free Edition – on demand scanner. not automatic, so we recommend only using this for single purpose scans, i.e. when you are trying to remove an infection.

clamwin.com Clamwin – Free & Open source

Microsoft Defender.

Panda Cloud Antivirus  – Free, lightweight.

pctools.com – PC Tools Free Antivirus

PC Magazine Best antivirus article.

Sophos – Free PC and Mac Antivirus

Virus removal tools:

AVG Rescue CD – Bootable CD

Hiren’s BootCD – Older antivirus versions

McAfee Labs Stinger

Sophos Anti-Rootkit

Beware of fake Antivirus Software especially those from popup Ads, spam advertisements, and bad Google search results. When in doubt use one of the links above. ‘Scareware‘ that performs fake antivirus scans and make you pay for phony fixes has exploded.

4. Free PC Firewall Software

PC Firewall Software is built into Windows 7 and Vista but power users may want more control, so consider installing one of the following.

comodo.com – Free Firewall & Anti-virus, plus proactive security

Glasswire – New modern firewall

pctools.com – PC Tools Firewall Plus

agnitum – Outpost Internet Security Suite is one of the few free suites.

5. Free Antispyware Software

These utilities are mainly useful when you have been infected with malware and need to ensure that you have remove all traces of it.

Ad-aware – Also one of the first antispyware apps. Free for personal home use.

ComboFix is free software that helps remove virulent malware.  It can be run from the Windows Recovery Console.

Emsisoft Anti-Malware – German antimalware

F-Secure has a free bootable Rescue CD that allows you to fix a computer that no longer starts up correctly.

Malwarebytes – Designed to clean out all types of malicious malware.

Spybot – One of the first anti-spyware apps that has faded in popularity.

SUPERAntiSpyware.com – Detect and remove Spyware, Adware and Remove Malware, Trojans, and more.

ThreatFire AntiVirus – Actively defends against new threats.

6. Free Anti-Phishing Toolbars

Most anti-virus or internet security software provides anti-phishing support built-in. If your security software does not include this feature, consider installing on of these toolbars.

Traffic Light – From bitdefender, unobtrusive web threat control

Netcraft Anti-Phishing Toolbar – Community based anti phishing toolbar.

7. Intrusion prevention and detection

Intrusion prevention and detection software is designed to watch network traffic and prevent attacks on your network. This software is typically targeted towards small to mid-sized businesses.

snort.org – Open source network intrusion prevention and detection system (IDS/IPS)

Syslog watcher – Syslog Watcher can collect, parse, store and analyze syslogs. Not really an intrusion prevention, however users can examine router and firewall logs looking for intrusions.

Kiwi Syslog Server – Receive and manage syslog messages from network devices.

8. Anti-Virus Review Sites that compare security software

Techradar.com – Reviews security software.

AV-comparatives.org – Independent comparatives of Anti-Virus software

PC Magazine – Online review site with security software reviews.

Virus Bulletin – Independent anti-virus software test lab

Virus total scanner – Scan files, you submit, online using multiple virus engines. This process is slow because you have to upload the files to their servers.
Jotti’s Malware Scan – Scan files, you submit, online using multiple virus engines
NoVirusThanks – Threat analysis APIs, tools to prevent virus

OPSWAT Metascan – Scan files, you submit, online using multiple virus engines

9. Malware Analyzers – Analyze the behavior of files you upload:

Anlyz

Any Run
Threatexpert
Norman
Comodo Instant Analysis

10. Misc Security Software

SuRun is very configurable implementation of Run as Administrator.

There are many free alternatives in Internet security software for the PC. Hopefully the lists of programs above satisfy your needs for internet security software.

Firefox is one of the most popular web browser for Windows and other platforms. This makes it a large target for malware and cybercrime. We will focus on securing Firefox, and will significantly increase the browser’s security through add-ins and special hardening settings. We are avoiding earlier versions of Firefox and recommend users to upgrade to the latest version of Firefox. We also recommend running under Windows 7, 8 or 10, so if you are running under an older version of Windows, we recommend you to upgrade or buy a new computer. Older versions of Windows like Windows XP were not built with security in mind.

Secure your computer, web browser, Internet connection

Follow our guides to secure your Windows PC or secure your Macintosh by installing the right software, firewall, antivirus software, etc. Secure your mobile devices: iPhone, Android smartphone or tablet, iPad. Configure the settings and add plug-ins to you web browser so that it is more secure. Consult our tutorials for: Internet Explorer 9, Google Chrome, and Mozilla Firefox. Secure your Internet Connection: Wireless Network, Public Wi-Fi.

We recommend booting from a Linux CD or USB key when performing mission critical applications such as online banking, online trading, or online shopping.

Firefox includes the following security oriented features:

• Instant Web ID
• Do not Track
• Private Browsing
• Clear Recent History
• Customized Security Setting

The Golden rules of the Internet:

• Do not trust anyone
• If it is too good to be true, it probably is
• Don’t install software from anonymous sources
• Don’t automatically hit “yes” to any pop-up
• If it looks suspicious, run

Before you make any changes to your system, always back it up.

Firefox Add-ons to UNINSTALL

Software that enhances Firefox can become targets of malware, adding new entry points into your computer. It is mandatory that you keep any third-party add-ons up to date, so allow Firefox to update plugins when necessary. Consider removing an add-on if it is rarely used, as you will also be increasing the security of Firefox through its removal.

Plugins are also one of the biggest sources of malware, so only install plugins from trusted developers.

• Adobe Reader or Adobe Acrobat – This is a major source of internet threats, so consider using an alternative PDF reader such as Foxit Reader, or PDF-XChange.
• Flash Player – This animation enhancement plug-in is widely used but full of security holes, leading to many updates. If you need Flash, you will have to update it constantly.
• Java – This language allows many cross platform programs to run in the browser, but is another huge target of malware. We recommend removing it unless you really need it for a particular application. This page checks if Java is installed. At a minimum disable Java in the browser by going into the Java Control Panel – Security Tab – Uncheck Enable Java content in the browser
• Quicktime – Is installed when older version of iTunes was installed in your system. Remove it, as it is not being updated any more.
• Silverlight – We recommend removing it from your system unless you really need it. This software is another possible time bomb waiting for exploitation.

Hardening Firefox’s Settings

Firefox can be secured even more with several key changes to the browser’s settings.  We have selected all the Critical settings for Firefox.

1. Prevent Firefox from saving passwords

Firefox can save passwords for different websites. We recommend that you do not use this feature because it is not as secure or flexible as using a password management program.

1. Launch Firefox
2. Click on the Tools Menu
3. Select Options
4. Select Security Tab
5. Make sure Remember password for sites and Use master password are not checked
6. Click Saved Passwords
7. Click Remove All to remove saved passwords

2. Mark Valuable Data Inaccessible to Firefox

Download chml.exe and run it to change the permissions on your valuable files and folders on your system as unreadable to Firefox. (Better yet, use Truecrypt and keep the volume unmounted!)
For example if your sensitive data is stored in the folder C:\Sensitive_Data – You would do:

1. Press Start menu
   
2. Go to All Programs
3. Go to Accessories
4. Right-Click on Command Prompt
5. Select Run as Administrator
6. Type “chml C:\Sensitive_Data -i:m -nr -nx -nw“
7. Press Enter to Execute the Command
8. Type Exit to end the Command Prompt

3. Allow Firefox to update itself

Firefox automatically tries to update itself, which is a good thing, but it asks whether it is ok to install a newer version. Be sure allow Firefox to update itself tot he latest version available, so that you have all the latest security fixes.

4. Prevent Firefox from using a GPU

There have been several bugs related to using a Graphics processor or GPU. They were first supported in Firefox 4. This hardware level access can spell trouble. Disable GPU support to prevent this possible problem.

Helpful Firefox Add-ins

NoScript – Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks. By default, new websites that you visit will be loaded without scripting, maximizing safety. You can easily allow safe websites to allow scripting. Make Sure you go into the Options – Whitelist – And remove all sites from it, so you start from scratch without trusting anyone.

HTTPS Everywhere – Automatically makes Firefox try to use https secure connections whenever available.

Simple URL Extender – Replaces short URLs with the originals so you can see where links actually link to. Essential for Twitter.

URLs List – Shows the URLs of all the tabs of a webpage.

WOT – Know Which Websites to Trust – Shows you which websites are trustworthy based on millions of users’ experiences.

Adblock Plus – Block those pesky banner ads.

Qualys BrowserCheck – Performs a security scan on your browser and its plug-ins (Windows)

Cocoon – All-in-one plugin that tunnels your traffic through a SSL-encrypted proxy for privacy and security.

uBlock Origin – Filter out ads, trackers, and other sites.

Helpful Internet Security Add-ins

Phising Toolbars – Firefox already includes the SmartScreen Filter that detects dangerous websites and warns you. If you would like to install a supplemental toolbar add-in, see our Free Internet Security Software article. BitDefender TrafficLight works with Firefox to secure your browsing.

Internet Security Software – Supplemental internet security software including Anti-Virus and Anti-Spyware software is a necessity when surfing on the Internet. See our Free Internet Security Software article for links to various free software utilities.

Password Managers – It is critical that you generate, store, and use secure passwords on the Internet. See our How to Create, Store, and Use Secure Passwords article for details on several password management programs.

Sandboxie – Creates a sandbox or safe environment in which programs execute. This sandbox is a isolated space which prevents programs like Firefox from making permanent changes to other programs and data in your computer. Free for 30-days, then 29 euros.

Other Firefox Security Enhancements

Google Public DNS – A high performance domain name server (DNS) replacement for your ISP’s DNS. Protects against Spoofing attacks and DoS and amplification attacks. Be sure to write down your existing DNS settings before changing them.

Dyn Internet Guide – Free Web content filtering.

Microsoft Virtual Machine – Designed for web developers to test compatibility with different versions of Firefox, these Virtual Machines for Microsoft’s Virtual PC allow you to run a Virtual computer on your desktop with Internet Explorer and Firefox pre-installed. If you mess up the Virtual computer, you can just delete it and start fresh from a new image. Keep in mind some malware is capable of detecting virtual machines and acting innocent until you move into your main system.
If you use VMware Player, you can add the following line to your .vmx file so that it writes all changes to a temporary file, which will be deleted when you power off the virtual machine.:ide0:0.mode = “independent-nonpersistent”

Dell KACE – has a free secure browser based on a virtualized and contained Firefox Browser with Adobe Reader and Flash plug-ins.

Secure Web Browsing with HTTPS

Normal website access using HTTP:// causes information to be sent and received in plain text. This type of connection is not secure; a hacker could capture all the information being transferred and steal your data. While this is not important when you are casually surfing, you do not want your email or online trading information to be captured by others.

Force websites to use secure connections – It is important to utilize secure connections or HTTPS whenever possible. Several large websites have configuration options to force these secure connections. Here is more information on configuring HTTPS with: Gmail, Facebook, Twitter, Google. Google.com defaults to HTTPS if you are signed into your Google Account, if you are not, just manually add the s after http to force a secure connection ie –  https://www.google.com

HTTPS causes a secure connection to be made using SSL security. Certificates are digital documents that verify a site’s identity. They are sold by certificate authorities. If a certificate is not signed correctly, your browser will pop up a warning. Recently, a Dutch certificate authority got breached, causing forged certificates to be created. To workaround issues like this, Internet browsers are updated to remove the forged SSL certificates. It is crucial that you keep your browser up-to-date.

If you have applications other than your web browser accessing the Internet (FTP client, desktop mail client, etc.), make sure you enable SSL secure connections within each application.

Use a password manager to create, use, and store passwords for websites. See our password manager guide for details.

By applying special Firefox settings, we can significantly increase the security of our Windows notebook and desktop PCs.

This concludes our How to Secure a Windows based personal computer article. Other articles on Safegadget.com help you secure the other aspects of your personal computer, including How to Set up a Secure wireless Internet Router, and How to Secure Internet Explorer article, or How to Secure Firefox Article. Please see our other articles on security tips for your e-mail, iPad, online banking, online shopping, smart phones, and more.

Optional Software from Microsoft and Other Third Party Developers is a crucial part of adding computer security to your Windows based PC. We recommend a minimal set of crucial network security software add-ons that we feel all users should install. Here are several extremely useful free security oriented software utilities from Microsoft, that are not bundled with the operating system. These programs add additional security for Windows and are free to download.

Before you make any changes to your system, always back it up.

Google Docs can replace Microsoft Word and Excel. Doing so helps prevent many of the security holes in Microsoft Office including Flash based bugs.

Windows Firewall Control customizes Windows 10’s built in firewall. You can control outbound traffic if you set it to Medium filtering or High.

Microsoft Security Essentials – For Windows 7. Free anti-virus software from Microsoft that is a no-brainer for everyone. Microsoft Security Essentials can also be used by small business on up to 10 PCs! It includes automatic updates and is easy to use. Newer versions of Windows include Windows Defender.

Microsoft Baseline Security Analyzer – Scans your system for security problems, missing or obsolete Windows components and patches. This is oriented towards small and medium sized businesses but can also be used by consumers. For Windows 7 and server operating systems.

Windows Defender Offline formerly known as Microsoft Standalone System Sweeper Tool – A bootable software tool that can find root kits and other hard to find malware (like rootkits) that normal anti-virus and anti-spyware software can’t. This creates a bootable CD/DVD or USB drive that needs to be booted from. Only run this tool when you believe you have been infected or every three months or so.

3rd parties have a similar Rescue Bootable CDs:

• AVG Rescue CD
• Avira Rescue System
• BitDefender Rescue CD
• Comodo Rescue Disk
• F-Secure Rescue CD
• Kaspersky Rescue Disk no longer recommended – Russian Government Ties
• Trend Micro Rescue Disk

Microsoft Log Parser – is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®. The results of your query can be custom-formatted in text based output, or they can be persisted to more specialty targets like SQL, SYSLOG, or a chart.

Top Security Suites

If you prefer to purchase Internet security suite, a recent PC World review listed the top 3 security suites as:

• G Data Internet Security
• Norton Internet Security
• Bitdefender Internet Security

Free and Useful third-party software tools

These are several critical tools that every user should have installed on their system to increase security. These tools are not made by Microsoft but are a critical part of any free security software suite.

Foxit Reader – PDF files are a widely used means of breaking into a computer. A 3rd party PDF-reading utility that has far fewer security holes than industry standard Adobe Reader. Malicious PDF files that are emailed, are one of the fastest growing infection vectors for malware. We recommend removing Adobe Reader or Adobe Acrobat Reader and using this instead.

PC Decrapifer – Quickly uninstalls unnecessary or trial software loaded by PC companies. This is a good program to run after you have purchased a brand new PC. No need to run this on an existing Windows PC.

Sumo – Scans your system for obsolete software. Older versions of software may possess security risks that must be fixed. If you find yourself updating a lot of software you do not use, uninstall the program. Older versions of software may no longer be updated, forcing users to pay for newer ones. Using old unsupported software may put you at a security risk. Secunia’s PSI was discontinued.

GlassWire is a free firewall and network monitor tool for Windows.

NoVirusThanks has several useful free PC utilities including SysHardener and OSArmor

Zone alarm Free – A free firewall program that has been in existence for many years. It adds many capabilities and easy to access filters, over the one built into Windows 7.

Truecrypt – Free open-source software that encrypts critical files, folders, or entire drives. Utilizes extremely secure encryption algorithms. Store your most sensitive data within Truecrypt encrypted containers. Consider encrypting your entire drive if you own a laptop.

Truecrypt’s founders have walked away from its project around 2014 and say “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues”. Forked versions of Truecrypt are now available as is a security audit on the code itself.

Veracrypt is based on Truecrypt 7.1a and should be what you switch to.

Revo UnInstaller – Uninstaller utility, only for use when the regular uninstaller fails to function.

CCleaner – This utility goes way beyond Windows 7’s disk cleanup tool. It helps remove unnecessary files to free up disk space, and to securely erase free space and deleted files. No need to ever pay for a utility that claims to speed up your machine or clean your registry. Supports 32-bit or 64-bit. Also cleans up files from many popular third party applications.

Malwarebytes Anti-Malware – was free software that helps you remove malware, not defend against it. With version 3 they started charging. They also have a free Malwarebytes AdwCleaner.  Consider installing this program if you are unable to remove malware using the software utilities listed above. If Malwarebytes did not help to remove the infection, try SuperAntiSpyware Portable. Copy it to a CD or USB flashdrive, boot your computer into safe mode, then run the program. F-Secure has a free bootable Rescue CD that allows you to fix a computer that no longer starts up correctly.

NoBot – An anti-bot software scanner that does not need to be installed.

WinPatrol – Takes snapshots of your critical system files and resources. The program then alerts you to any changes that may occur due to malware or installing software.

Retina Network Community – Lets you test your server and hosting for security vulnerabilities.

Heimdal Security Software Free – Helps update software to prevent security holes.

By applying several free Windows security utilities, we can significantly increase the security of our Windows notebook and desktop PCs.

This concludes our Free Security How to: Computer Security and Computer Protection on a Windows computer article. Other articles on Safegadget.com help you secure the other aspects of your personal computer, including How to Set up a Secure Wireless Network, and How to Secure Internet Explorer article, or How to Secure Firefox Article. Please see our other articles on security tips for your e-mail, iPad, online banking, online shopping, smart phones, and more.

Every computer user uses e-mail. Security breaches make headlines almost daily. With more and more people going online, consumers are worried more than ever about keeping their e-mail safe and secure.

E-mail is the major way most malware is transmitted across the Internet. E-mail is the largest attack vector against large companies, as it is far more difficult to physically infiltrate a company. In this article, we will help you use e-mail more securely.

A recent experiment of 150,000 test emails sent by Verizon Enterprise Solutions found that 23% of recipients opened the email, 11% click on the attachment. One person clicking on the attachment would have infected the organization.  The human is the weakest link.

Secure your computer, web browser, Internet connection

Follow our guides to secure your Windows PC or secure your Macintosh by installing the right software, firewall, antivirus software, etc. Secure your mobile devices: iPhone, Android smartphone or tablet, iPad. Configure the settings and add plug-ins to you web browser so that it is more secure. Consult our tutorials for: Internet Explorer 9, Google Chrome, and Mozilla Firefox. Secure your Internet Connection: Wireless Network, Public Wi-Fi.

The Golden rules of the Internet:

• Do not trust anyone
• If it is too good to be true, it probably is
• Don’t install software from anonymous sources
• Don’t automatically hit “yes” to any pop-up
• If it looks suspicious, run

Secure Your Router

1. Configure your wireless router for optimal security. Consult our article How to set up a secure wireless router for details. For maximum security, access your e-mail when connected by a hardwired connection such as Ethernet.

Update and Secure Operating System

2. Ensure that your operating system is set up securely. Consult our computer security guides for Windows and Macintosh. For maximum security, you could start off a Linux boot CD or USB key.

Secure Internet Browsers

3. Secure your Internet browser. Consult our security guides to Internet Explorer, Firefox, and Google Chrome.

Pick a Good Email Provider

4. Most people already have an e-mail address that they are connected to. If you are considering a new e-mail address, consider examining how sophisticated the provider is. Infrastructure and state-of-the-art spam filtering are not inexpensive. We recommend users consider e-mail addresses from providers like Lavabit, Google and Hushmail. These companies are committed to staying on the leading edge, and are accessible anywhere. ISP based e-mail is convenient, but locks you in to the ISP. The same argument applies to school or company based e-mail addresses.You can always access these e-mail account via POP access in Gmail. This will allow your email account to utilize Gmail’s excellent spam filters.

Look for e-mail providers that have good spam filters and allow you to control attachments and HTML within e-mail messages.

Make Sure Email is using HTTPS

5. Make sure you are accessing the e-mail provider’s website using a secure connection, look for https:// in the browser’s address bar and a padlock icon in the browser. A broken key, broken padlock, or any open lock indicates it is not secure.

Use Unique Passwords

6. When creating an account at the e-mail provider’s website, we recommend you use a unique password as it is far safer in case the store gets hacked. You would not want hackers to get a password that worked on other websites. Consult our How to create, store and use secure passwords article for suggestions.

Create Multiple Email Accounts

7. We recommend creating multiple email accounts for different purposes, in order to maximize online safety. Having multiple email accounts linking to different accounts online. One example would be to have one email account for forums, one for banking, and one for shopping. Do not have all your emergency recovery email address be the same. This way if one email account gets compromised, the others are safe.

Use Two Factor Authentication if Available

8. Some e-mail providers support two factor authentication which requires users log in with both a password and a phrase generated on a smartphone, smartcard, or printed on a piece of paper. Gmail is a leading e-mail provider that supports this 2-factor authentication. Yahoo mail added 2-factor support at the end of 2011. A hacker who had your password could not log on without a second means of authentication. This is especially good for people that travel out of the country.

Two factor authentication system using SMS text messages is not secure, due to hijacking of mobile phone accounts and the weak SS7 routing system. We suggest only using two factor when you can use a physical token or a time based authenticator like Google’s.

Use 3G/4G connection instead of Public WiFi when checking Email

9. When accessing e-mail on a smartphone or tablet, using the built in 3G/4G connection is a lot safer than connecting via a local wireless internet hotspot. This warning applies to both apps and mobile internet browsers.

Don’t open suspicious links and/or attachments

10. To avoid falling victim to e-mail phishing, never click a link or open an attachment from an e-mail. This is especially true for online banks and online brokerages. Manually type the URL into your browser.

Spear Phishing is utilizing realistic looking e-mails with personalized information, possibly emanating from a known person to steal your login password, run a attachment that contains malware, or force you to visit a web page containing malware.

Fact: When a someone has more information about us, we are more likely to trust them. If your personal details leaked in a company’s data breach, criminals could use that information to craft emails that look more credible.

Opening Attachments Safely with Gmail

Forward the email with attachment to a Gmail account.  From there, you can use Google Docs to open Word Processing, Spreadsheets, etc.  No need to endanger your own computer.

Minimize your personal information on Facebook, Twitter, Instagram, etc. Also cleanse or set to Private your Amazon wishlists and eBay bidding history.

Fight SPAM

11. Spam unfortunately, remains a unfortunate element in e-mail. Leading e-mail providers are pretty good at fighting spam, but no one is perfect. Unintended consequences include good mail ending up in a spam folder. Be very careful when accessing the spam folder as many a penetration has been enabled when workers accidentally click on links within spam folder e-mails that look legitimate.

Don’t Display HTML

12. For maximum security set your e-mail provider’s configuration to not display HTML when displaying e-mail. A less secure setting is to allow HTML but not to display images. This additional security tactic helps prevent rogue pages from being displayed within e-mail. (Windows Live Hotmail does not allow you to control this.)

We suggest these settings for Gmail:

• Select Mail Settings from the Gear Icon in the upper right corner
• In the General Tab, next to External Content: Select Ask before displaying external content

Use SSL to access Mail Servers

13. It is important that email accounts accessed from a smartphone are setup utilizing encryption when available. Many email providers including Google’s Gmail, Microsoft Exchange, MobileMe, AOL Mail and Yahoo Mail support SSL (secure sockets layer) when accessing their mail servers. If SSL is not used, your emails as well as your password can be read by hackers.

To enable SSL with Yahoo Mail (not enabled by default) follow these steps:

• Login to your Yahoo Mail account
• Click the Gear icon on the upper-right corner
• Select “Mail Options“
• Click General on the Left, Under Mail Options
• Check the Box next to “Turn on SSL“
• Click Save at the top of the screen.

14. If you have applications other than your web browser accessing your E-mail IE. A desktop mail client suck as Windows Live Mail, Outlook, or Mail.app, make sure you enable SSL secure connections within each application. Here is a tutorial on using Gmail with Windows Live Mail.

Be careful of Short URLs

15. Do not click on shortened URLs, expand them first using a site like URL Expander or run them through a service like Virustotal.

Report Phishing

16. If you encounter phishing emails you can forward them to:

• reportphishing@antiphishing.org
• spam@uce.gov
• Internet Crime Complaint Center
• Anti-Phishing Working Group
• Stay Safe Online has spam reporting information on the top 10 ISPs

Check to see if any Email addresses have been compromised

17. There are databases of email addresses that have been compromised. If you are listed, immediately change all your passwords connected to that email account.

• haveibeenpwned.com

18. Someday phishing will hopefully fade in volume.  DMARC.org which stands for “Domain-based Message Authentication, Reporting & Conformance” may help reduce the volume of problematic emails.

Encrypt the contents of Email

19. Email uses an insecure SMTP protocol to send data between servers.  All the data sent is unencrypted.  This factor has nothing to do with using SSL to connect your email provider.  You need to use tools like PGP (pretty good privacy) to encrypt the contents of your emails to ensure privacy.  Never send a password in email.

Email Attachment

Next to clicking a link in an email, clicking an attachment is the second most dangerous way to get infected.

Block attachments in your email client.

Gmail automatically blocks:

.ADE, .ADP, .BAT, .CHM, .CMD, .COM, .CPL, .EXE, .HTA, .INS, .ISP, .JAR, .JSE, .LIB, .LNK, .MDE, .MSC, .MSP, .MST, .PIF, .SCR, .SCT, .SHB, .SYS, .VB, .VBE, .VBS, .VXD, .WSC, .WSF, .WSH

We recommend you supplement this by blocking these file types that are not used very often any more. Select Create a new filter from Filters and Blocked Addresss

Things Not To Do

1. Do not access your e-mail from public wifi hot spots unprotected or cyber cafes. Many of these locations provide little to no security and are prone to snooping or malware.

2. Always log out web-based e-mail account, do not simply close the browser.

3. Do not have a single email address where everything goes.  If everything is linked together, you entire security chain can get compromised with one break in.

We feature many different security tutorials.

• Learn how to secure your PC, find free anti-virus software, and find Windows security software
• Secure your Mac and find free Mac security software
• Use Linux for secure online banking, online trading, and online shopping
• Secure your wireless network (Wi-Fi)
• Learn how to create, store and use secure passwords

Harden the Security of your Browser

• Chrome
• Internet Explorer 9
• Firefox

Boost the Security of your Smartphones and Tablets

• iPhone
• iPad
• Android Smartphone or Tablet

Learn how to perform the following Safely and Securely

• Online banking and online trading
• Online shopping
• E-mail

Twitter is becoming more popular everyday. With millions of people to be targeted, Twitter is definitely a battleground for security and privacy. This website has become a worldwide hit and consequently has become a target for those intent on spamming, spreading worms, and stealing private information. In this article, we will cover many techniques to allow you to safely use Twitter.

Secure your computer, web browser, Internet connection

Follow our guides to secure your Windows PC or secure your Macintosh by installing the right software, firewall, antivirus software, etc. Secure your mobile devices: iPhone, Android smartphone or tablet, iPad. Configure the settings and add plug-ins to you web browser so that it is more secure. Consult our tutorials for: Internet Explorer 9, Google Chrome, and Mozilla Firefox. Secure your Internet Connection: Wireless Network, Public Wi-Fi.

It is important that you follow the tips above to ensure your computer is secure. There have been Twitter Spam Attacks caused when malware infects a computer and gives control of the user’s Twitter account to a spammer. The spammer then posts messages on Twitter offering everything from Free items to pictures of celebrities, all appearing to be posted by the infected user. If one of your friends clicks on the offer, they instantly get infected, repeating the cycle of malware propagation.

Access the Real Twitter

Always make sure you are at a real Twitter log in page when you access their site. Do not count on Twitter links in email or on web pages to access the real Twitter website.

Think before Clicking on Links

There have been several viruses that have hit Twitter users, many of which have caused links to malware on Twitter. It is important that you exercise care before clicking on any links. Twitter has added a automatic link screening service, but this service could be bypassed. Be especially cautious in clicking links from direct messages.

Shortened links that do not fully disclose the destination site should be expanded before being clicked. You can expand short links with a browser plugin such as Linkpeelr for Chrome or visit a site like URL Expander or unshorten.it Virustotal.com checks shortened url’s for malware. Consult our How to Secure Your Internet Browser article for details. Internet Explorer 9 – Mozilla Firefox – Google Chrome

Enable Two Factor Authentication

Enable Two Factor Authentication so a login will require you to check your smartphone for a pin code. This only takes a minute and would have prevented many Twitter hacks.

Secure Twitter Browsing

As with the rest of the web, browsing a website using a secure connection is always preferable. You can set Twitter to automatically use secure HTTPS browsing by doing the following:

1. Click your Twitter Account name on the upper right hand corner
2. Select Settings
3. Check Always use HTTPS
4. Click Save

Sharing Sensitive Information

The following information is sensitive and may not be desired to be shared with others. Thieves can use this information as well those trying to piece together your identity or those attempting to hack your passwords. Think twice before including any of this information in your Tweets.

• Who your friends are
• Vacations or times away from home
• Real birthday, at least no year
• Mother’s maiden name
• Pets names
• Children’s names
• Address
• Phone numbers
• Schools attended
• Religious views
• Political views
• Tweet Location
• Changing Passwords
• Moving
• Switching Servers

Consider having separate work and personal Twitter accounts. Be sure not to Tweet anything that could offend your employer.

Twitter Passwords and Access

It is important to follow our standard password suggestions. Consult our article on How to create, store, and use secure passwords.

Removing Unnecessary Twitter Applications

Twitter stores access credentials for 3rd-party applications. This allows them to send Tweets. You should review the list of applications allowed access to your account and remove unnecessary applications.

1. Click your Twitter Account name on the upper right hand corner
2. Select Settings
3. Click on Applications tab
4. Click Revoke Access on unnecessary applications

We have covered many areas in which you can increase the security and privacy of your Twitter usage. We suggest you implement as many of the suggestions as quickly as possible to maximize your safety on Twitter.

Scan your Twitter feed for Spam

Use a site like TwitBlock to look for spammy followers and bots.

The only thing worse than spam in your email box is a spam text message on your cell phone or smartphone. For the last 20 years spam has been clogging up our email, and now it is in full bloom on our phones. Spam Texting needs to stop.

How do Spammers get Phone Numbers?

There are several sources of phone numbers for text message spamming.

• Internet postings
• Random phone number generation
• Auto dialing robo calling

The Dangers in Spam Text Messages

Just like email spam, offers made in unsolicited text messages are full of bogus offers like free iPads, prizes, or gift cards, etc. Clicking on any link or calling a phone number listed in the text message can result in the following:

• Malware being installed on your phone
• Unauthorized charges billed to your phone
• Recurring items added to your phone bill
• Private information being transmitted to cyber criminals

Fighting Unsolicited Text Messages

The major wireless providers, AT&T, Verizon, Sprint, and T-Mobile try to do everything in their power to prevent these. Each person calling to complain costs them from $5 to $50. The carriers are banding together to create anti-spam and mobile security solutions. Slowly, cell phone technology will rise to the same level as email and anti-spam filters.

The Federal Trade Commission files suit against spammers to help reduce the problems.

You can complain to your wireless carrier and let them know that you are receiving unsolicited text messages by doing the following:

Blocking Text Spam

The major wireless carriers provide Free Spam blocking controls for users. However, there are restrictions.

Here is how you can access the blocking controls online for each carrier:

Verizon Wireless – They offer many different free options to block text spam.

1. Log into your My Verizon wireless account
2. Go to My Services
3. Go to Verizon Safeguards
4. Go to Spam Controls
5. Go to Internet Spam Blocking and Call & Message Blocking
6. Save desired configuration

There are 3 options for Internet Spam Blocking you can select from :

1. Block all messages from the web.
2. Block all messages from emails.
3. Block  up to 15 specific email addresses and/or web domains (i.e. domain.com).

There are 2 options for Call & Message Blocking you can select from:

1. Block all calls & text messages originated from specific numbers
2. Block up to 5 specific numbers at one time.
   1. Expires 90 days from the date of your first block.
   2. Can reestablish blocked number by adding blocking preferences after they expire.

Verizon also offers Usage Controls for $4.99/month per line. This allows you to block up to 20 contacts (i.e. phone number, email address, instant messaging screen names).

AT&T Wireless –

They provide different ways to block spam form their source:

Internet spam & email address spam:

• Respond to the spam with “BLOCK” in the body

or

1. Log in to My Messages – This site is different than the main AT&T wireless website, so it requires a separate account to be created.
2. Select Blocking Options under the Preferences section
3. Type the domain or email you wish to block in the Block List section
4. Click Submit to save changes

Create an Alias for your wireless number (Example: your-alias@txt.att.net instead of your-wireless-number@txt.att.net)

1. Log in to My Messages
2. Select Message Options under the Preferences section
3. Input your desired alias without the “@txt.att.net” in the alias option
4. Click Submit to save changes

Short Code Spam (4-digits are shown, not a phone number):

•  Reply “STOP” in the body to block sender from spamming messages to you in the future.

Wireless Number Spam – AT&T does not currently offer a Free solution to wireless number spam. The only way to block wireless number spam currently is by signing up for AT&T’s Smart Limits for Wireless. The service costs $4.99/month per line. Similarly to Verizon’s Usage Controls.

You must purchase the Smart Limits feature before configuring Smart Limit options. Afterward, you may set up Wireless number blocking by following these steps:

1. Log in to your Wireless Account
2. Click the myAT&T tab
3. Click the Wireless category
4. Click Smart Limits under Enhanced Services
5. Click Blocked Numbers under your phone
6. Enter the 9-digit phone number you wish to block
7. Click Submit to add to your Blocked Numbers list

If mobile spam continues to be a problem, you may contact AT&T’s Customer Service at 1-800-331-0500 for additional help or forward the spam to the short code “SPAM” (7726) to open an investigation. AT&T says, “There is no charge to report mobile spam. Messages forwarded to 7726 do not count toward your data usage or voice package.”

Sprint –

• They have a very complex system to manage text blocking, see this page.

or

• Forward spam directly to abuse@messanging.sprintpcs.com or call customer care at *2 (Sprint phones)/ 611 (Nextel phones). More information here.

T-Mobile –

• Forward the message to “SPAM” (7726)
• T-Mobile will send back a confirmation that they have received your message
• T-Mobile will ask you to send them the number of the original sender so they can try to identify the identity of the spammer

*Note* Sprint does not have auto-blocking available yet & T-Mobile does not currently offer a blocking from the Internet.

Remove Text Messaging Completely

If the options to fight text message spam are not versatile enough, we recommend you disable text messaging completely. You can then use a third-party app to send and receive text messages albeit to a different phone number.

Verizon –

Call *611 and ask Verizon’s Customer Support to disable text messaging for you

or

Remove text messaging completely from your phone online in your account settings by doing the following:

1. Log in to My Verizon Account
2. Go to My Services
3. Click Add/Remove Services
4. Select Messages
5. Click Remove
6. Click Next to submit request

AT&T –

You can also go to http://mymessages.wireless.att.com/ to disable text messages sent to you as email. Keep in mind, this just affects text messages sent via email and not directly to your phone number. Most of the text message spam is not sent this way. Call customer service to totally disable texting.

Sprint -Call Sprint Customer Service to disable text messages.

T-Mobile – Allows blocking incoming and outgoing text messages (SMS), picture messages (MMS), Instant Messages (IM), and e-mail to be configured online.

Apps to help you fight Text Spam Messages

These apps help you block texting spam.

smsBlocker – Android – SMS blocking & text filter tool

VeroSMS – iOS – SMS blocking & text filter tool

Free Texting Apps:

Free apps are available to send/receive Text Messages for free on smartphones. These do require you to use a different phone number to receive messages. Simply turn off texting with your carrier and use this.

Text+ – iOS, Android – Ad supported.

Google Voice

Google Voice helps you create virtual phone number to send/receive calls, messages, and texts.  It is available for iOS, Android. Simply turn off texting with your carrier and use this.

Texting spam is costly and time consuming.  There are many techniques for dealing with it, and most are free.