How secure is my nonencrypted Admin2's Documents directory?

[Zy]

WinXP (SP3) Media Center; NTFS; standalone computer

I'm concerned that some sort of internet malware could switch off my
system's standard WinXp firewall and then a badguy could steal various
sensitive personal info of mine.

I've never encrypted any files because I read that their backups are useless
for recovery purposes; in case the OS that created them crashes so badly
that a clean reinstallation is required. If that happens, then the encrypted
backup files become inaccessable to the reinstalled OS.

So instead I only right-clicked on the directory Admin2's Documents >
Sharing tab > and checked 'Make this folder private'

Is it possible for an internet hacker who is sophisticated enough switch off
my WinXp firewall to copy the contents of the directory described above and
somehow open its files?

 

[pjp]

WinXP (SP3) Media Center; NTFS; standalone computer

I'm concerned that some sort of internet malware could switch off my
system's standard WinXp firewall and then a badguy could steal various
sensitive personal info of mine.

I've never encrypted any files because I read that their backups are
useless for recovery purposes; in case the OS that created them crashes so
badly that a clean reinstallation is required. If that happens, then the
encrypted backup files become inaccessable to the reinstalled OS.

So instead I only right-clicked on the directory Admin2's Documents >
Sharing tab > and checked 'Make this folder private'

Is it possible for an internet hacker who is sophisticated enough switch
off my WinXp firewall to copy the contents of the directory described
above and somehow open its files?

No one can truthfully say to you 'That's impossible", history has always
shown that's seldom the case.

That said, it's up to you what measures you go to to protect what you want
to keep private. Yes, you can become a tech guru of some sort and build more
and more of a brick wall but you have to ask yourself is it worth it for
what someone might glean if it's breached. You know before you start that
you can add as many software layers as you want to and there's still no
guarantee so ...

If it's that important to you than use a thumbdrive or external hard disk
and keep what's important SOLELY on them insuring everything else gets
deleted from the hard disk, e.g. passwords, history or whatever your
specific paranoia is. Then so what if someone hacks into pc, so long as you
realize it and clean it up before reattaching "memory device" ...

 

[Paul in Houston TX]

WinXP (SP3) Media Center; NTFS; standalone computer

I'm concerned that some sort of internet malware could switch off my
system's standard WinXp firewall and then a badguy could steal various
sensitive personal info of mine.

I've never encrypted any files because I read that their backups are useless
for recovery purposes; in case the OS that created them crashes so badly
that a clean reinstallation is required. If that happens, then the encrypted
backup files become inaccessable to the reinstalled OS.

So instead I only right-clicked on the directory Admin2's Documents >
Sharing tab > and checked 'Make this folder private'

Is it possible for an internet hacker who is sophisticated enough switch off
my WinXp firewall to copy the contents of the directory described above and
somehow open its files?

Do you have a static ip address?
Do you store national security data on your online computer
or use your computer to commit crimes?
Not much else is worth someone's effort at hacking your comp.

Get yourself a usb drive or hard drive that has security software
on the drive itself, not on your computer.
Unplug it when not in use.
Be aware that usb drives are only good for about 3000 writes.
I would never store sensitive data on an online computer.
And certainly not with any Windows o/s.

 

[Zy]

Do you have a static ip address?
Do you store national security data on your online computer
or use your computer to commit crimes?
Not much else is worth someone's effort at hacking your comp.

Get yourself a usb drive or hard drive that has security software
on the drive itself, not on your computer.
Unplug it when not in use.
Be aware that usb drives are only good for about 3000 writes.
I would never store sensitive data on an online computer.
And certainly not with any Windows o/s.

I have internet service from my cable TV provider, so I presume that I must
have a static IP address in order for there to be a continuous connection.

Earlier this year something called 'Win32 malware gen' infected my system
and switched off the standard WinXp firewall. If the system hadn't slowed to
crawl I would never have suspected that an intrusion had ever occurred. So
evidently the hackers are not just intruding on the systems of governments
and corporations. Individuals' systems are not only easier to attack;
individuals generally don't have the financial resources to conduct a
private investigation if something is stolen, namely financial data, social
security number, etc.

I keep various web site passwords stored in a file, which I must refer to
frequently because I can't memorize them all. I also have various account
numbers in (3) banks and online banking passwords too. I refer to these
files frequently enough that plugging/unplugging or switching on/off my
external HDD would cause a hardware degradation.

Hmmm... I just remembered that a USB connection can be softly disconnected
via WinXP. If I disconnect the USB that way without switching off the power
to the external HDD, can a hacker command my WinXP to remake all USB
connections?

I've never before heard that USB external HDDs are good for only about 3000
writes. So I just did an exhaustive search via several different search
engines for the key words 'USB external hard drives 3000 writes', which
turned up absolutely nothing. So how do you know that to be true?

 

[Zy]

Earlier this year something called 'Win32 malware gen' infected my system
and switched off the standard WinXp firewall. If the system hadn't slowed
to crawl I would never have suspected that an intrusion had ever occurred.
So evidently the hackers are not just intruding on the systems of
governments and corporations. Individuals' systems are not only easier to
attack; individuals generally don't have the financial resources to
conduct a private investigation if something is stolen, namely financial
data, social security number, etc.

The point I was trying to make here is that it's far less risky for a badguy
to break into an individual's system and steal sensitive info from there
than from an organization's system.

 

[Paul]

I have internet service from my cable TV provider, so I presume that I must
have a static IP address in order for there to be a continuous connection.

Earlier this year something called 'Win32 malware gen' infected my system
and switched off the standard WinXp firewall. If the system hadn't slowed to
crawl I would never have suspected that an intrusion had ever occurred. So
evidently the hackers are not just intruding on the systems of governments
and corporations. Individuals' systems are not only easier to attack;
individuals generally don't have the financial resources to conduct a
private investigation if something is stolen, namely financial data, social
security number, etc.

I keep various web site passwords stored in a file, which I must refer to
frequently because I can't memorize them all. I also have various account
numbers in (3) banks and online banking passwords too. I refer to these
files frequently enough that plugging/unplugging or switching on/off my
external HDD would cause a hardware degradation.

Hmmm... I just remembered that a USB connection can be softly disconnected
via WinXP. If I disconnect the USB that way without switching off the power
to the external HDD, can a hacker command my WinXP to remake all USB
connections?

I've never before heard that USB external HDDs are good for only about 3000
writes. So I just did an exhaustive search via several different search
engines for the key words 'USB external hard drives 3000 writes', which
turned up absolutely nothing. So how do you know that to be true?

Hard drives, with rotating media, don't have a "write limit". If you had an
external hard drive, with rotating platters, you can use that as much as you want.
The write operation, doesn't hurt them.

Hard drives can be worn out, by excessive seeking. For example, a commodity drive,
experiencing random seeks (i.e. a pounding), can last around a year or so, before
they wear out. That would be the kind of thing experienced by a web server perhaps.

Your usage scenario is much more benign, and the head will not be moving back and
forth continuously 24/7.

Hard drives also have a "start/stop" cycle limit, which is guaranteed to be
50000 cycles minimum. I've even seen drives with a 300,000 cycle limit, so
the drive can be plugged and unplugged so many times, the connector on the
external drive will wear out, before the drive does. Start/stop means
"spin up and spin down".

*******

A second kind of storage media, is based on NAND Flash chips. The basic MLC chip
has a 3000-5000 cycle *write* limit, while reading is unlimited. Flash chips
are used in USB thumb drives. They are also used in SSD drives. SSD drives
use more Flash chips in parallel, to achieve higher transfer rates.

To make the 3000 cycle count less of an issue, the drives use what is called
"wear leveling", which smooths out the usage of the Flash memory blocks so
they all wear out at about the same time. The addressing inside the Flash
drive has one level of indirection, such that if you ask for "Sector 0", the
drive might be storing that at sector 12345. The drive processor can choose
a different place to store Sector 0, the next time Sector 0 is written. By being
able to choose where to store things, the wear can be "leveled" across the Flash
chip storage areas.

If I had a 20GB flash based device, with a 3000 cycle limit, it means I can
do 20*3000 GB worth of writes, before it wears out. If I was writing 20GB of
random files per day, it means the drive would wear out in 3000 days. So attempts
to write to the same location, over and over again, cause the drive to move to a
new spare sector to do the storage. And instead of the limit being one sector
getting worn out, the sectors are used about equally, due to the one step of
indirection between requested sector and the actual sector used to store the
data.

Wear leveling works best, if you don't fill the drive up.

*******

Generally speaking, if you used two external storage devices, and "synced"
them once in a while, that should be sufficient to protect you against
failure scenarios. You only use one device at a time, and keep the second
one as a backup, and sync them any time you think it is necessary. Then unplug
the second one and lock it up again.

Paul

 

[Paul in Houston TX]

I have internet service from my cable TV provider, so I presume that I must
have a static IP address in order for there to be a continuous connection.

Earlier this year something called 'Win32 malware gen' infected my system
and switched off the standard WinXp firewall. If the system hadn't slowed to
crawl I would never have suspected that an intrusion had ever occurred. So
evidently the hackers are not just intruding on the systems of governments
and corporations. Individuals' systems are not only easier to attack;
individuals generally don't have the financial resources to conduct a
private investigation if something is stolen, namely financial data, social
security number, etc.

I keep various web site passwords stored in a file, which I must refer to
frequently because I can't memorize them all. I also have various account
numbers in (3) banks and online banking passwords too. I refer to these
files frequently enough that plugging/unplugging or switching on/off my
external HDD would cause a hardware degradation.

Hmmm... I just remembered that a USB connection can be softly disconnected
via WinXP. If I disconnect the USB that way without switching off the power
to the external HDD, can a hacker command my WinXP to remake all USB
connections?

I've never before heard that USB external HDDs are good for only about 3000
writes. So I just did an exhaustive search via several different search
engines for the key words 'USB external hard drives 3000 writes', which
turned up absolutely nothing. So how do you know that to be true?

Your ip address is dynamic and is renewed periodically,
either through time, router reboot, or release/renew ip address.
Windows firewall is ok but basic. There are better ones out there:
http://personal-firewall-software-review.toptenreviews.com/
Go here to run an online security check:
http://security.symantec.com/sscv6/home.asp?langid=ie&venid=sym&plfid=23&pkj=VLOCHFLHVXMQAYKGEWA

This computer is behind a dsl router w/hardware firewall,
an additional router with dhcp and hardware firewall,
and a non-windows software firewall. My firewall allows me to
see what is going on and instantly stop traffic if things
don't look right.
The chinese are always attempting to hack into everyone's system.
My first router gets hit hundreds of time per day by china.
It is not directed, just a random scrolling thing.

Sorry for the confusion on the usb writes. That was for flash
memory and not hdd. Many people store vital data on usb sticks
not knowing that there is a write limit.
If you store on external hdd's, be sure to refresh every
few weeks. Magnetic media is prone to losing data.

A hacker dedicated to getting into your system will be able
to take control of your computer. They can turn usb on at will,
or destroy your computer.

Most people have anti malware and virus scanners running.
Most people click on every little popup and ad that appears
on their screen. I do not do either of those.
However, I do run malware bytes and avira every month.
Avira is on a stand alone CD and bypasses the o/s.
Its free.
I also run CC cleaner after each browsing session.
Beware of "flash cookies". Few people know of their existence.

I do not store passwords on my computer.
They are written by hand on paper.

My recommendations:
1) get a good firewall
2) get an additional router
3) do not use IE, get some other browser
4) do not use MS mail of any sort, Live, Outlook, hotmail, etc.
5) do not allow java script or html in email. Text only!
6) be very careful what you click on and be ready
to ctl-alt-del out of any popup window that won't let you
close it by normal means via the little X on the upper right.

 

[John Wunderlich]

I've never encrypted any files because I read that their backups
are useless for recovery purposes; in case the OS that created
them crashes so badly that a clean reinstallation is required. If
that happens, then the encrypted backup files become inaccessable
to the reinstalled OS.

This is not true.

If you use Microsoft's EFS encryption, backups of the encrypted files
are recoverable given that you have also backed up your encryption
key/certificate (a step skipped by virtually all EFS users). See the
following Microsoft article:

"Best practices for the Encrypting File System"
< http://support.microsoft.com/kb/223316 >

However, any process that runs under your login (including any
malware) will have free access to these files anytime that you are
logged on. This also applies to someone that sits down to your
machine should you walk away from it with your session active.

My approach is to use the freeware "Truecrypt"
<http://www.truecrypt.org>
and create encrypted container files. Backups of these container
files can be accessed on any machine so long as you know the
passphrase that they were encrypted to. With the correct passphrase,
they mount as another disk drive and when dismounted cannot be
accessed. Since they're only accessible when mounted with the
passphrase, mounting them only when necessary cuts down on the chance
of data being compromised.

HTH,
John

 

[Zy]

Hard drives, with rotating media, don't have a "write limit". If you had
an
external hard drive, with rotating platters, you can use that as much as
you want.
The write operation, doesn't hurt them.

Hard drives can be worn out, by excessive seeking. For example, a
commodity drive,
experiencing random seeks (i.e. a pounding), can last around a year or so,
before
they wear out. That would be the kind of thing experienced by a web server
perhaps.

Your usage scenario is much more benign, and the head will not be moving
back and
forth continuously 24/7.

Hard drives also have a "start/stop" cycle limit, which is guaranteed to
be
50000 cycles minimum. I've even seen drives with a 300,000 cycle limit, so
the drive can be plugged and unplugged so many times, the connector on the
external drive will wear out, before the drive does. Start/stop means
"spin up and spin down".

*******

A second kind of storage media, is based on NAND Flash chips. The basic
MLC chip
has a 3000-5000 cycle *write* limit, while reading is unlimited. Flash
chips
are used in USB thumb drives. They are also used in SSD drives. SSD drives
use more Flash chips in parallel, to achieve higher transfer rates.

To make the 3000 cycle count less of an issue, the drives use what is
called
"wear leveling", which smooths out the usage of the Flash memory blocks so
they all wear out at about the same time. The addressing inside the Flash
drive has one level of indirection, such that if you ask for "Sector 0",
the
drive might be storing that at sector 12345. The drive processor can
choose
a different place to store Sector 0, the next time Sector 0 is written. By
being
able to choose where to store things, the wear can be "leveled" across the
Flash
chip storage areas.

If I had a 20GB flash based device, with a 3000 cycle limit, it means I
can
do 20*3000 GB worth of writes, before it wears out. If I was writing 20GB
of
random files per day, it means the drive would wear out in 3000 days. So
attempts
to write to the same location, over and over again, cause the drive to
move to a
new spare sector to do the storage. And instead of the limit being one
sector
getting worn out, the sectors are used about equally, due to the one step
of
indirection between requested sector and the actual sector used to store
the
data.

Wear leveling works best, if you don't fill the drive up.

*******

Generally speaking, if you used two external storage devices, and "synced"
them once in a while, that should be sufficient to protect you against
failure scenarios. You only use one device at a time, and keep the second
one as a backup, and sync them any time you think it is necessary. Then
unplug
the second one and lock it up again.

Paul

Sounds like the flash drives are much more prone to fragmentation. I rarely
use them unless I'm travelling from my home office and taking data with me
to use somewhere else.

Back in the day of backup tapes I used to use multiple tapes, so I'm
familiar with the benefit of not putting all the eggs in one basket. That
should've occurred to me about using a 2nd backup HDD. Why didn't I think of
that? I must obtain a 2nd one. Thanks.

 

[Zy]

Your ip address is dynamic and is renewed periodically,
either through time, router reboot, or release/renew ip address.
Windows firewall is ok but basic. There are better ones out there:
http://personal-firewall-software-review.toptenreviews.com/
Go here to run an online security check:
http://security.symantec.com/sscv6/home.asp?langid=ie&venid=sym&plfid=23&pkj=VLOCHFLHVXMQAYKGEWA

This computer is behind a dsl router w/hardware firewall,
an additional router with dhcp and hardware firewall,
and a non-windows software firewall. My firewall allows me to
see what is going on and instantly stop traffic if things
don't look right.
The chinese are always attempting to hack into everyone's system.
My first router gets hit hundreds of time per day by china.
It is not directed, just a random scrolling thing.

Sorry for the confusion on the usb writes. That was for flash
memory and not hdd. Many people store vital data on usb sticks
not knowing that there is a write limit.
If you store on external hdd's, be sure to refresh every
few weeks. Magnetic media is prone to losing data.

A hacker dedicated to getting into your system will be able
to take control of your computer. They can turn usb on at will,
or destroy your computer.

Most people have anti malware and virus scanners running.
Most people click on every little popup and ad that appears
on their screen. I do not do either of those.
However, I do run malware bytes and avira every month.
Avira is on a stand alone CD and bypasses the o/s.
Its free.
I also run CC cleaner after each browsing session.
Beware of "flash cookies". Few people know of their existence.

I do not store passwords on my computer.
They are written by hand on paper.

My recommendations:
1) get a good firewall
2) get an additional router
3) do not use IE, get some other browser
4) do not use MS mail of any sort, Live, Outlook, hotmail, etc.
5) do not allow java script or html in email. Text only!
6) be very careful what you click on and be ready
to ctl-alt-del out of any popup window that won't let you
close it by normal means via the little X on the upper right.

If you store on external hdd's, be sure to refresh every
few weeks. Magnetic media is prone to losing data.

Didn't know that. Hmmm... maybe that explains why my previous external
backup HDD mysteriously became inaccessable after it was unused for a month
or so. Since it sat on the floor I had assumed that it must've gotten kicked
or bumped. I still have it. Maybe it can be reformatted, and it can become
my future 2nd backup HDD (to be used in rotation).

It's been years since I configured my router. Either I had forgotten, or it
never occurred to me that it might have a hardware firewall in it. So
yesterday I checked and yes there's one in it; an SPI type, and its still
enabled too. But alas, I just came across this article about hardware
firewalls being easily hacked via web page javascript
http://www.theregister.co.uk/2010/01/06/web_based_firewall_attack/
So I'll definitely be disabling javascript except at several trusted
websites that I use quite often. So thanks for the heads-up about
javascript.

Our current router is wireless, but my computer is wired to it. I still have
an old wire-only DSL router in the closet; circa 2002. It has no firewall in
it. Does it qualify for your recommended 2nd router?

I never heard that before about ctl-alt-del being effective against pop-ups.
I got a web page pop-up the other day and tried that, which merely opened
Task Manager, as expected. Are you implying that I should end process on the
browser if the popup doesn't go away?

Before I purchase a 3rd party firewall I want to try the free or shareware
version first. So far I've had TERRIBLE experiences with the current
no-price versions of both ZoneAlarm and Comodo. I was lucky to be able to
uninstall them via Last Known Good boots, because they each caused my system
to freeze. In effect they behaved worse than malware. At least with Win32
malware gen I was just barely able to get my Avast AV to work (albeit verrry
slowly) good enough to find and fix the problem. Conversely those two
firewall utilities each disabled my mouse and keyboard. The computer's power
button wouldn't even work! I actually had to pull the plug... for each of
those utilities.

 

[Paul in Houston TX]

Didn't know that. Hmmm... maybe that explains why my previous external
backup HDD mysteriously became inaccessable after it was unused for a month
or so. Since it sat on the floor I had assumed that it must've gotten kicked
or bumped. I still have it. Maybe it can be reformatted, and it can become
my future 2nd backup HDD (to be used in rotation).

It's been years since I configured my router. Either I had forgotten, or it
never occurred to me that it might have a hardware firewall in it. So
yesterday I checked and yes there's one in it; an SPI type, and its still
enabled too. But alas, I just came across this article about hardware
firewalls being easily hacked via web page javascript
http://www.theregister.co.uk/2010/01/06/web_based_firewall_attack/
So I'll definitely be disabling javascript except at several trusted
websites that I use quite often. So thanks for the heads-up about
javascript.

Our current router is wireless, but my computer is wired to it. I still have
an old wire-only DSL router in the closet; circa 2002. It has no firewall in
it. Does it qualify for your recommended 2nd router?

I never heard that before about ctl-alt-del being effective against pop-ups.
I got a web page pop-up the other day and tried that, which merely opened
Task Manager, as expected. Are you implying that I should end process on the
browser if the popup doesn't go away?

Before I purchase a 3rd party firewall I want to try the free or shareware
version first. So far I've had TERRIBLE experiences with the current
no-price versions of both ZoneAlarm and Comodo. I was lucky to be able to
uninstall them via Last Known Good boots, because they each caused my system
to freeze. In effect they behaved worse than malware. At least with Win32
malware gen I was just barely able to get my Avast AV to work (albeit verrry
slowly) good enough to find and fix the problem. Conversely those two
firewall utilities each disabled my mouse and keyboard. The computer's power
button wouldn't even work! I actually had to pull the plug... for each of
those utilities.

Much depends on a person's level of computer knowledge.
The DSL router sounds like a DSL / modem / router.
I don't know if that would function as a router and
have a hard ware fire wall or not.
My second router is a router, not a modem.
My software firewall is the freeware version of Zonealarm
8.0.298. It works great. If I see its network light flashing when
it should not be, I can block the network connection with it.
If you turn off js for everything, then web browsing will not
work very well. Just turn it off for email.
The popups... I have heard that Ad Block Plus works.
I know nothing about it though.

I know of the supposed java / hardware hole and am not
worried about it. Too many things have to be enabled that
are not normally enabled for it to work.
The only secure way to compute is to never connect your computer
to a network and never insert any media.