Promptware Attacks

[sparkplug]

Yeah - if you've got Windows specific applications then you're stuck with running them on Windows.

There's not really any way round that.

There are probably quite a few like that in commercial application - but for my home use I've never needed it.

 

[sparkplug]

I haven't mentioned Antivirus/Anti Malware because I sort of assumed that everyone knows about them already - but that's also something worth having.

The world of hacking has changed a bit so an AV alone isn't sufficient as protection, but it does still play a part in your overall strategy.

The free ones are probably good enough for home use. Avast, AVG, BitDefender...

Paid ones give you a few more options, but have a read through and decide if it's worth the money.

What I do personally think is worth the money is a proper firewall. I don't mean running Windows Firewall on your laptop, I mean a device that sits between your BT/Virgin/Vodaphone/Whatever main router and the rest of your network.

For companies, this is one of the requirements to get the CyberEssentials accreditation.

Now, this again could be complete overkill for a home network, and it does fall into the 'advanced' category, but it doesn't have to be particularly expensive.

What you're looking for is something that will do Intrusion Detection and Intrusion Prevention (IPS/IDS).

Lots of choices out there but I'm a big fan of the UniFi kit because there's no subscription. You buy it, you own it. Updates are free.

There is the option to buy the CyberSecure protection which for £80/year isn't really a massive cost.

Lots of device choices out there but something like the DreamRouter7 for £220 isn't a bad starting point as an 'all in one' device.

This will work 'straight out of the box' (although I think you have to turn on IDS manually in the settings) but will also let you have really fine level of control if you want it to.

It also lets you set up a 'guest network' so you don't have to give people outside of your family access to your home network.

Anyway, I'm digressing again...

 

[karlp]

I haven't mentioned Antivirus/Anti Malware because I sort of assumed that everyone knows about them already - but that's also something worth having.

The world of hacking has changed a bit so an AV alone isn't sufficient as protection, but it does still play a part in your overall strategy.

The free ones are probably good enough for home use. Avast, AVG, BitDefender...

Paid ones give you a few more options, but have a read through and decide if it's worth the money.

What I do personally think is worth the money is a proper firewall. I don't mean running Windows Firewall on your laptop, I mean a device that sits between your BT/Virgin/Vodaphone/Whatever main router and the rest of your network.

For companies, this is one of the requirements to get the CyberEssentials accreditation.

Now, this again could be complete overkill for a home network, and it does fall into the 'advanced' category, but it doesn't have to be particularly expensive.

What you're looking for is something that will do Intrusion Detection and Intrusion Prevention (IPS/IDS).

Lots of choices out there but I'm a big fan of the UniFi kit because there's no subscription. You buy it, you own it. Updates are free.

There is the option to buy the CyberSecure protection which for £80/year isn't really a massive cost.

Lots of device choices out there but something like the DreamRouter7 for £220 isn't a bad starting point as an 'all in one' device.

This will work 'straight out of the box' (although I think you have to turn on IDS manually in the settings) but will also let you have really fine level of control if you want it to.

It also lets you set up a 'guest network' so you don't have to give people outside of your family access to your home network.

Anyway, I'm digressing again...

All useful information

Thanks

 

[Mr Derek]

Lots of excellent information and as a tech numpty, I am amazed at how many of your suggestions I am already using. Perhaps it's because I neither like nor trust tech.

I'm a bit confused about VPNs. I know the theory but how do you use one in practice? Do you download one onto each device? ( I use Apple stuff. iPhone, iPad and MacBook air. The lovely Mrs Derek uses the android equivalent) Does it make using the interweb any harder or does everything happen without the user even realising it's happening? Is it worth paying for or will free stuff do the job?

Thanks in advance.

 

[sparkplug]

I like tech, but I don't trust it

Well, that's not true. The tech itself isn't at fault. Like any other tool it can be used in good or bad ways.

VPNs is an interesting topic and again one where a 'quick and dirty' answer won't cover the finer points but I'll give it a go

What is a VPN? Essentially just a way of connecting two devices 'privately'

Does it make it any harder? No, you just turn on the VPN on your phone / computer and off you go. It does make it slower though....


What most people think of is NordVPN or some other paid for service where you can pretend you're in a different country so you can watch iPlayer when on holiday or bypass some of the recent restrictions brought in by the Online Safety Act for ..um.. 'research' purposes?

Yes, VPNs can make 'the internet' think you're somewhere different geographically and they achieve this by using the IP address of the device you're connected to rather than your local one. So the big providers just have a bunch of servers all over the world. NordVPN has something over 6,500 servers in more than 100 countries - so that's what you're paying for.

So how can the free providers do it for free? Well, there's an old saying that if the service is free then you are the product! Essentially some of your data may not be as private as you might like and may be being sold off if you're using free online providers.

Not to be confused with other free VPN software which comes from the Open Source community and credible providers.

Yes, I know. "Don't trust the free stuff, apart from this other free stuff" - I did say it wasn't straight forward

To answer the question, yes, I do use a VPN. Not very often, but I do use one.

When would I use one, and why?
Mainly when in hotels but in theory whenever I connect to 'public WiFi'. In theory that could include cafes, airports and any other 'guest network' scenario.

Why? Because who knows if I actually connected to the real network or to someone broadcasting the same SSID sat next to me (Man in the Middle attack) or if the network is secure (you'd be surprised how weak the security on many cafe WiFi routers is).

Now, I don't sit at Starbucks all day working 'remotely' using their free WiFi, so the only time I really ever use a non-trusted network is in Hotels. I have a VPN server at home so I connect to that and I'm essentially working as if I was at home. This does mean that when I'm abroad I could theoretically continue to watch Auntie Beeb (I don't but that's from choice rather than any technical limitation).

What's the difference?

With a paid (or dodgy free) online VPN all you need to do is create your account, download a piece of software or an app to each device and connect to it. Most of these will let you 'pick a country' that you want to pretend you're in.

With my style of setup you need to have a server in your house that's permanently on and install VPN server software on it so that you can connect all of your other devices to it. Your other devices will still all need the client software installed on them.

Now, in my case, my firewall supports WireGuard and OpenVPN (both credible trusted OpenSource software) so I have this enabled directly on the firewall because it's always on anyway and I don't have to buy another computer just to run the VPN server. However, you can do this with an inexpensive RaspberryPi and some free software. Lots of 'step by step' tutorials online so you can do this even without any previous experience of RaspberryPi or coding or anything else. Just follow the steps and you'll be up and running.

Still with me? Congratulations, you've won a teddy bear.

Now....

Just to really confuse matters.....

I'm in the process of setting up Tailscale which completely contradicts most of what I've just said.

Free, credible, online, doesn't need you to setup a VPN server and connects devices differently.

One of the problems with traditional VPNs is that they are a 'tunnel' through which all of your traffic goes. Again, perhaps over simplifying, but this usually creates a bottleneck which results in a slower connection.

Tailscale is based on the Wireguard protocol (very highly respected) and connects devices together in a sort of mesh (known as a tailnet) rather than through a single central point (gateway).

If you're interested this describes it in a bit more detail.

It does need you to use one of those Identity logins which I don't like, but thankfully google email is free so I just created a new account just for tailscale.

The rest of the setup is really easy, doesn't require you to type lines of code into a terminal window and it's very worthy of consideration.

--------------------------------------

TLDR? The summary:

Always use VPN if connected to an unfamiliar or public WiFi (or wired) network.

If you really want to be able to pretend you're in a different country, or don't want to have to install any server then go for a reputable paid online VPN service. I would personally avoid the free online services like the plague as I don't trust them.

If you don't care about pretending you're somewhere different (but you can pretend to be in the UK when you're not) then a free OpenSource VPN such as OpenVPN would be a good option. It will need an 'always on' computer at home but you could do this with a RaspberryPi (one off cost of about £40) and half an hour following a YouTube video (actually really easy to do - don't be put off by the perceived geekery)

If you want something in between, that's easy to setup, free and secure then consider Tailscale - but be prepared to do a bit of learning on how to configure it properly so that it will do what you want it to do.

 

[sparkplug]

Hmm...

I should probably add that all of the 'short' version of VPNs above doesn't really apply to cellular data.

If you're using 3/4/5G on your phone (or tablet) then you don't need a VPN for security (you might still want one to pretend you're in the Netherlands or whatever)

Why bother mentioning this? Well, because if you're in a cafe with your laptop and want to (for example) email someone a file that's on your laptop then you can simply connect your laptop to your phone's hotspot and use the cellular connection perfectly safely without using the cafe WiFi or setting up VPN servers or subscribing to free (don't do it!) or paid online services...

For a lot of people this is actually all they need.

Alternatively you can also buy 'personal hotspot' devices (aka MiFi) so, for example, if you and the family went to France on holiday you could buy a local SIM, pop it in the MiFi device and you could all share that connection on all your devices. Obviously this would work just as well in the UK as a way to connect multiple devices to a single, secure, portable internet connection - thus avoiding public WiFi and the need for VPN.

Sheesh. I told you it was a complex topic and I've skimmed over so much of it

Anyway, hope that's been vaguely helpful.

 

[SBD]

Though do bear in mind if you use a French SIM card, google will give you French results in French by default because it assumes that’s what you want.

Not a problem per se, but worth knowing

Also you’ll need a vpn to convince the BBC to let you watch telly, should you wish to send your hollybobs so doing.

 

[Toshack10]

@sparkplug Do you do house-calls?

 

[sparkplug]

@sparkplug Do you do house-calls?

I used to have a t-shirt that read "no, I won't fix your computer"

I have done a few for friends and the like, I've even set up an LTE router for a fellow Tosser. Hmm.. and set up 'shed' WiFi for Grizz, and...

So the answer is 'no', unless it's 'yes'.

Favours, yes - sometimes. For money, no - never.

Another clear and concise and non-contradictory answer from me

 

[sparkplug]

Though do bear in mind if you use a French SIM card, google will give you French results in French by default because it assumes that’s what you want.

...unless you VPN in to your UK network in which case it will be in English...

 

[Mr Derek]

Many thanks for such a detailed answer Sparkplug. I saw the teddy from a distance but I may have been using the wrong end of the telescope

If I am correct I should use a VPN when accessing public wifi and a paid one would be better. As I only ever use the iphone or ipad, but not the laptop, when away, I should the vpn one on both. If hotel wifi is slow I hotspot from my phone and don't need to use vpn then, but if hotel wifi is ok, use the vpn. I am using hotel wifi as an example of where I might need to access the interweb (for research about where to eat, of course), but it is just as likely to be the public wifi inside a test match cricket ground.

Will any paid vpn do or are some better than others? I am not away from home wifi much. No more than 1 month per year, usually in UK but sometimes abroad. India, for my last trip and Norway then South Africa for the next two. Does which country one pretends to be in matter? Should it be English speaking for preference?

Sorry to be a pain, but you are making it understandable to the extent by which I can understand tech.

 

[sparkplug]

Many thanks for such a detailed answer Sparkplug. I saw the teddy from a distance but I may have been using the wrong end of the telescope

@Mr Derek - I'm pleased and surprised in equal measure that people are finding this useful. I'm always happy to share my knowledge and experience for what it's worth!

If I am correct I should use a VPN when accessing public wifi and a paid one would be better.

Correct

Although.... (here comes today's contradiction )

A huge number (the majority) of websites these days use HTTPS which encrypt data anyway. A lot of people argue (correctly in many respects) that a VPN is pointless if you're only visiting secure sites. So if your browser shows the padlock icon or whatever indicator it uses to show a secure site then don't stress too much about the VPN (yeah, yeah, I know I told you to always use them and now I'm saying not to... I did say it was a complex topic)

Why do I always use it on public networks then? Because I have shares in tin foil and millinery to some extent but mainly because of Man in the Middle attacks (MITM). What's one of those when it's at home? The short version is:

• Hotel WiFi details are "Ibis-Guests" pass="IbisWalsall2020" (they like using the year for some reason and all it does is upset me that it's been 5 years since they changed it...)
• Evil bod sets up a router that broadcasts the same network name with the same password.
• Your devices connect to the strongest signal, which is the one from evil bod because he's sitting right next to you.
• Evil bod's device looks at all the traffic from your device and passes it back out to the real internet after having had a good read of your passwords etc. You don't even know it's happening until...

A VPN mitigates this to some extent because it will tunnel through to your VPN server without evil bod being able to read your stuff.

As I only ever use the iphone or ipad, but not the laptop, when away, I should the vpn one on both.

Yes, assuming you are connecting to the WiFi, no need if on 3/4/5G. Might as well install it on the laptop 'just in case' - VPN clients are tiny files that do nothing unless you turn them on.

If hotel wifi is slow I hotspot from my phone and don't need to use vpn then, but if hotel wifi is ok, use the vpn. I am using hotel wifi as an example of where I might need to access the interweb (for research about where to eat, of course), but it is just as likely to be the public wifi inside a test match cricket ground.

All correct.

Will any paid vpn do or are some better than others? I am not away from home wifi much. No more than 1 month per year, usually in UK but sometimes abroad. India, for my last trip and Norway then South Africa for the next two. Does which country one pretends to be in matter? Should it be English speaking for preference?

OK, so this is the part where my personal knowledge runs a bit thin as I've never used any paid online VPN services. There was a good video I saw about this but I couldn't find it quickly. I'll keep looking and will post it if I can find it.

I'm also hesitant to recommend paying for a VPN for 'security' because, as stated earlier, you don't really need it for traffic to secure (https://) websites.

It's zero cost to me, and an added layer of protection - so it makes sense.

Paid services do have their place I suppose, but it's quite limited in my opinion (others are available!) The one thing they do very well is to pretend to be in a country of your choosing when you're not really there. Other than that I don't really see what they do that you can't do easily for free.

Sorry to be a pain, but you are making it understandable to the extent by which I can understand tech.

You're not being a pain at all. Glad it makes sense. It doesn't always to me