{"id":251,"date":"2014-11-10T13:16:34","date_gmt":"2014-11-10T17:16:34","guid":{"rendered":"http:\/\/blog.uvm.edu\/whysecurity\/?p=251"},"modified":"2014-11-10T15:01:55","modified_gmt":"2014-11-10T19:01:55","slug":"visiting-questionable-websites-or-using-your-internet-hazmat-suit","status":"publish","type":"post","link":"https:\/\/blog.uvm.edu\/whysecurity\/2014\/11\/10\/visiting-questionable-websites-or-using-your-internet-hazmat-suit\/","title":{"rendered":"Visiting Questionable Websites (or, Using Your “Internet Hazmat Suit”)"},"content":{"rendered":"

National Cybersecurity Awareness Month is an annual opportunity for folks like us to encourage folks like you to adopt a simple, three-point approach to keeping yourself and your information safe online:<\/span><\/em><\/p>\n

STOP.\u00a0THINK.\u00a0CONNECT?<\/span><\/h2>\n

With each phishing<\/a> campaign that’s conducted against UVM’s students, faculty, and staff, the\u00a0Information Security Office receives dozens of notifications from astute members of the community who recognize the email messages for what they are: a scam aimed at co-opting someone’s legitimate\u00a0access to UVM’s information\u00a0resources.<\/p>\n

Occasionally, these notifications include a comment\u00a0like, “I knew the email\u00a0was a phish, and clicked the link. Wow, was that ever a poor excuse for a website!” (or “…Wow, the site looked exactly like myUVM!”). While we appreciate the heads-up and certainly understand folks’ curiosity, the sad fact is that even the simple act of visiting<\/em> one of these websites can cause trouble by forcing your browser to make unauthorized\u00a0requests,<\/a> instigating\u00a0malware downloads<\/a>, or even by\u00a0commandeering your web browser for control by nefarious puppeteers.<\/p>\n

What’s the astute-yet-curious Internet citizen to do?<\/p>\n

In short: Leave it alone, unless you’re willing to undertake a fair amount of work. Seriously: The Bad Guys have gone out of their way to take Everything That’s Nice About the Internet and turn it against us.<\/strong><\/p>\n

You’re still here? OK, there are<\/em> a few techniques that someone\u00a0willing to go the extra mile (well, frankly, a few extra miles) can use to investigate suspicious sites in relative safety. But even all of these are only a hedge, and not a guarantee that nothing Bad will happen to your computer\/mobile device\/information. Caveat lector\/Lasciate ogni speranza\/Here be dragons, etc.:<\/p>\n

The “one-time experiment” approach: A separate user account on your computer.<\/h3>\n

The easiest entr\u00e9e into Fearless Acts of Internet Investigation involves becoming someone else…sort of. Modern computer operating systems (including Windows, OS X, and Linux) leverage the concept of the user account<\/em>. Whether you know it or not, each time you use your own computer, you log in as a particular user (even if you don’t use a password). In most “consumer computing” cases, that user is also an\u00a0administrator<\/em> of the machine’s\u00a0operating system, meaning that it\u00a0is capable of doing just about anything to that computer including installing malware<\/a> like viruses and keyloggers<\/a><\/em>.<\/p>\n

The trick to safely investigating suspicious Internet sites is to NOT<\/em> have that capability. Here’s how to do it:<\/p>\n