The recent malware/ransomware infection

Perry Metzger has some excellent advice at Samizdata:

How not to be a victim of computer malware
For my friends who don’t know much about computers:

I do computer security work professionally. People always ask in the wake of yet another internet attack “what should I do to protect myself.”

The advice is always the same. Do what computer professionals do. Don’t do what you imagine computer professionals do, because you’re probably wrong.

1. 1. Always run the latest version of the OS and software.
   2. When security updates appear for your operating system or software, apply them as soon as possible, meaning that day. Configure your system to automatically apply updates if possible.
   3. Back up your computer frequently. Since normal humans cannot remember to do that, get software and/or a service to do it for you.
   4. Don’t use the same password with two different services, period. Since you cannot remember hundreds of different passwords, use a password safe, and remember only the password for it.
   5. If a web site offers two factor authentication (that is, you can set it up so it both requires a password and a code your phone generates), turn that on.

Every professional security person does those things.

If you ignore my advice, you’re going to get screwed one day, period. You might still get screwed even if you do follow my advice because the world is dangerous, but I can guarantee you’ll get screwed if you don’t.

Every organization that got infected recently by the ransomware worm was ignoring (1) and (2). Their suffering was avoidable. Do you want to suffer like them? Those that forgot (3) are really suffering because they have no way to recover. Why do you want to suffer? Every day, people get badly, badly screwed because the password that they use everywhere gets stolen and it is de facto impossible to remember every place you use it. Why set yourself up to suffer?

As to the question “who would attack me? No one is going to attack my computer, I’m unimportant”, the answer is that it isn’t individuals doing the attacks, it’s machines that are programmed to try to attack other machines by the hundreds of millions. You’re not being personally targeted, but that hardly matters when everyone on earth is being attacked. Your obscurity will not protect you. Even if you think there is nothing for the attacker to gain by taking over your machine, they’ll want it anyway, so they can set up a botnet to send spam from it, or use it to bring down other people’s web sites, or to take over yet more people’s machines.

Much more at the site - be sure to look through the comments - lots of good stuff there too.