Evading Malware with Quad9

Evading malware can be difficult these days. The bad guys are very clever and surfing the Internet involves several complicated technologies. Software is rife with bugs and traps are ready and waiting for any slip-up you might make. I posted a detailed article on choosing the most secure web browser setup recently that you should have a look at, but today I’m going to talk about something much simpler and more fundamental: choosing your Domain Name Service, or DNS.

Brief Overview of Internet Routing

Whenever you type in a web address like “google.com” or “amazon.com”, you are giving your web browser a domain name. Domain names are easy for humans to remember, but the Internet actually routes traffic based on IP addresses. So the very first thing your web browser does is convert that domain name to an IP address using a Domain Name Service. Your DNS provider is usually just given to you by your Internet Service Provider (ISP) like Comcast, Spectrum, or Verizon. Though you can choose whatever service you want, most people never change the default.

Enter Quad9

A new DNS provider called Quad9 has been created by a consortium of concerned companies, including law enforcement, in an effort to stem the tide of malware and botnets. This non-profit organization was founded not only to enhance security but also to protect privacy. (There’s still a long way to go before it’s totally private, though). Quad9 will actively block your web browser, your apps, and even Internet-connected devices from talking to known-bad servers, using a list that is updated multiple times per day. This can save you from phishing sites, malvertising, and botnet control servers. It’s important to note that this service will not perform any other filtering. That is, it’s specifically avoiding censorship issues and focusing solely on evading malware.

Evading Malware using DNS

To use the Quad9 service, you just need to change a simple setting on your computer, and the Quad9 web site has two videos to help you do it (one for Mac, one for Windows). If you want to kick it up a notch, you can set your DNS service right on your home’s router to use (four 9’s, or “quad” 9). Most devices will defer to the router’s choice of DNS provider by default. But you can effectively change this setting for every device on your home network in one fell swoop.

Give Thanks and Donate

Thanksgiving is almost upon us here in the US. I felt it was a good opportunity to say thanks to some of the wonderful organizations out there working very hard to improve our security, protect our privacy, and defend our rights. If you believe in a cause but don’t have the time to get directly involved, then donating money to groups with the skills, time and talent to truly make a difference is an excellent way to go. You might even get break on your taxes, too. (Note that some companies have donation matching programs, as well – so you might ask your employer about matching your contribution.)

Many of these organizations will send you something for donating – a shirt, hat, sticker, magnet, etc. Display it proudly for others to see. Perhaps it will cause them to look it up or ask you about it, offering another opportunity to spread the word or spark some much-needed debate on these issues.

Electronic Frontier Foundation

If I was going to pick one organization that just does it all (and does it well), I would have to pick the Electronic Frontier Foundation. (This won’t come as a surprise to anyone who follows my podcast.) Staffed with top-notch technologists, lawyers and policy wonks, EFF is at the forefront of privacy, transparency, security, and free speech issues. They have been involved in hundreds of important legal cases, including an impressive string of legal victories. The EFF web site hosts some wonderful security guides, including tutorials and materials for people willing to teach others. They have created two of my most recommended browser plugins: HTTPS Everywhere and Privacy Badger. And that’s just the tip of the iceberg.

Saving Democracy, Fighting for Your Rights

Of course there are many other superb organizations that are fighting for your rights, holding governments and corporations accountable, and trying to improve our democratic institutions. Here are just a few that you might consider supporting:

You can find these and other great security and privacy links on my Resources page.

Browser Safety: Choose Your Weapon

Your web browser is your primary portal to the wild and woolly world wide web. For many people, the web browser effectively is the Internet. As such, it’s one of the most vulnerable areas of our attack surface (i.e., the sum of all the places where we might be susceptible to attack by digital bad guys). Therefore, it behooves us to choose the most formidable browser we can find, bolting on whatever extra ‘armor’ and ‘stealth’ technologies we can find.

How Do We Define a “Safe” Browser?

There are at least two primary aspects to ‘safety’ when it comes to web browsing: security and privacy. A secure browser will do whatever it can to prevent you from visiting bad web sites, warn you against entering sensitive information on insecure pages, identify sites that aren’t encrypted, and strictly enforce policies that prevent malvertising and other malicious web exploits.

However, while security is something that all browsers claim to seek, privacy is another matter entirely. Because much of the web is “free”, most web sites have turned to advertising for revenue. And unlike traditional newspaper and billboard ads from days of yore, web advertising is built on hordes and gobs of personal data. Companies like Google and Facebook collect intimate details on you in order to serve you highly targeted (and much more lucrative) ads. Data, as the say, is the new oil. In their lust for data, online advertisers have gone seriously overboard with their tracking technology, prompting many to use ad blockers. So a good web browser will help protect your privacy by severely limiting the ability of web sites and marketers to track you.

The Big Four

The four most popular browsers today are Chrome (60%), Internet Explorer/Edge (20%), Firefox (13%), and Safari (4%). It wasn’t long ago that Microsoft had a near monopoly on web browser use, but Google’s Chrome browser has come on strong and clearly holds the lead today. Internet Explorer and Edge are the default browsers on Windows PC’s and Safari is the default browser on Apple Macintosh computers. Firefox (which rose from the ashes of Netscape Navigator) is the only browser in the top four that is open source (meaning the source code is freely available for review). Firefox is made by the non-profit Mozilla Foundation, which is funded primarily by search royalties. Despite very different aesthetics, at the end of the day, all four of these browsers do basically the exact same things: they show you web pages. So how do you know which is safest?

Choose Your Weapon: Security

Let’s just get this out of the way now: it’s almost impossible to know which browser is the most secure. This is largely because all of these browsers are constantly rolling out new security-related features, fixing security-related bugs, and generally trying to claim the title of ‘most secure’. That’s a good thing – they’re competing to be the best, and so we all win. There are dedicated hacking contests to reveal bugs in browsers, but it’s hard to say whether the number of bugs found in these contests really reflect the security of the browser. How likely were bad guys to find these bugs? How severe are the bugs? What about the bugs they didn’t find? These hack-a-thons also don’t address factors like how quickly the browser maker fixes their bugs and whether the browser is smart enough to self-update (because if you don’t have the latest version, you don’t have the bug fixes). It’s really hard to compare the relative security of web browsers (see this article to understand what I mean).

However, if I had to pick a winner here, I’d probably have to choose Chrome. Google is doing some fantastic work in the realm of computer and web security. Furthermore, they’re using Chrome’s dominance to prod web sites to be more secure, as well. That said, I think Firefox and Safari are also fairly secure browsers. And you could argue that because Firefox is open-source, it can actually be audited by cybersecurity experts – unlike the other three major browsers. Ideally, this vetting leads to less bugs.

Choose Your Weapon: Privacy

Unlike security, there are significant and important differences between the four major browsers when it comes to privacy. And this (to me) is the real differentiating factor.

While Google has been a true leader in terms of security, they’re pretty much the worst in terms of privacy. They’re whole business model revolves around advertising (Google makes about 90% of its money from ads). And that leads to an enormous conflict of interest when it comes to protecting your personal data and web surfing habits. Apple has gone out of their way to basically be the anti-Google, making it a point of pride to collect as little data on their users as possible (and causing a collective freak-out by advertisers). But Firefox is also doing some great work in this area. In the coming months, Firefox will enable some wonderful anti-tracking technologies of their own.

So who’s the winner in terms of privacy? Today, I’d say it’s a toss-up between Firefox and Safari, with Chrome being dead last. Internet Explorer and Edge are somewhere in between, but with Microsoft’s recent penchant for collecting user data, I would put it closer to Chrome.

And the Winner Is…

Based on everything I’ve read, I personally choose Firefox as my main browser. No browser is 100% secure and it’s very hard for even the most erstwhile browser to completely protect your privacy. But I think Firefox, on balance, is the best of the bunch. Browsers are constantly adding new features, so I will have to revisit this periodically (and I will update this article accordingly).

That said, there is at least one reason to also have Chrome installed on your system. And we’ll talk about that below.

Beyond the Big Four

There are actually several other web browsers you might want to consider. This article covers some of them, but I’ll just mention three.

The fifth most popular browser is Opera, and many people enjoy using it. If you’re not satisfied with any on my list, you might give it a try. Opera is fast and works on both Mac and PC.

The Brave browser is an open-source browser built for privacy, with built-in ad blocking and tracking protection. However, in a move to try to acknowledge the need for ad-based revenue, it also has a mechanism to insert its own ads, which opens up a lot of issues. I would wait and see on this one.

Lastly, the Tor browser is all about privacy – in fact, it tries to achieve true anonymity (though that is extremely difficult in practice). It’s based on Firefox and builds in several kick-butt privacy tools that are too technical to sum up here. But if you really need to surf privately, you should give Tor a serious look.

Less Is More

Modern browsers all have the ability to add more functionality through plugins or add-ons. These extensions can both significantly raise and lower your level of security and privacy. So no discussion of browser security would be complete without discussing them. Let’s start with the plugins you should remove.

First and foremost, delete Adobe Flash. Flash was created years ago to enable all sorts of fun things – animations, video or audio, and online games. But Flash is horrendously buggy and mostly obsolete. So just remove it. (Note that the Chrome browser actually has Flash built-in and Google ensures that it’s up to date – so if you find a web site that requires Flash, you can use Chrome for that site… and then go back to Firefox!)

In the same vein, I would delete both Java and Silverlight plugins, if you have them. They’re buggy and mostly unnecessary.

Finally, go through all your browser plugins and just remove (or disable) any that you don’t need. Every one of those add-ons is a potential security or privacy risk.

If you later find that you do need any of these plugins, you can always just reinstall them… with the following major caveat…

DANGER! Beware Plugin Requests!

If you ever get a pop-up from a web site saying that you need some plugin in order to do something, never ever follow their link to install it!! This is an extremely common and effective way to install malware. When you see a pop-up like this, close it and then go directly to the site for this plugin and install from the source. A Google search should take you to the right place, if you don’t know where to go.

Plugins for Better Privacy and Security

The one plugin you should add to your browser to increase your security is a password manager like LastPass. Not only will a password manager help you to create strong and unique passwords for every web site, they will not be fooled by fake (“phishing”) web sites.

In terms of enhancing your privacy, Firefox and Safari already have a lot of built-in features to prevent tracking. However, there are a handful of add-ons I strongly recommend you install. It’s safe to add them all, they play nicely with each other.

  • uBlock Origin. This is a very good ad blocker, which protects you from tracking and malvertising. (Don’t get “uBlock” – you want “uBlock Origin”.)
  • Privacy Badger. From the wonderful folks at the EFF, this plugin watches for suspicious tracking behavior and blocks it – it even learns over time to get better.
  • HTTPS Everywhere. Also from EFF, this plugin ensures that any site you visit that can support encrypted communication will do it by default.
  • Decentraleyes. Kinda hard to explain briefly, but this plugin helps to limit your downloading of several common web page resources that could be used to track you when you request them.

To install a plugin, find your browser’s menu option for plugins, add-ons or extensions. You can search for the above plugins and install them directly into your browser.

Smartphone Privacy: Reining in Nosy Apps

Every application you install on your smartphone comes with a set of permissions – a list of things it would like to access. This includes things like your camera, microphone, location, contact list, photos, calendar and more. While these functions allow your apps to do amazing things, they can also compromise your privacy. These permissions are usually established when you install the app or first use it. Many of us don’t even give this a thought and just click “yeah, sure, whatever” (I’m pretty sure that’s what the button says). But have you ever stopped to question these requests? For example, should you really grant a Sudoku app access to your contact list? Or a dating app access to all your photos? It’s not uncommon for apps to request way more access than they truly need – maybe to enable some social features you don’t care about or perhaps even to gather intel on you that they might sell to third parties (like marketing companies).

Software developer Felix Krause recently published an article on how permissions in iOS apps (iPhone, iPad) can be easily abused, allowing them to take pictures or video with the front or rear camera, record audio, and even use facial recognition. Of course, you had to have given this app permission to do these things at some point. Maybe it even made sense for that application to have those permissions. But the point he’s making is that these apps can use those permissions for more than the obvious purpose. Furthermore, there may be no obvious way to know when the app is accessing these things.

Need to Know Basis Only

The bottom line is that you should only grant permissions that make sense for the given app’s real purpose, and that you should restrict those permissions as much as possible. For many iOS apps, you can grant permission to these sensitive functions and data only when the application is in use (it’s the foremost app, the one you can see). When the application is not in use (in the background), their access is cut off (or at least severely restricted). For example: why would you want to grant Google Maps access to your location when you’re not actually using it? What else might Google use that location data for? (You know that Google is an advertising company, right?)

Privacy Over Permission

Obviously, for Google Maps to work, it needs your location. And many other apps have a valid need for access to your camera, microphone, photos and so on. But you should question every one of those permissions and dial them back to the bare minimum.

This is fairly straightforward on Apple devices. You simply go to Settings, and then Privacy. There you will find the various privacy-related functions and features, and by clicking on each one you can see which applications can access them. You can then select “always”, “never” or (in some cases) “while using”. Dial them back as far as you can – you can always change it later if you find it’s necessary. This article has some more info, if you need more help. On the whole, Apple does a good job giving users power over their privacy.

Android apps were notorious for being all-or-nothing with requested permissions. However, in Android Marshmallow, Google allowed for finer-grain control. Android 6 gave users the ability to revoke permissions after initial install. The Android interface is often customized by the phone manufacturers and cell phone providers, so it’s harder to give blanket instructions on how to change app permissions on any Android phone. Generally, you go to Settings, then Apps. When you open any individual app and look at App Info, you should find the app’s permission settings. For more info, you can see this article or this one straight from Google.