2

At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my systems are patched with WSUS, and we regularly push FireFox and Flash updates via GPO.

Despite all of these measures, I still find users getting Malware on their PC's. For the most part this Malware is just "Scareware" however it looks as though it's put there from a dropper of some sort. While the Scareware is cleaned easily enough, I'm more concerned about the dropper putting a Trojan or Rootkit on a machine and that machine sending information offsite that it shouldn't be allowed to do.

My question is if we can't completely mitigate the infection of PC's, can we at least prevent that machine from connecting to the outside world? Firewalls will only go so far as they're stateful and will maintain a communication with external computers so long as they're the one that initiated the communication. Can this communication be effectively prevented?

2

You can't, not without imposing an unwarranted intrusion on people's ability to get work done.

  • You could turn off all networking (or forbid all outbound connections), but then no one could get any work done. Not a helpful solution.

  • While it might be possible to build a blacklist of known C&C servers and prevent machines from contacting any server on that blacklist, this is not likely to be a useful defense. Where would you get that blacklist? You're not gonna compile it on your own; this stuff changes too fast. And if someone has analyzed the bot software to identify the C&C server, they've probably also identified it to find a fingerprint that can be added to anti-virus software. So I would expect any bad stuff that's blocked by this defense to already be recognized by anti-virus software. In short, I don't think this offers much value over just running anti-virus software.

In conclusion, I don't think this is a promising direction to solve your malware woes.

I think it's a better bet to focus on standard practices: automated backups, bring everyone up to the latest version of the OS and software, turn on automatic updates. For Windows users, get them on the latest version of Windows (XP must die), give them a modern browser, uninstall Java, Quicktime, and other unnecessary software (unless they need it), and give them antivirus software. If they get infected, wipe and reinstall their machine and give them some quick informal, impromptu security training (e.g., about clicking OK on dialog boxes). Also, Secunia PSI can help you keep your users' software up to date on the latest security patches.

0

Of course you can. You can setup firewall on the machine, hardware router and NAT firewall as well HTTP proxy at once, and deny all outgoing connections to the internet, however you have to allow some software like browser and email still to be able to download malware, so you can add something to your email scanner too.

On Windows 7 for example, it is possible to setup firewall for all applications and enforce it via GPO, not exactly the graphical way, but you can make all set of rules to block any unknown software not in the policy to connect from the machine to anything at all, so only authorized set of files in certain locations can use the windows networking.

For example, you can prevent software from temp folder actually using networking for whatever reasons, as well software installed in root folder.

And some malware does actually switch it off, and kills the warning message, as I have witnessed once.

On the NAT firewall machine you can restrict outgoing connections to certain list of services going to the internet, for example, only HTTP/S and Skype for Office and whatever needed.

On HTTP Proxy and SSL proxy (without decoding) you can deny certain traffic based on virus information, like communication with botnets and infected hosts over HTTP, which is very useful for people who are browsing the internet.

http://www.spamhaus.org/xbl/ - be careful with them ;-)

http://www.enisa.europa.eu/activities/Resilience-and-CIIP/networks-and-services-resilience/botnets/botnets-measurement-detection-disinfection-and-defence/at_download/fullReport

http://download.microsoft.com/download/8/1/B/81B3A25C-95A1-4BCD-88A4-2D3D0406CDEF/Microsoft_Security_Intelligence_Report_volume_9_Battling_Botnets_English.pdf - microsoft

http://cbl.abuseat.org/ - this works with some proxy servers

http://www.cisco.com/web/about/security/intelligence/bots.html - cisco

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.