Result of no-protection XP challenge

When I installed Windows XP on a virtual machine on my laptop some time ago, it wasn't just because I want to experience nostalgia from using old OS'es, it's also to challenge my resilience on security and protection.

How does this challenge work? It's easy. I will never install any anti-malware software on my computer for some weeks or so. Additionally, since my copy of Windows is not genuine at all, it won't receive important security updates from Microsoft, so that's another layer of protection removed. Then I would do whatever I always do online. Trolling, researching, reading the news, maybe even download some pr0ns for...safekeeping. So there. I'll go out in the wild without anything watching your back for a few weeks, then I'd download Trend Micro House Call to scan for malware that came through.

Why did I use XP? Because with all the Windows versions I've used, XP was the most vulnerable, wherein I had way too many run ins with malware in the past. I believe XP is the most vulnerable operating system out there when it comes to malware. It's like a Thai prostitute - ugly and full of viruses. The only advantage XP has over its successors is that it uses way less resources than Vista and 7. So there.

Of course, I took every security precaution available. To safeguard myself against keylogging, I used LastPass to encrypt my logins and on-screen keyboards while inputting usernames and passwords. I even used Tor so that those tracking websites won't be able to remotely view my geolocation.

Results

House Call just finished scanning my computer for malware, and it found something. Great thing is, it's alone, and it's just some regular adware that I probably got from browsing pornographic websites (you know those popups of Adultfriendfinder and other sites? They give you that). The file detected was cmdow.exe, and its corresponding threat was, according to Trend Micro, ADWARE .0737EEDD. According to the data in the link, this spyware does nothing but take my browsing history and send it somewhere for marketing purposes. Well they're in for a big surprise then.

Also, cmdow.exe, according to further Googling, is not originally a fatal binary file, but a tool designed to modify commandline windows, such as not allowing the user to close the window (because some users freak out at the sight of an ugly DOS-prompt and close it immediately, hampering some installation procedures in the process). However, in this case, I don't recall having to use this, and I don't really need it, so I just removed it.

I also managed to install and run Malwarebyte's Anti-Malware (an excellent software, I might add), which managed to snag a trojan executable and a dangerous registry value. Also, it detected three potentially dangerous security settings, which was the Windows Security Center being turned off, but I intentionally set it that way for this challenge.

After a quick system reboot, I decided to run a scan again, just to be safe. I won't be posting any more details and its results, because that would be a waste of time.

Conclusion

• It is possible to be malware-free without some sort of security software


• Windows XP is very vulnerable to attacks


• Virtual machines are probably the best way to protect yourself against malware, by using a fake OS as a shield

Virtualed XP

Recently I have successfully finished the task of virtualizing Windows XP under my Windows 7 OS in my Thinkpad X60s. Since I'm fond of installing XP stuff for the sake of nostalgia (after a failed attempt to make Ubuntu look like XP), I knew adding Windows XP to my boot configuration would be unnecessary, so I turned to virtual machines.

What are virtual machines?

Virtual machines are non-physical computers running instructions inside a host computer, similar to a real, physical machine. In layman terms, it's like Inception: a computer within a computer. This is very useful for testing compatibility issues, like testing if your Windows 7 program could work on earlier versions of Windows without using another computer or installing the OS on a separate partition. You can go as many virtual computers as you like, so long as your hardware capabilities can permit. You can have like a computer within a computer within a computer within a computer, and so on.

Disadvantages of virtual machines

Virtual machines will always grab a chunk of the host OS's resources. This means your host OS (the real computer) should have some spare resources to give to the guest OS. Processing power isn't really that much of a requirement, unless you're installing a modern operating system like Vista, 7, or OSX. But memory is a must, and for virtual PCs, 2GBs of RAM or more is recommended.

Also, it can't run as fast as a real operating system can. But it can do whatever a real OS could do.

Cool stuff about virtual machines

One of the most important traits a virtual machine possesses, is that, it is not directly linked to your host OS. It only runs inside the host OS, but it rarely directly communicates or shares files with the host OS unless you set it to. This means that whatever happens in your virtual machine stays in your virtual machine. This is great, because if your guest OS catches a virus, it stays there and it will never infect the host OS unless the guest has privileges to write to a shared folder on the host OS.

You can use the guest OS as a sandbox, go to sites you never dare to visit lest your computer gets messed up, and see what happens. If the guest OS gets nuked by malware and whatnot, don't panic. You can always just remove it and install another one, provided you don't have much sensitive data on your guest OS.

On a side note, virtual machines could be excellent for trolling, as it adds an extra layer of anonymity and protection. Combine that with a good relaying service, some proxies, and good privacy ethics, and you're good to go as a faceless person on the Internet, e.g. a complete Anon. Just don't troll too much, ok?

What you'll need for a virtual machine

- Some spare RAM (256MB+ recommended)
- At least 8GB of HDD space
- A (hopefully genuine and legal) copy of your preferred guest OS
- Time

I used some Windows XP disc I found lurking in my disc archives, it was marked as "Service Pack 3" for the lulz, as I recall I have bought it sometime around 2006. Now remember that the SP3 for Windows XP didn't come until recently in 2009 or so. But this copy was good - uxtheme.dll was already patched, so it had custom themes of its own, it included a basic suite of Microsoft Office 2003, and 2005 versions of Adobe Reader, Mozilla Firefox and Winrar. At least there aren't any bloatware.

My quick experience of deleting my Friendster account

Right now, those crazy kids are all about Facebook. Being a member of Friendster for about six years, and a member of Facebook for five years, I've decided I don't really need my Friendster account anymore, and the information stored there could impact my identity and the future. Not to mention that if I get to become a target of a raid, trolls would have more targets for them to mess up, so there.

This is also an opportunity for me to say that social networking sites nowadays are so desperate and have completely lost the sense of originality. Just take a look at this screenshot I took when I was on Friendster's front page:

Go to Facebook, login, and compare the Facebook front page to Friendster's. Familiar, right? I'd like to let you know that about three years ago Friendster never looked like this. It looked a lot more like MySpace.

So in conclusion, dying social networking sites are keeping themselves alive by stealing ideas from popular sites of their time. I can't argue with the logic, as 90% of people using social networking sites don't mind the difference anyway.

Although I have to give Friendster the credit of allowing me to cancel (or delete) my account quickly. I was just given one form and was not bombarded with regret with the "Your friends X, Y, and Z are going to miss you!" page in Facebook. Also, I don't have to freeze my account for 14 days, and I'm pretty sure they actually delete my files and information from their servers.

So goodbye, Friendster. Thanks for all the good times, and nightmarish memories.

I'm going to delete my Multiply next because it's another useless social networking site that could hurt me in the near future.

Why people should f*cking wake up and fix their Facebook profiles

Right now, Facebook is in a roll. I actually signed up there when some of my machinima-directing friends made a group there for they find the site cool. I didn't, and I left my account rotting there for four years. Then the Facebook asteroid suddenly crash landed in my country and put Friendster into extinction, and quickly everybody had Facebook accounts which were indefinitely wasted on playing one-track games for one-track minds.

Right now I don't use Facebook for leisure. I hate it because of all the Farmville requests, force-tagging me in photos, and people ditching proper IM platforms because they believe that the shitty embedded Java chat is better than a regular IM client. If I were to use Facebook, I'd use it to track someone, organize myself with other people, stalk someone, and arrange events. I think social organization is the only "productivity" you can get with Facebook. Too bad people missed that part because they were waiting for their sunflowers to grow in Farmville.

Oh, and about that stalking part, that's actually a very easy thing to do. I've been doing that even before I'm into Facebook. But it's not about ethical hacking and making your screen look like it's from the Matrix just to stalk someone. You just need some skills on human psychology.

Take advantage of a common Facebook tradition of accepting everybody who asks using a friend request. Create a fake profile, add a picture of a hot girl or a douchebag and load up all kinds of BS you could think of into that profile. Then start luring in the morons. Earn someone's trust, make him/her think you're his/her boyfriend/girlfriend, and invite him/her to meet at some public place. Then don't go there, build an excuse, and promise to meet up again. Repeat. That's just one of the many things you could do to destroy someone on Facebook. I could go into more damaging and dangerous techniques, but I wouldn't go into any more details for the safety of others.

That's all thanks to Facebook's shitty privacy settings, where, by default, your profile and all its useless information are visible in Facebook's growing public directory. Think of it as one big phonebook - everything you have written on Facebook that is set to public is accessible there - from seemingly harmless information like your name, your applications, your Farmville, to more serious ones like your complete address, your telephone/mobile numbers, etc.

I actually tried the trick of texting a complete stranger in Facebook - I used an old SIM card and jacked it in my PLDT WeRoam 3G Dongle, picked a random stranger in the Philippines, and I quickly found her mobile number. I texted random shit to that person using my computer, and she responds like a charm.

Are you afraid? Want to change your ways. I'm going to help you with that. Here's what you have to do:

1. Remove all sensitive information from your public profile. You can choose not to delete them, just set them to viewable by "Only Me".
2. Remove and unassociate unnecessary applications from your profile. Applications are always given full view of your information, and that's not good. Keep in mind that quizzes are separate applications, and I found them hard to remove from my profile. Right now I only have my useful desktop applications (TweetDeck, Pidgin, Miranda, Trillian, etc.)
3. Remove yourself from the Facebook public directory. This can be done by going to Privacy Settings > Applications... > Public Search. If you're under 18, the setting is turned off by default, however, it is wise to turn it completely off even if you're over 18.
4. Remove Instant Personalization. Instant Personalization is a feature used by partner websites that automatically updates your settings and profile there using your Facebook profile. This could save you some time, but it is potentially dangerous to your privacy. It is wise to turn them off, just go to Privacy Settings and you'll find it there.
5. Limit the amount of information accessible to your friends. It's not just your friends - it's also for the applications your friends use.

However, the best defense for your privacy on Facebook is, to not use Facebook at all. You can deactivate your account on Facebook, however, it's difficult to do so, as it takes quite a long time. Since I'm lazy and don't want to point you in a certain direction, I'm just gonna give you a "Let Me Google That For You" link.

Think Facebook is still safe? Here's the torrent that contains over 100 million Facebook profiles harvested by an efficient person named Ron Bowes. This isn't illegal in any way, because every user included in this database actually agreed to have their information displayed in public. It only takes a simple dataminer to automatically collect the data, because Facebook is not protecting public data and it makes them available to anyone for anyone to use in any way. Go, download the database, and look for your profile there. If you find it, change your privacy settings right away, if not, good job.