Slashdot Mirror
Spyware/Adware Prevention In Large Deployments?
foQ writes "I work in the IS department for a ~2000 networked computer environment across 10 locations. As with most people, we have experienced serious problems with spyware/adware. We have SpyBot and Ad-Aware installed on most computers, but this doesn't prevent the computers from getting these programs and only sometimes properly removes all of them. Is there a tool that we could push out to all the PCs to basically do what anti-virus programs do and block these programs from running and clean them from the computer?"
I took a look at enterprise antispyware software for a client and particularly liked Webroot's Spy Sweeper Enterprise product. It provides centralized management and automatic deployment though you can do it manually as well. Definition upgrades as well as version upgrades of the sofware is also automated. Take a look at this page from their website. Lavasoft also has an enterprise product that is pretty good though I think Webroot has a slight edge.
http://www.busyweather.com/
besides freezing them?
I usually dont reccomend upgrading antivirus programs to my clients, but the latest round of 2005 versions basically have adware in with their virus defs. Not sure about the corporate level stuff, but almost all the major consumer AVs do.
We use Symantec Antivirus and Desktop Firewall - seem to do the trick...
The friendliest digital photography forums on the net!
I recommend just sticking a firewall up at the root of your network and blocking all traffic on port 80. It cuts down on web surfing and it puts to death all those stupid ad/spybots that already infest your network.
If someone needs to access a site, have a system where they can request a site to be opened for access. Of course they will need to have a valid reason and you (as network admin) have final say as to letting them have that access or not.
The www is something that can be surfed at home on personal time. Work is for work.
Two words: Death penalty.
Get spyware, get shot in the head. After two or three pluggings in front of coworkers, NO ONE will get on the net period, or even check e-mail.
Harsh? Yes. Effective? HELL YES!
but this doesn't prevent the computers from getting these programs
I believe Spybot does protect you ("immunize") from around 2000 different pieces of software, if you let it.
Every time a user finds spyware on their PC, replace the monitor with a smaller one.
When a user has to make a decision between h4rdc0r3 p0rn and a 6" monitor, they might be a little more proactive in preventing spyware!
You can apply what is known as a Software Restriction Policy and enforce it strictly so that only approved software is installed on system computers
Thank you for taking the risk of testing that so that others won't have to.
Sounds like the same problem we face--4k client PCs in five locations--and we don't have too good of a solution.
We're currently taking a two-pronged approach. First, for the big baddies like Gator or Bonzi, we use Altiris Notification Server to find them and block their execution. This works tolerably well, but it's a reactive process--for me to block a spyware app, I have to know about it, and it has to be something of which I can deny exeuction (so, no browser helper objects).
Second prong is a managed install of Spybot S&D--we're enterprise licensed and maintain our own update server. We stick Spybot S&D in our base loads and force it to run on a schedule, automatically updating itself and running non-interactively. This catches lots, but can sometimes interfere with the users' work.
There is also an ongoing user education effort, consisting of mandatory training and constant reminders about how spyware works and how one gets infected, but that's about as hopeless as bailing the ocean with a kid's toy bucket. I'm long past the point of hoping that the general user population can learn about how not to get infected with spyware; I'm resigned to spending the rest of my days hearing about how someone in Marketing was hitting the gambling sites at lunch and picked up yet another malware app.
Use FireFox instead of Internet Explorer. www.mozilla.org
Though this is a quick way to get a "+5 Informative", it is not a valid solution to most Adware/Spyware/Malware exploits. The majority of this software is installed as part of another application. For instance, the notorious "Internet Optimizer" and "Gator". Running FireFox does nothing to stop an ignorant user from falling for a snappy ad and installing something bad on their workstation.
I'm not defending IE, I'm just pointing out how it does not apply in this particular case and Mozilla will, by no means, be the end all of web-related tragedies.
I did some spyware experiments of my own one day, to "ferret out" where some of this stuff came from. I did a clean install of XP on a machine, and carefully documented what I did, and the resulting changes in cookies, commit charge, etc. The results were interesting - I visited a lot of adult porn sites - literally just combining verbs and adjectives, and got very little in the way of spyware. I went to a particularly vicious site - default-homepage-network.com, and instantly got hit with a bunch of popups and three items immediately went into add/remove programs. Then I installed the "standard" kazaa - installing spyware programs was part of the initial installation!!! Commit charge went from about 100 megs right after a bootup, to 212 after installing Kazaa. Then, I wiped the machine out and installed XP and then SP2. The first things I tried - porn sites and default-homepage-network, didn't do anything - only Kazaa resulted in spyware, because installing it yourself is part of the package. When I clean out clients' PCs, I do the following: 1. Safe mode, command prompt - delete everything I recognize as a spyware .dll or .exe, and I rename anything I believe may be a system file.
2. Normal mode, uninstall any program with "rebates" "shopping" "bargain" etc...
3. Install and run Adaware, Spybot, Hijack This, CW Shredder, and Spyware Blaster.
4. Install SP2 if it's a recent machine - SP2 tends to crush PCs that have been running for a while.
5. Scold them for downloading music, and remind them that not only will they have to pay me if their internet habits cause reinfection, but the greedy RIAA bastards may even come knocking one day.
I agree that most 2004 and up versions of Symantec and McAfee include anti-spyware protection, as well.
Not too impressed with Webroot Spysweeper - it's a rather ponderous product.
Firefox is a damn good idea, too.
And of course, stay away from "Spyware Stormer"
Never start vast projects with half-vast ideas.
I love how all the FFox/Mozilla comments get a score of 1.
The truth of the matter is Mozilla does indeed prevent quite a bit of malware from entering your computer.
Oh well, I'm sure this will be modded 1 - Redundant
Why is a normal user allowed to install programs in the first place?
Because that computer thing is meant to be USEFUL
RelevantElephants: A Somatic WebComic...
A man who can't pronouce "nuclear arsenal" shouldn't have one -sig ends here.
Assuming you have to run Windows, first remember there are multiple steps that you'll likely have to take with no silver bullet. Consider these 10 steps as a spring board:
The first step is to put in place policies (where possible) on domain controllers that prohibit both the installation of BHOs and of other software by anyone other than Administrators. Given that many, many bits of spyware (I'll go out on a limb and say most) work as (so called) "browser helper objects", don't let people install them at all. Other software Administrators can install when needed. It's actually fairly easy to do.
Second, where possible, deploy W2K or XP, and...
Then, third, where possible, yank people's admin privs. In virtually all cases, with a bit of good ol' trial-and-error, you can successfully adjust users' permissions to take away admin from most folks. Let's face it, most people SHOULD NOT have the ability to have admin on their own machines.
Fourth, where possible, dump IE.
Fifth, do some short SMALL GROUP tutorials about the evils of spyware and how it works. (I found this to be surprisingly useful for teaching users about passwords.)
Sixth, where possible, dump IE.
Seventh, consider netbooting the workstations and storing users files on fileservers. That way the OS you give 'em is the OS they get and it's always the same every day. (Tell them to think of it as life imitating art as in "50 First Dates", where they get a fresh start every day....)
Eighth, where possible, dump IE.
Ninth, go with something many of the folks here have/will recommend in terms of enterprise-based anti-spyware/anti-virus/anti-?????? software. I used Norton Corporate Edition in a fairly recent gig, and while that particular version didn't check for sypware, there are a number of solutions others are proposing that will. (The Corporate Edition is critical to your sanity--you can manage the AV software on *all* desktops via a central console.)
Last, and not least: dump IE.
------
Running 'Nix is like owning a Lightsaber. It's "a more elegant weapon for a more civilized time."
I am so sick of hearing that "once [fill in the blank] reaches critical mass, it will have the same problems." That sidesteps the issue of design, as though all designs are created equal. This viewpoint only works if you view your computer as a magic (black) box with no discernable internal structure or parts.
Methinks it says much more about the people who utter the phrase than it does about the systems they suggest are inherently equal.
But it's true. Apache eventually won out over IIS, and what happened? 10 apache worms a week, every week for the past 2 years. And don't even get me started on the local exploits. Apache, the worst httpd ever!
Oh wait. Never mind.
So you installed ad aware and spybot on most of 2000 systems. Did you pay the authors of those software any money? Maybe if you paid them some money they could help you roll out massive deployments or modify their software to suit you.
My guess is that like most companies you installed them without paying because you didn't have to fill out forms or break your budget. Now you are looking to pay somebody else for software after using their products for all this time.
Just doesn't seem fair.
evil is as evil does
No it is not. There is no Microsoft Word for Linux, Open Office comes close and I love it to death but its just not ready yet.
There is no god damned Access for Linux either. Heres a newsflash a lot of companies have database frontends that rely on Access, it may not be the best solution but it is the current system and to change it would cost thousands of dollars.
Like it or Loathe it Visual Basic is used throughout many companies. Please correct me if I am wrong but do any Linux office products work with Visual Basic?
These are just a few of the many examples why you couldn't just switch to Linux like that. Those are just the software factors too, forget user training, the cost of changing hardware that isn't supported to Linux etc.
What about thousands of pissed off users because they can't figure out why the hell the start button looks different or why text on the screen doesn't behave as expected.
I'm not trolling, I like Linux I think it is great for the home and for a hobby but its just not ready for the mainstream. Perhaps in a few years, but not today.
You need to stop them before they are able to install one peice of code on the system.
1). You can do a few things, namely locking the computers down using the Microsoft Policy Editor (as I am sure you are aware of it's existance).
2). Make sure that no user has administrative access, and that downloading / installing programs is not allowed - if they need programs, that is what their roaming profile is for.
3). Also keeping a image available of every system so that you can restore to a known good working point
4). Invest in a decent SAN and keep the roaming profiles there, ALL documents should be kept on the SAN / roaming profile so that re-imaging the computers when they do get things on them does not cause valuable work to be lost.
Perhaps suggest hiring a freelance IT guy who knows how to do such things if you do not, there are plenty here who need the work.
If you can get to the control panel, display settings, look in the C: drive, change IE options, etc, you're doing things wrong, it's not locked down enough.
Yes it's a pain for the users, but it does alleviate the potential of corporate espionage (don't beleive it doesn't exist, it most certainly does) and also spyware/adware/etc screwing up your computers.
These are just the basics but it's worked fine for the company I work for, after some user adjustments it's actually not that bad. The only thing you loose is the storage on the clients, and possibly a big investment in a SAN ranging from 1TB on up, which can be moderately expensive.
http://www.fsckin.com/
The reason why ignorant (I'm being kind) users are installing crapware in the first place is because they clicked on a pop-up window that led them to the crapware in the first place.
Because pop-ups can be disabled in Mozilla/Firefox, said users never see them and therefore are far less likely to install the crap.
Lets not forget the tradition of there being a new remote exploit discovered for IE every couple of weeks.
I do IT support in an academic environment and I've found that just hiding IE's presence on a system and replacing it with firefox means that I'm far less likely to have to deal with some security issue on that system again in the future.
My steps to securing an XP Box:
0) Optional: Install SP2 if possible/safe
1) Turn on the firewall
2) Set the system to auto-update
3) Install good AV software and set it to auto-update and scan the system each day
4) Get rid of IE
5) Get rid of MSN messenger
6) Cross your fingers
7) Pray
Optional:
8) Sacrifice Chicken
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
It selectivly breaks activeX to prevent spyware. I use it on my only windows box. Failling that, I have linux on 2 systems and Mac OS X on the other two. And on my work box which is dual boot I have spywareblaster on the windows part.
You also still have to exit and restart the browser every few days as it tends to get sluggish after a while.
When someone's computer gets fucked up, just set a firewall on their IP so they can only access a list of websites, and block their email so they can't receive any executable attachments. That'll teach them.
There's no reason for most people to need access to the whole internet at work, other than work would really suck if I actually had to work instead of sitting around and reading Slashdot.
My solution is simple.
No user can write to the registry in the common spyware places. All access to write to the ares of the registry that is commonly attacked by spyware is removed by GPO. That is - no unapproved shell extensions, no BHO add access, no new Explorer bars, no ability to modify the Winsock32 stack, no install priveleges. All apps are deployed through GPOs. There is a white list of approved ActiveX in general and BHO controls.
Spyware usually requires BHO access to tap into IE. Removing that access is good. White list enables the ability to provide desirable BHOs, such as Google and Yahoo bars, as well as internally developed apps.
Leonid S. Knyshov
Find me on Quora
Depending on your budget, try Encase Enterprise by Guidance Software. EnCase is the forensic program/application used by the US Govt and also by most of local and foreign law enforcement investigators as well.
The Enterprise version takes forsensics a step further, utlizing a client listener app which runs on the desktop and after establishing a baseline of permitted apps, can be used to detect and counter malicious apps running on the LAN and WAN as well as imaging drives realtime for investigative purposes.
Investigations have been performed from halfway around the world with the click of a button. Another selling point to the PHB's is that it can be used for HR investigations as well, making it an easy ROI for most companies.
http://www.encase.com/
Most of the bright windows admins on here are going to tell you to use permissions to lock down the workstations and take machine admin rights from the users. Now you have to sit back and ask yourself is that really going to help? Yes it is probably going to help but they are really luring themselves into a false sense of security. Now ask yourself how many of the windows admins that you know use IE? That right most if not all of them use IE. So now ask yourself what does that got to do with anything? Well if IE can execute code easily at user level privs then what happens when that stupid windows admin browses to a page containing malicious code? That's right the worm, virus, trojan has full admin privs.
What do you do to avoid catching the flu? That's right you get a flu shot. So do yourself a favor and get a flu shot, install mozilla on the clients everyone will thank you for it anyhow.
Got Code?
If businesses used your logic, there would be no PCs. We would still all be running green screens off of mainframes. It is those terrible users that found they could do thier job 5 times faster by going around IT and running apps on a 'toy' (PC) that has gotten us as far as we are. At least 2/3 of the Administrators that I have run into are not competent, and are simply not well versed enough in business or technology to determine what software is necessary and what is not. The comment about Kinko's is a perfect example. Remember the 'Shatter' attack? If you had access to the machine as any user, you could get admin access. The Kinko's Admins are probably thinking that they don't want the huge PR problem that happens the next time a similar hole is found, and some script kiddie grabs copies of confidential documents for weeks or months before the attack is made public and a fix is released. SNL's 'Nick Burns' is not far from reality.
I manage an active directory domain and I've taken care of the major offenders through group policy.
First, I attempt to download the spyware much like any user would. When I get the prompt asking me to approve this installation, I view the certificate that it was signed with and save the certicate to the file.
Next, I add that certificate to the list of banned certicates domain wide. It works great and fixes the problem of people installing spyware without knowing it.
Install VNC over the network (or other comparable remote-control software; VNC is free and GPLed) and put HijackThis on a read-only network share.
If the user reports problems, VNC into the machine, run HijackThis as root, and remove what you need to.
Running as User or Power User will help, but it won't stop everything.
Try adding the MVP Hosts list to the firewall's shit-site blocker.
If you can, put SpywareBlaster into your image set for the machines you clone and force a once-a-year reclone with updates.
There's also the simple idea of not letting your users use IE. Force them to use Firefox, Opera - anything but IE.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Any time you have to deal with a technical issue that involves user interaction as a component of success, you will need to propose to management, a policy that bolsters the behavioral aspect of the solution; Users need to be made, by management, to have some degree of awareness and culpability for virus and spyware infections.
"Frequent-fires" users will be compelled to learn some digital hygine.
Most large and medium-sized businesses operating today have some sort of policy on sexual harassment/hostile workplace/conflict of interest/Internet and PC usage policy, etc. Generally, users understand that these policies are for eveyone's protection - With ~2000 PCs in the mix... This is definately where you should start... Policy Covers Your Ass.
On the technical side:
1. Router logs, intrusion detection, and sniffing as trending tools to show your boss what's up with traffic.
2. Good, solid desktop images/ app pushes/ GPO's - harden the Registry, Security Policy, individual apps as necessary. Beyond that - when a machine is sufficiently infected, it should be replaced with a re-imaged one --- it can be faster than cleaning, and is a hell of a lot more complete. This also reinforces the notion of users not storing important things locally.
3. Helpdesk tracking software - What users/machines/network segments are continually having the same problems? Does Human Resources need to be the next step for some people?
4. Desktop management software - provide your boss with stats on just what kind of crap is showing up.
5. If you must use/develop software that may enable or even contain spyware, you have a particularly tricky problem that concerns both company policy and IT best practices.
Of course, you know your boss, I don't... How you implement these suggestions is different for everyone. To some, it may seem draconian, to others, quite lax.... To some, budgets will not allow the necessary attention - for others, this kind of focus could perhaps justify a budget increase.
Oh... And consider the broswer's role in the business - what is an acceptable $$ loss for a preventable issue? Have you already spent that?
My $.02