Packet Level Virus Scanning Network Appliances?

Tiber asks: "I had the pleasure of locking down the servers for a large company against the Slapper/Sapphire worm over the weekend. It wasn't enjoyable, less so because I knew I'd have to face it again come Monday when all our users brought their business laptops in. Sure enough, Monday morning, all hell broke loose on our networks. It got me thinking, instead of routers 'dumb' routers, does someone make a network appliance that does worm scanning inside the packets and log attacks? Perhaps someone has a project they know of that does this?"

Comments

small problem

[josepha48]

Even if you have a network appliance that 'scrubs' email and data as it come in, it has to know what is good and what it bad. In the case of a new virus there is no way it is going to know that the virus is a virus and not a real attachment.

So do you delete ALL word attachments or scan them all for known virus? Or do you attempt some sort of AI that figures out virus / worm from none virus / worm?

In the case of using AI, I just don't think it is quite there yet. Yes it may be possible, but not cheap enough for the general public. I wish!

In the case of deleteing all attachements, you could set up a quarentine place for them. I think Norton utilities has a virus scanner that does this for email. My dad once mentioned something about this. He loves it. I no longer get MS virus email from him ;-). Of course I run Linux at home so even when I did get them they did not work cause the binaries just would not run under Linux without wine and me manually running them, and even then I don't think they could have done anything without enough permissions.

Depending on how many servers you have, one thing would be to setup some of the servers as read only. Not sure if you can do that with windows. I.E. Create an account for the mail system and give it access to only certain things on the system and then lock down the rest of the system. Using permsissions restict the mail from screwing up the rest of the server. I don't know enough about windows to know if this can be done? I know you can restrict accounts from accessing data, but can you restict the email admin account? Can windows run entirely off a cdrom? Can windows run in a memory filesystem? Maybe embedded windows can do this, and you may be able to make an embedded windows mail server. Or search the internet for embedded devices and windows servers or somehting.

In unix I know I can run my whole filesystem off a cdrom ( I am doing this with my freebsd home based router). Worst case senerio I have to reboot the router. There are a few problems in my current approach (swap errors in FreeBSD), but it works. Turn it on and it boots up in less than 2 minutes. To shut down just hit the power button, no shudwown required.

My suggestion is to look for embedded devices and make an embedded mail server of your own. You may try using http://www.intrinsyc.com/products/cerfcube/ to create an embeded window mail server. The OS should hopefully be protected in flash ROM, but since I have not tried I cannot say. It may be possible to use this and create a device that you just have to reboot to fix the problem.

Best thing to do NOW if you have not already, is to install Anti virus utilities like Norton and Mcafee stuff on your laptops and servers and use them if they are windows machine which I suspect they are. KEEP THEM UP TO DATE. Our sys-admins send out emails at LEAST once a week with new virus updates.

Lastly educate the people in the company, with weekly emails on the latest virus. If they are aware that they could get a virus that could f*** up their project and screw their deadline they may be more cautious about their email. Not everyone will, but it may be just enough people that it would make your life a little easier.