Slashdot Mirror
Using Firewalls to Block Spyware?
MartinMotor asks: "I'm a Network Administrator for a company with approximately 200 users, and we just installed a shiny new PIX. Being the resourceful network geek type, I immediately started adding deny statements to kill off access to places where people can download evil cursed programs like HOTBAR. Is there anywhere out there where people like me are maintaining a list of IPs for spammers, spyware progs, and pop-uppers to add to our firewalls? I can't be the first person to have this idea."
comes with a HOSTS.TXT that you can extract the data from.
http://security.kolla.de/
"Life is great; without it, you'd be dead." -Harmony Korine
A firewall should be configured to deny everything and only allow through what is needed. Only open ports that you need to open. Stuff like pop-ups that run on port 80 (which you need to open for at least your squid proxy) are a different matter As for blocking pop-ups and stuff like that, those are best done on the proxy server. On my proxy, I block all ad related sites (doubleclick, etc) and it is real easy to do with squid. The downside is that on some sites (like cnn) you get java errors on some of their java code. Just tell the users to say "no" to the "do you want to execute more java code from this page" and it is fine. That is the configuration I use and it works fine.
Try the CAUCE, Osiris Relay, ORBS, and other spam clearing house websites. I was able to pull down spam domains and ip addresses to route to a non-existent port on my firewall.
And don't forget those weather news download sites and gotomypc.com!!!!
If you need some starter lists drop me a note.
Success is the ability to go from failure to failure without losing your enthusiasm.........
Spy Sites
As a side note, if you can't find a big enough list, you can always load the spyware on a test machine.
Gryftir
Death to all Fanatics!
http://www.santacruzbynight.com/index.shtml Santa Cruz By Night Vampire Larp
I asked myself the same question a few months ago - creating a blacklist for squid - and couldn't find a good resource. I grabbed the hostfile that came with spybot and started with that - I found that about 10 domain names account for 90% of the spyware out there.
The list itself is at the office, but maybe I'll reply to myself tomorrow.
Our site denies software installations of any type through Windows policies for anyone but power users (ie.: programmers and not even all of them). Sure there were complaints and groaning... But they weren't for crashing computers anymore. You'd be surprised of the kind of sh*t some cute screen savers (TM) install. DLL messups, preferences mangling! So while firewalling might prevent some of the symptoms of spyware (ie.: call homes) good policies both technically enforced and "socially" enforced go a long way.
I don't have a complete list, but you may want to add 66.35.250.150 to your IP blocks banned. I've seen way to much time lost to that one...
+++ UGUCAUCGUAUUUCU
You let your users install stuff? You have a lot to learn...
I can't remember which spyware apps did this, but they will actually go into the ZoneAlarm config and get through that way. It's scary, but it happens. IIRC I even read about it on /. (imagine that...).
The other way firewalls get bypassed is if the spyware uses something already given permission to tunnel out on a system, like a web browser spyware plug-in would. In that case, what chance do you have of stopping it but to remove it?
Here is a copy of mine in Text format.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
after the horse has left, but for what it's worth, there's Peer Guardian, which uses a constantly updated list of IP addresses which have been declared "bad".
Fuck Slashdot
So I setup outbound deny rules on the firewall for those IP addresses and DNS servers related to Permissioned Media. That stopped the problem until they started to host the download off of other IP addresses and servers... so I went back to SARC document and added the new IP addresses to the block list. For two weeks, I checked the page twice a day to see if the list changed. Since then, the problem stopped.
As far as HotBar is concerned, I setup the internal DNS caching server to be authoritative for the hotbar.com zone and pointed it to a non-active IP in the local subnet. That fixed much of the problem of people installing it... :)
Be careful, you don't want to get sued
Do not insult me sir! To call me dumb is fair play, but French? That is a low blow.
Actually, I was just having a bit of fun at the expense of some karma.
Yes I do make those boots in the directory above the file.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Windows XP supports application signing. Learn more at microsoft.com/windowsxp
I personally use Tiny Persona Firewall. It doesn't have tons of features but it does the job. Every time a program tries to access the internet, I'm given the option to block or allow and can set up rules accordingly. So when adware tries to get out and report home, I block it's network connection. (Ver. 2 is free)
In addition, it is nice because I can stop Outlook Express from accessing images from HTML docs, and may programs with built in images for ads can have their ads blocked as well.
There are other such programs, I just don't know much about them.
My hosts file is here:t win.htm
;-) to load much faster...
http://www.froggy.com.au/mike.skinner/16bi
It blocks lots of adds, cookies, trackers and XXX sites. It might even block Slashdot images and adds
http://www.slashdot.org
If you think
We had the same problem here, someone went and started to image our new sites, and hmm what do we find but Gator.. this thing was driving us nuts, but since we have our own internal DNS that gets used, we put an entry in the DNS that pointed all traffic destine for gator to 127.0.0.1 .. the gator traffic that was 75% of our outbound traffic dropped to 0%...
The easiest way to acheive what you want is to change your network security policy, and enforcing it by way of ACL's on the INSIDE interface of your PIX. By this, I mean:
2 PApp basis. But i digress.
Go from your current "Internal users can access anything they want" (default allow), to "Internal users can ONLY access what we allow" (default deny). The beauty of this is that you *don't* waste time tracking down various ports for each and every application you want to block. Nor do you have to worry about keeping up with the latest spyware-ridden P2P client crap to be released. The only thing it *won't* cover is applications using protocols you allow (such as using port 80 for data xfers in $P2PappName). You can cover this with more specific ACL's on a per-shittyFsckingMakeMyNetworkAdminLifeMiserableP
The PIX makes this very easy - matter of fact, we do this exact same thing at work.
First thing you need to do is take a list of all network applications (or protocols) that your users require to do their jobs. Things like FTP, WWW, SSH and the like. Next, you formulate your ACL list to be applied to the inside interface (or whatever name you gave to the interface your users sit on. It defaults to INSIDE with a security level of 100). Do this in a text file, and check it for sanity BEFORE you apply it to your PIX (otherwise you have irate users calling you 100 at a time, screaming that you broke $nameOfAppINeedToDoMyJob).
Once you have this list and you think it's complete, add a default deny rule to the bottom. Now before you go pointing out that PIX already has default-deny, you should STILL add this because the PIX won't log packets that hit its default deny - only packets that match an explicitly defined Default Deny ACL.
Very basic example ACL list:
access-list PERMIT_OUT permit tcp any any eq 80
access-list PERMIT_OUT permit tcp any any eq 21
access-list PERMIT_OUT deny any any (denys all other traffic from any source to any destiation on any port, and logs it)
The above will allow FTP and HTTP outbound for your users (you need to use protocol fixup on the FTP), and deny ALL other traffic! Problem solved, and it only takes about 10 minutes to do.
Janie took my gun...
The "-u" flag to sort(1) only works on systems that implement the XPG4 standard. If you want to write portable shell scripts, you'll need to call uniq(1). Unfortunately for us script writers, not all the world uses GNU textutils.
HTH. HAND.
I'm proud of my Northern Tibetian Heritage
Don't mean to sound like an Internet Nazi, but...
:)
Denying all traffic while allowing only the bare minimum necessary is a good policy to implement on many levels. Here's some of the most important reasons why that are in my head right now (not necessarily in order of importance):
- increased security: not only are outsiders unable to see what you have running inside (obscurity), they simply can't get to it. What can't be reached, cannot be easily (i.e. directly) exploited
- simplifies management of rules: instead of blocking port A for irc, port B for ICQ/AIM, port C for Gnutella, port D for... this IP range for irc, that IP range for Gnutella... just block everything by default. No worries if new nodes, not yet on your list, pop up. Less time spent adding IPs. No worries that a third-party blocking mechanism might block false-positives
- increase productivity (yeah, yeah, I know). But, simple fact is, when people are at work, they should be working, not downloading the latest Britney Spears singles (and yes, I am a hipocrite when I say this, because I am reading / posting to slashdot right now)
- make sure that whatever means of blocking you use (e.g. a firewall) are configured to filter both incoming and outgoing traffic: even if a piece of spyware makes its way inside, it won't do too much harm (except maybe try to spread itself)
- in general use the least-trust principle -- it's simply the way to go, not just about spyware, but in general
Yes, I am biased. I'm an admin
Have EVDO, will travel.
what they are doing are the worst, any true Guru generally downplays their knowledge because they know how much is out there and how fast it changes.
I once read, the more you know, the more you know there is to know, the less you really know.
errr....umm...*whooosh* *whoosh* Is this thing on ?
One of the very few mainstream websites to use totally wierd ports is FedEx. Their Java applet for shipping packages not only uses unusual ports, it requires that a connection be opened from the host side. If you're behind a NAT box, this is painful. Amazingly, Linksys has special support for this.
Your employees will undoubtedly spend way too much time there, and its full of a bunch of opinionated, undereducated tech geeks anyway!
On these nameservers, override the zones for the biggest spyware domains and also for AIM, Yahoo Chat and the like, adding wildcard A records directing the request to the IP address of an internal machine running a HTTPd, or to 127.0.0.1.
The effect is twofold -- this will break 90% of the spyware programs, and you will have a log of all of the internal clients with spyware installed.
I use DJBDNS for the nameserver and publicfile for the HTTPd, but the same effect can be obtained with BIND and Apache.
There are a few programs out there that use or will fall back to hardcoded IP addresses, but these can be dealt with by adding NULL routes at the appropriate gateway routers.
I do not deploy Linux. Ever.
BIND 9 documentation states that "this is not yet implemented in BIND 9"
The alternative is to add "block out return-icmp" rules to the packet filter for those destination IP addresses -- just dropping the outbound query packets will cause the nameserver to wait for the query to timeout before returning SERVFAIL.
With karma to burn, I would like nothing more than to congratulate you on your achievement of the Useless Use of cat Award.
Washington, DC: It's like Hollywood for ugly people.
I deal with a lot of sites that are implementing security for the first time due to HIPAA regulation.
If you are a stone-cold IP expert, that is, you can name at least thirty ports and their uses off the top of your head, you know exactly why DirectX v7 doesn't NAT properly, you are intimate with the ICMP packet structure, you know why FTP uses more than one channel (and how to proxy that) you are qualified to do this.
If you aren't an expert, and you set up a firewall for an existing site using the philosophy of "everything that is not mandatory is forbidden" you might cause more trouble than you'd have from not using a firewall at all.
If you want to become an expert, set up a NEW network with a firewall, or do it at home, or something. Don't break business processes for 10,000 users because you don't understand that certain types of ICMP must be allowed, or because you don't understand FTP port negotiation.
If you want the security, and you are too cheap to hire an expert and too proud to take training, at least run some serious packet logging on all your outbound links for a month or more (business runs on monthly, quarterly and yearly cycles) so you know what is going on before you break it.
And don't forget IP-addressed ingress and egress filters - i.e. don't let people send packets IN to your domain using your source addresses, and don't let people send packets OUT of your domain unless they ARE using your source addresses.
--Charlie
It's even possible to execute two or more identical test systems on their own private "ethernet bridge" to watch the scanning and propagation behavior of a virus or worm.
I do not deploy Linux. Ever.