Slashdot Mirror
Universities Taken Offline to Fight Worms, Viruses
chrismg2003 writes "Nationwide universities are opening their doors to new students but closing off their network services. The Blaster worm has caused universities to take drastic actions to protect their campus networks. Universities have gone as far as shutting down their entire resnet network and bringing it back up dorm-by-dorm after each computer has been certified worm-free. The ICMP ping requests alone have brought down my university's resnet multiple times and we are scrambling to clean the worm from all computers before it forces us to follow suit with other universities."
> upgrade to a more secure operating system. If you mean Linux, I assume you somehow are going to fund training all the students how to use it, along with getting all of the school's faculty and staff to support it, along with providing for Linux patch management efforts. Yeah, right. Back to the real world we go...
Lets see here..
Two scenarios
Scenario A-
Computers taken off line. Productivity is lost entirely.
Scenario B-
Virus hits. Productivity reduced.
Hmm.
It doesn't work when most students bring computers in from home that are unpatched.
The ICMP ping requests alone have brought down PLU's gatekeeper (resnet) multiple times
sounds like somebody needs better sysadmins to me. perhaps a better network layout wouldn't hurt either.
why not block those icmp requests at the switches to each bank of dorms? you do have switches, don't you? you can then look at the logs and find out which machines are infected.
why not deny any outgoing smtp traffic from resnet machines?
why not block the ports used by these specific worms?
why not implement some proxy servers, so that students at least have access to the web while everything else is offline?
if you were working at a real company, and not a dorm, you'd be fired for "shutting down the network". disabling all services is NOT an acceptable solution.
No. My computer is patched, and I pay for web access. I will NOT put up with being shut down for no reason. Either they need to target the virus vectors, or don't do it at all. The minute my machine is ever turned off because someone near me has a virus is the minute I cancel my account and change providers.
I still have more fans than freaks. WTF is wrong with you people?
The action seems perfectly reasonable to me:
To get the school's message across, all students were asked to sign a document confirming that their computers were updated with all the needed security upgrades. Not enough students confirmed that their machines were updated, prompting the GMU action today. Administrators said they would try later today to reconnect dorms, weeding out students with infected PCs. Students living off campus can continue to dial in to the campus computer network.
Looks like the kids are getting a decent deal on virus-removal and system updates too:
Students are being charged $30 if a university technician is called in to clean an infected machine, a school spokesman said. Students can go to off-campus experts for a fix but must certify that their computers are updated with the latest security fixes before being allowed to access the campus network.
Hmph, I can't find anything wrong here. Of course, there are a couple of choice quotes from the kids who, I believe, are our future:
Kimberly Borchert, a 19-year-old sophomore, said her computer "freaked out" as soon as she plugged it into the school's network last week.
Freshman Andrew Canose was one of several GMU students who encountered problems after installing the university-provided anti-virus software. Canose found the new program conflicted with an older anti-virus program already on his computer. "My computer is like at war with itself and won't work," he said.
But my favorite lines are from the admins, such as this gem:
"I think we really need to groom a new type of student who is responsible for their computer security," said Kathy Gillette, manager of George Mason University's beleaguered tech support center. "A lot of them lived at home and mom or dad took care of the computer so they've never learned how to fix them, but hopefully we'll be able to teach them that too."
And the classic:
"There were a certain percentage of students that wouldn't listen to us unless we hit them upside the head with a lockout," he said. "You simply can't deal with these problems until you've got your network under control."
everything in moderation
Saying that everyone should switch operating systems is not the answer to the problem. Although Windows has more than it's share of problems, other operating systems aren't flawless. If everyone went out tomorrow and switched to a Mac or Linux I can promise you that the number of viruses and worms for these systems would go through the roof. Considering that an average user either a. doesn't know how, or b. even bothers trying to use something as simple as Windows Update, do you really think they are going to know how to secure a Unix based system.
Microsoft should hire me. I can write code that doesn't work faster than the guys they have doing it now.
Toss a webpage up that says:
"We detected MSblaster on you machine, please goto to microsoft wupport, and download the appropriet patch"
Just let it sit there for 60 seconds, then let them conintue on.
After they hey the site three times, send them an email with directions. always point towards microsoft support.
all this can be automated pretty darn quickly.
The Kruger Dunning explains most post on
people using Windows are just about as insensitive to their peers as people who, say, smoke
No. People who don't apply security patches are about that insensitive. There are a lot of mismanaged Windows machines in the world; there are also a lot of mismanaged linux and BSD machines.
We see Windows worms because that's a big target; but let's not delude ourselves into thinking that our favourite operating systems are immune.
Tarsnap: Online backups for the truly paranoid
And far FAR easier than "switching" to Linux.
Anyone "retarded" enough to get infected with a virus on Windows is FAR too "retarded" to not get their linux box rooted. Especially with the blaster virus. It could be blocked by two compeltely seperate and simple prevention schemes.
If you have your linux box, unsecured on the net, then you are the "retarded" one. You have either been rooted already and don't know it or it will happen soon.
If you HAVE secured it, I guarantee you did more work to do so that it would have taken anyone to prevent being infected with Blaster.
Contrary to popular belief, coding is not all free blow-jobs and beer. Those things cost MONEY!
You should get a partial tuition refund if you don't use Windows, and thus the university's IT doesn't have to worry about you.
Since when does using Linux mean IT doesn't have to worry about you? A friend of mine set up a Linux box a few years ago. ITS showed up at his office and shut his computer down because it was (unintentionally) DDoSing the DHCP server.
I'm a Linux user as well, but I certainly don't think that it solves all problems. Should knowledgeable Windows users who keep their systems patched receive a tuition discount too? And students who use more than their share of network resources, should they pay more?
-- "Complacency is a far more dangerous attitude than outrage." -Naomi Littlebear
sometimes the techs are so harried for time that they don't get around to patching their own shit.
Sometimes they are so lame they can't be bothered to wipe their own asses, either...
Still, what a professional embarassment!
Of course, you get to go right past airport security without stopping, too, because you know you're not a terrorist. Right?
Identify what is the source of the problem and then get rid of it. In this case i think demanding safer systems would be a wise solution. Just cut off the bosos who have infected computers.
That should make linux etc popular. Every windows user has stare at their empty nic while the nerds just keeps using the network as usual.
HTTP/1.1 400
Sorry, I don't buy this argument. Suppose there's some terrible disease going around. However, there's a freely-available vaccine available for anyone who's not so lazy that they can't call a number and have a county health worker at their front door in 10 minutes to personally give them a shot. There's enough vaccine available for everyone in the whole country, and then some; however, the county health workers will only come if you call. There's public service announcements all over radio, TV, the internet, and public highway signs telling you all of this, so there's no way you can't know of it. Everyone at work talks about it. Lastly, this disease only affects some people. People with green eyes are naturally immune.
But even with all this, lots of people for some reason are just too lazy or too stupid to get this vaccine. According to you, every place should be quarantined to make sure the disease doesn't spread further, even though this is going to be a major PITA to all those people who got vaccines, and all the green-eyed people who don't have any problem in the first place. This is stupid. What should be done is just let the disease run its course, just like we do with the flu every year. Anyone too lazy or stupid to protect themselves, given how easy it is to do and how impossible it is to not know better, deserves to die.
Do you not realize the problem with what you just wrote?
No Internet == No Email
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
I'm only on page 3 of 7.. but think I have made enough comments to show that we should take this article with more than a grain of salt. I'm going to read the rest of the article now.
-tor
Any upper level (Junior/Senior) CompSci students who were infected and notified by the automated bot should be ASHAMED!
It should also be noted in their record. (Wants to run a network, but can figure out Windows Update, personal firewalls or anti-virus software...)
Learning HOW to think is more important than learning WHAT to think.
Insightful? How about entirely wrong?
Certainly there are far fewer OS X virii, but it's far from true to say it can't be done.
Dave
I write a blog now, you should be afraid.
As someone managing 2 cable plants with dialup and wireless pools mixed in I couldn't agree more. As soon as we saw our routers get wonky I investigated to see what it was, saw more than a dozen cable clients spewing garbage like crazy and promptly blocked them at the routers.
.pif/.bat/.scr attachment, everything else is still clear and still goes through a virus scanner. The blocked extensions can be legitimately sent via .zip if someone really does want to send such a file.
Next I investigated what the worm was, it was Blaster and it was brand new, we noticed it before the virus companies released a thing. I found out what ports they were using and blocked those, those ports are now permanently closed since they have no use on the public internet and can easily be handled with a VPN connection.
Then came SoBig.F, our mail servers became bogged down as infected hosts would send a message per minute or so, so now I have instructed the mail scanner to simply discard any incoming email with a
Oh, our users, appreciate the steps being taken to ultimately protect their systems and to help keep the network stable as possible.
More broadband services need to actively block certain ports and strip attachments at the door. For those that don't want blocking then feel free to get your own T1 instead.
This bug has been in Windows for over a decade
Yes, and there are bugs which were in Sendmail for over a decade before they were discovered. Ditto for BIND. And BSD. And it would almost certainly be the same for linux, if linux were old enough.
My employer (who keeps up with security patches) was only halfway through the desktop update cycle.
For some value of "keeps up with security patches" meaning "is halfway through applying security patches which were released four weeks ago".
Tarsnap: Online backups for the truly paranoid
A bit over half the world's domain names are hosted on Apache servers. If you look at big targets (companies running https, for example), there isn't much difference between Apache and IIS.
This is, however, rather irrelevant to the question of worms; most of the machines hit by Code Red had IIS running (and weren't patched, of course) but weren't actually hosting any web sites.
Tarsnap: Online backups for the truly paranoid
The "gentleman scholar" approach you advocate to teaching engineering has been tried.
It results in highly trained people with degrees who design and build things that don't work in the real world.
Tech Public Policy stuff