5

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. Yesterday, our landlord got a message from the ISP stating that there is "a virus" on the network, and that there have been complaints about lots of spam going out to the Internet from our IP address. If the problem does not get resolved in one week, Internet will be cut off from us. He also said left a message to all of us to scan our systems with AVs and to send him scan logs but if the situation is that bad already, I believe that his approach will be of little help since AVs on these machines already failed to identify malware on the system.. And in case they don't even have any kind of protection, trying to install it now that they are already infected also won't be very useful.

So, I thought of offering my help to the landlord to help in locating machines that are infected and that send all this garbage out to the Internet. I don't have access to our network "infrastructure" at the moment, but I might be able to get it if I offer them my help.

My question is - what could I do to help him detect and locate the infected machines? Are there any tools out there that are made for the purpose of finding infected machines on the network? Should I maybe set up an IDS on my system and then look at what is trying to attack me? I know that I could use a vulnerability scanner to locate some stuff like Conficker for example.. Maybe Nmap? Other ideas?

I would prefer an approach where I could detect these machines from my own computer since our network is made from small home wifi routers and does not have the capability to do anything fancy. I also don't want (and don't have the time) to go to each and every tenant in our building to clean their computers from malware manually. I just want to find out who is infected so he could get taken off the network until he gets his machine cleaned.

One more question - if the solution involves scanning computers on the network, do you think I should ask for a written permission from our landlord that I am allowed to do the scanning?

Any ideas are welcome. Thank you.

edit: Regardless of will I be allowed to do this or not, I would be happy to see some possible solutions to this problem.

Improve this question
4
  • Before deploying any form of monitoring tools on your own or on behalf of the landlord, I'd check the Acceptable Use Policy for the network. If there isn't one, I'd stay far away from the issue unless I could get written consent from all of the users.
    – Iszi
    Sep 8, 2011 at 17:02
  • 2
    Unless the landlord has an AUP that includes consent to monitoring, the written permission you need is from the users - not your landlord.
    – Iszi
    Sep 8, 2011 at 17:15
  • How about firing up wireshark and than analyzing the traffick? Is that something I would be allowed to do?
    – tkit
    Sep 8, 2011 at 17:24
  • That would still constitute monitoring of the network, and could be subject to whatever civil or criminal laws your locality would have against it, if an un-informed or un-consenting user took issue with it.
    – Iszi
    Sep 8, 2011 at 17:31

2 Answers 2

Reset to default
2

You say the ISP has detected large volumes of spam. So the easiest way to find the offending system is to monitor the outgoing line for connections to port 25. If you find a host that does a lot of those, then you've probably found the infected machine.

To do this, you would need to sniff right before or after the last router. You'll need cooperation from the landlord I'm afraid. Depending on the gear in front of the internet trunk, you could put a linux box in between with two network interfaces, that forwards and logs. You could also find other malware trying to spread.

Beware however, IANAL, perhaps you're invading others' privacy of you start poking around in their traffic. If you keep it at netflow data (src ip, dst ip, src port, dst port, time, bytes) however, you should be ok. And that should point out the spammer.

Improve this answer
1
  • If you want to look for more than just port25 traffic, consider setting up a snort IDs sensor to monitor the traffic that leaves your wireless AP en-route to the internet. Since it needs to sniff that traffic, you can hook the snort sensor, the AP, and your internet router up to a hub. The snort sensor will see all the traffic. Snort can even be configured to block traffic it thinks is bad. It can be a little tricky weeding out false positives though, but generally if a host is throwing out tons of anomalous traffic, that is a good sign that it is infected.
    – user47267
    May 25, 2014 at 14:27
1

As you don't have access to the uplink you could try a passive approach by installing a honeypot. A honeypot does not actively scan the network and is generally considered legal. It simply runs in the background waiting to be attacked. You are inside the network so if you are attacked you will get detailed information on the attack vector and source.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .