Preventing Client PC's from accessing C&C machines

Question

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my systems are patched with WSUS, and we regularly push FireFox and Flash updates via GPO.

Despite all of these measures, I still find users getting Malware on their PC's. For the most part this Malware is just "Scareware" however it looks as though it's put there from a dropper of some sort. While the Scareware is cleaned easily enough, I'm more concerned about the dropper putting a Trojan or Rootkit on a machine and that machine sending information offsite that it shouldn't be allowed to do.

My question is if we can't completely mitigate the infection of PC's, can we at least prevent that machine from connecting to the outside world? Firewalls will only go so far as they're stateful and will maintain a communication with external computers so long as they're the one that initiated the communication. Can this communication be effectively prevented?

D.W. · Accepted Answer · 2012-08-03 18:12:32Z

You can't, not without imposing an unwarranted intrusion on people's ability to get work done.

You could turn off all networking (or forbid all outbound connections), but then no one could get any work done. Not a helpful solution.
While it might be possible to build a blacklist of known C&C servers and prevent machines from contacting any server on that blacklist, this is not likely to be a useful defense. Where would you get that blacklist? You're not gonna compile it on your own; this stuff changes too fast. And if someone has analyzed the bot software to identify the C&C server, they've probably also identified it to find a fingerprint that can be added to anti-virus software. So I would expect any bad stuff that's blocked by this defense to already be recognized by anti-virus software. In short, I don't think this offers much value over just running anti-virus software.

In conclusion, I don't think this is a promising direction to solve your malware woes.

I think it's a better bet to focus on standard practices: automated backups, bring everyone up to the latest version of the OS and software, turn on automatic updates. For Windows users, get them on the latest version of Windows (XP must die), give them a modern browser, uninstall Java, Quicktime, and other unnecessary software (unless they need it), and give them antivirus software. If they get infected, wipe and reinstall their machine and give them some quick informal, impromptu security training (e.g., about clicking OK on dialog boxes). Also, Secunia PSI can help you keep your users' software up to date on the latest security patches.

This is great feedback thank you DW. I think moving to Windows 7 is the next step for us - Given a browsers dependency on Java this day, do you think you can realistically run browsers without Java? I imagine that would be a big attack vector for the malware to take advantage of and I'd love to eliminate it, however I don't think I can realistically
I'm not sure what you mean by "a browsers dependency on Java". Browsers don't depend upon having Java installed. These days, only a very few websites require Java. Most users get on just fine without Java. See, e.g., Don’t Need Java? Junk It.; Java: A Gift to Exploit Pack Makers‌; Time to Let Go of Java in the Web Browser: How to Disable It, (cont.)
... and more on Java: New Java Exploit to Debut in BlackHole Exploit Kits; Apple, Oracle Ship Java Security Updates; New Java Attack Rolled Into Exploit Kits; Exploit Packs Run on Java Juice.
Windows 7 is reducing the number of malware if run with windows update, as well very good anti-virus software with very high malware detection and quick update to the latest rules
If you cant afford secunia, the best thing you can do, is to setup WSUS (Windows Update on Domain), and eventually you can push all Microsoft, and this is alone closing lot's of issues, and then you are left with other software, so basically autoupdate to flash player, adobe reader, and the rest is not as much exploited as the above mentioned.

Andrew Smith · Answer 2 · 2012-08-02 21:22:12Z

Of course you can. You can setup firewall on the machine, hardware router and NAT firewall as well HTTP proxy at once, and deny all outgoing connections to the internet, however you have to allow some software like browser and email still to be able to download malware, so you can add something to your email scanner too.

On Windows 7 for example, it is possible to setup firewall for all applications and enforce it via GPO, not exactly the graphical way, but you can make all set of rules to block any unknown software not in the policy to connect from the machine to anything at all, so only authorized set of files in certain locations can use the windows networking.

For example, you can prevent software from temp folder actually using networking for whatever reasons, as well software installed in root folder.

And some malware does actually switch it off, and kills the warning message, as I have witnessed once.

On the NAT firewall machine you can restrict outgoing connections to certain list of services going to the internet, for example, only HTTP/S and Skype for Office and whatever needed.

On HTTP Proxy and SSL proxy (without decoding) you can deny certain traffic based on virus information, like communication with botnets and infected hosts over HTTP, which is very useful for people who are browsing the internet.

http://www.spamhaus.org/xbl/ - be careful with them ;-)

http://www.enisa.europa.eu/activities/Resilience-and-CIIP/networks-and-services-resilience/botnets/botnets-measurement-detection-disinfection-and-defence/at_download/fullReport

http://download.microsoft.com/download/8/1/B/81B3A25C-95A1-4BCD-88A4-2D3D0406CDEF/Microsoft_Security_Intelligence_Report_volume_9_Battling_Botnets_English.pdf - microsoft

http://cbl.abuseat.org/ - this works with some proxy servers

http://www.cisco.com/web/about/security/intelligence/bots.html - cisco