Slashdot Mirror
Stopping Adware and Spyware on Windows w/ Citrix?
SilverDivan asks: "A fairly large non-profit charity organization recently asked me how they can permanently take care of the spyware and adware problem that is plaguing their computing environment. I told them to simply use Mozilla/FireFox, but as it turns out they access outside applications that only run in Internet Explorer. So, I am planning to make a recommendation to publish Internet Explorer on a Citrix Farm, and let the users use the IE published on Citrix instead of the locally installed IE This way they can lock down the IE to their heart's desire. Also publishing IE 'anonymously' on Citrix will further secure the environment, as the anonymous profiles can be deleted on a nightly basis. However one issue with 'anonymous' access to Citrix applications, is that the user can not maintain their preference or even their bookmarks. Another issue is that there is no tracking, and no way to hold someone accountable in case of abuse. Has anyone implemented a similar solution before? What was your experience? Will it work? How can you configure the Citrix environment to best handle a situation like this?"
You could always run Win4Lin Terminal Services. Then you could run a linux server farm and still let users run their windows desktops. Then you could let them do what ever they want.
:)
Once you remove Microsoft from the important job, it gets pretty easy
"A synonym is a word you use when you can't spell the word you first thought of." - Burt Bacharach
Make them use Firefox with this extension. Then they only use IE for the sites that require it. Those, one would hope, should be reasonably safe.
When will Windows be ready for the desktop?
Comeon man, it's on the front page.
"they access outside applications that only run in Internet Explorer"
If they need IE, they need IE. Removing windows won't help them access these sites at all.
If they need to surf with no limits, put-up a Squid caching proxy and let them use Firefox.
theres dozens of ways to maintain bookmarks.
offer them a customisiable startpage or something for instance.
world was created 5 seconds before this post as it is.
Set them up with del.icio.us accounts for their bookmarks, then have a bookmark for del.icio.us in the default profile.
About writing IE only applications. It's the web, for heaven's sake - the idea is that it's not supposed to depend upon any given application.
My bet is the outside sites they access only say they require IE. Try changing the user agent string in firefox so it looks like IE (with prefbar extension for example), and the sites will likely work just fine. It's worth trying anyway.
I told them to simply use Mozilla/FireFox, but as it turns out they access outside applications that only run in Internet Explorer.
Maybe this is an obvious question, but have they actually tested these applications on FF or Opera? I'm sure that somone in the company has told them that they only work on IE, but it seems quite possible that FF would handle them just fine.
Guys who design for IE generally don't have clue about other options.
Three Squirrels
Use profiles, store the bookmarks elsewhere on a file server. You can then set the rights to stuff accordingly, and backup stuff regularly.
Better if you run the IE as a different user. e.g. normal user account = John_Doe. normal user's IE account = John_Doe-IE.
Then allow John_Doe to have access to John_Doe-IE's files, but not vice-versa.
For "internet zone", turn off everything, including activeX.
For your "access outside applications that only run in Internet Explorer" but them in the trusted sites, and nothing else.
Install firefox and let them use that for the "intar web".
Please let me know where I can send the bill.
There was a way to open a link in a new window without displaying the window's address bar. Couple that with putting up a link like so:
iexplore.exe http://site.com
And removing all links to iexplore.exe elsewhere...
And a better example:
enforce proxy servers (setup as admin in win2k, and leave the users unprivileged), setup a squid proxy server that only allows the site, and do not setup any proxies for firefox...
How about this one:
Hack a spyware and find out how they redirect people's URLs. use that and infect your own machines, so any address in IE takes them to that website. Use firefox for everywhere else.
And make sure you disable activex!!!
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
Despite the userbase growth of FireFox, it is still taking a long time to change the mindset of PHBs.
We are starting development on a very large web application. (primarily using C# and ASP.NET) During one of the design meetings I asked "we are going to develop this so that it is browser independent, right?"
A PHB replied "I see no reason to believe the customers will be using anything but Internet Explorer." Sheesh!
Can't they just "lock down IE to their heart's content" via Group Policy? Or perhaps an outbound proxy that only allows access to the specified pages when the user agent is IE's?
Citrix seems like a little overkill for this problem.
NO CARRIER
I know of a guy who works in a real estate office, who has to access everything through citrix. All employees have individual logins, and are able to maintain their own preferences, email, and other stuff.
I used a similar setup where I work. We set up a win2k server box with terminal services (essentially citrix), so we could keep one stable desktop while we were constantly messing with our own desktops (or like in my case, I was using unix with rdesktop client).
Managing virus and malware on one common server would be preferable I think. The only issue you might face could be licensing costs, especially if you went the multi-user route.
_______
2B1ASK1
If they are serious about going the Citrix/Terminal Services route, you might consider moving all of their applications to the server and migrating them to cheap thin clients on their desktop. From an administration perspective, managing the machines becomes a lot easier. They can't install anything on their local machines. Most don't need to have access to install anything to the server. No virus software needed for the clients. Actually, no client management at all. If one breaks, you just replace it because their customizations are all on the server. And while you might stretch a PC to 5 years, the only limitation on a thin client will be the display resolution.
The only drawback is political. You have to manage user egos when they find they can't do whatever they want with 'their' PC anymore.
Windows is like a high maintenance wife. Everything is nice to look at, but it cleans out your wallet and there is a lot of down time.
It is amazing what you can accomplish if you do not care who gets the credit. -- Harry Truman
Maybe this is too simple and obvious, but how about, Don't go to websites that install spuware/adware!!
Where I work (US Air Force), this type of policy has not created any problems at all, and for the most part has prevented any significant invasion of spyware in the 5 years I've been at this facility. Why build some expensive and unnecessary additional infrastructure to solve a problem that can be controlled with permissions?
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Maybe something like Deep Freeze would solve your problem.
Each restart eradicates all changes and resets the computer to its original state, right down to the last byte.
There'd still be risks during a session of course. Then again, most of the truly evil stuff I see doesn't turn up until after the system has been rebooted and all the user-installed trash in registry gets launched.
Whoever designed level 61 in Frozen Bubble is a sadistic bastard.
As long as they run Windows NT, 2000, or XP just properly configure them and they should be fine. By this I mean have the users log in as regular users that don't have any sort of Administrator rights (local or domain). Don't even make them members of the Power Users group. Change permissions at the root of the C: and any other local drives because I think the defaults are incorrect and are writeable by everyone (be careful that you do this properly).
Other nice things to do are to not use roaming profiles so that all the junk that could be stored in the user profiles is not saved. Have a script run at startup to delete any profiles on the machine so that they get a fresh one every time the computer is restarted.
I do IT work for a high school district with 2500 students and over 1000 computers. We haven't had a single problem with viruses or spyware once this was configured like this. We also run Norton AntiVirus to help protect against viruses. We don't use Outlook either which I'm sure helps too.
I guess my whole point is that it isn't Citrix that is going to help you solve your problem... it's just configuring the OS properly. I guess the only way Citrix would help would be if all your clients were Windows 98 because then Citrix would allow you to run IE with properly set security.
They are all half assed patches. I find, time and time again, that it is better, faster, and cheaper to remove the dependency on IE - like, re-write the app or use a vendor that actually supports decent, secure software.
Citrix?!? Just to run Internet Explorer?!? Absolute rubbish. Fix the real issue instead just doing a half assed patchjob like that. What's wrong with you whippersnappers....
People who think they know everything are a great annoyance to those of us who do.
Deploying Citrix to an organization of the size you imply would be a HUGE expense. Doing so for a single application is absurd. If this charity is as big as you say, let them use their clout to have the IE sites updated.
At one point in May-ish, with a fresh install, I brought everything up to date, set the security settings, but forgot to trash MS's Javascript .. and promptly picked up a bad case of CoolWeb. With the change, I was CoolWeb-immune. I forget Sun's URL for it, but installing Robocode is always a good start and a fun learning game!
One line blog. I hear that they're called Twitters now.
Hehe. I am betting that the outside app. relies on ActiveX. Which would explane might acount for more spyware getting loaded up. ActiveX would be the only real show stoper for going with Mozilla/FireFox, as others have pointed out.
Quite simple. Firstly you give your users Firefox to stop the spyware problem.
Now, for the external IE only applications, you create them as applications in Citrix and give each an icon on the user's desktop. If the user wants to use one of the external apps, they click the app icon which will launch a Citrix'ified IE window with the app in it. Obviously configure the Citrix IE to remove the address bar.
Let me preface this by saying that I'm not a Citrix administrator or a web site administrator, but here's two things that might make this simpler on many of the fronts you listed.
1. Make a custom home page for IE on the Citrix Server. Include links to where they enter all these custom IE applications so they can get to them in one click after starting IE.
2. Optional. Disable pretty much every domain but the ones these custom apps are on. A thorough test should verify if they will (currently) work in that configuration.
This might be a better option than using the anonymous option in Citrix, which will mean that they can still use bookmarks (but to what?) and preferences (good for all those passwords), and you will have abuse-tracking logs.
Sure I'm paranoid, but am I paranoid enough?
If it is a significant problem, they will be interested enough to learn how to avoid it. If it is not a big deal, they are not going to care. If you can't educate their users to avoid this problem, either your a bad teacher, or they don't really care about avoiding it. If their management is asking you to fix the problem, tell their management to point out the simple fact that these things are easily avoided. The answer is NOT always technical guys. Sometimes it is social. If you treat them like a bunch of monkeys banging on the keyboard, they are going to act that way. There will never be enough options in the world to lock everything down. If they can drive a car to work, they can avoid spyware on the internet. There will be mistakes, insurance will always be necessary, but for the most part education is the way.
Spyware can't screw up your computer for you when you don't even have the rights to screw it up yourself. Just take away administrative rights and stay on top of updates. Some institutions take this to the next level and run with all users as guests, and use logon scripts to build the user environment when needed. You will occasionally find software from sloppy vendors that don't do things in a clean way with respect to permissions, but if enough people come to their senses about admin rights, the few remaining vendors will get their shit together.
On the other hand, there was an interview recently with Microsoft's head of IT. It's shocking how they don't even try to use their own built-in security measures. They just give everyone admin rights and scan constantly. Since you probably aren't as big as Microsoft, you don't have that kind of luxury (or need for users to have that kind of flexibility). Just set permissions sensibly and relax.
If you don't give your users enough rope to hang themselves, they probably won't.
Of course it does take a little while to get everything working as you want it to, but since you are exporting the registry keys you want, the flexability it there.
You do not have to use anonymous access to get to the server. Mandatory profiles may do the trick as well. That way they can use their normal user IDs to log in, but still get a clean copy of the profile every time. You can also set where bookmarks are stored using group policy or the IEAK so they can keep some degree of personal settings. You could either redirect it to a network share or back to the user's local computer.
There is no reason to have spyware infected PCs in a corporate environment.
At home, everyone runs, by default, as administrator. But, at work, there is no reason to do this.
Try this:
1. Format a PC and reinstall with ALL the applications they absolutely need. Make sure you launch all the apps at least once so that they can finish writing everything that needs to be for setup to complete.
2. Create a group for all the users on that PC. If you are using AD or other Domain logins, you can skip this step on the PC. Just add the Group and Users on the Domain.
3. Open up Explorer. Set the permissions on the C:\ drive to 'read only' for the group you'll add the users to. Make sure that all the subdirectories inherit the permission change. Now, go to C:\Documents and Settings\. Set that directory to read/write.
4. Now, if not using a Domain, login as each user at least once. Most places will only have a few users per PC, so it shouldn't be too much trouble. Try launching the apps they use a few times. Some apps try to use c:\windows\temp or c:\temp or c:\program files\someapp\temp for temporary storage. If they need it, add read/write permissions to thoes directories.
5. Sit back and enjoy as spyware happily tries to write to wherever. If it tries anything outside the temp directories or the user's profile, it'll be denied. When users complain about not being able to install crapware, point them to a policy forbidding use of unauthorized software. Ask them to get permission from their supervisor before continuing. If it's something they *need*, you install it for them.
6. You may have to play with it a bit to ensure that users don't have permission to each other's directories.
7. One possible problem: if the spyware takes advantage of an exploit that bumps up the user's privelages, you can't defend agianst it.
8. Some additional steps: change the administrator user name. Change the guest user name. Make sure you set a password for both. Also, make sure guest is disabled.
Here is a doc with some more steps you can take:
http://nsa2.www.conxion.com/win2k/index.html
Or search google for 'win2k nsa hardening'.
I'd rather you do it wrong, than for me to have to do it at all.
Trend Micro makes IWSS, which is a proxy that has built in anti-virus, including filtering out assorted spyware/malware.
I can't recommend the product too highly, it seems somewhat immature, though it does block the spyware/adware as advertised.
Why not install a content filtering system such as Webmarshal or another inbound web filtering program.
Use group policies to force the use of a proxy and make this machine the proxy machine.
Then you set the rules on the WebMarshal box to what you want. You can install a virus scanner and such.
I use webmarshal in my enviroment, and whilst its not the greatest. (It IS a big brother monitoring device), it keeps my systems clean and protected from viruses and trojans and other illicit content that enters a company through the web.
The cost of hardware and software is probably similar to or significantly less than the cost of a citrix server and licenses.
I hate suggesting things that support continued use of IE but since we are talking charity here it is:
You can probably wrap the browser session with a frame navigator (like ask jeeves...) where the controlling frame has all the navigation buttons and necessary menu items and even an address bar. When the browser starts up, hide all top menus and only show the buttons and menus you want them to see via DHTML. You could even create a bookmark based system using DHTML and some simple server side storage. The only difficulty is that you would need to put an authentication layer to resolve the current user although there may be a way to resolve this with an active-x plugin or even native.
Although you are looking at a bit of coding here, I know that you could use a citrix frame to navigate any IE based site in this way.
Good luck.
JsD
Since the "IE-only" sites are presumably known, set up a sqid proxy that only allows access to those specific sites. Set everyones IE to use the proxy server.
Then to allow access to the wider internet, set up firefox w/out a proxy, or (more secure) firewall off ports 80 and 443 and proxy firefox through a different squid server which allows more-or-less open access.
Note that it's virtually impossible to 'lock down' IE under citrix since you can hit the 'help' menu which has a link to 'web help' which gives you... -- try it and you'll see what I mean. All citrix would do for you is to crap out their entire iE install in one go when there's a problem.
"But actually trying to use m4 as a general-purpose langage would be deeply perverse" --ESR
The most insane thing I've seen is virus protection software (McAffee) that needed explorer (and I assume activeX) for its user interface. So if you lock down IE completely and install Firefox McAffee will choke.
To use IE for UI strikes me as an outlandishly moronic move by McAffee.
Seriously, IE does have some security features, the default setup is abysmal, but you can tweak-up the security for the whole world, and put the outside app into the 'trusted sites' zone. Problem solved. I've done it and it works.
BTW, you still have to keep your boxes patched, but that's a no-brainer anyway.
"Sometimes, I think Trent just needs a cup of hot chocolate and a blankie." -Tori Amos on Nine Inch Nails
You seemed to have missed the "take your business to a vendor that has a clue" part.
I work for the local school district's IT department and we use Deep Freeze in all of our labs. What can I say, it's great.
We use the Professional version. This allows the computer to maintain itself. The computers are set to shutdown each night at 4:30 except Friday. On Friday at 5:00, Deep Freeze turns itself off and locks the keyboard and mouse. Windows updates are performed, virus defs updated, and hard drive defragmented. Sure since Deep Freeze is installed we don't need to do all of this but we do just to be safe.
Citrix has a nice solution for LARGE organizations (150+ desktop computers) but the costs of it are not balanced out by its functionality. Citrix had a leg up on microsoft when they sold Windows NT Terminal Server to Microsoft and made it basically broken, forcing people who wanted that functionality to buy Citrix for roughly two times the price. Now that MS has caught up with Citrix in terms of centralized management, there is no reason not to use AD and their policy editor.
On the other hand, there are ALOT of "mangling" HTTP proxies that can really cut down alot of the junk in web pages. Filterproxy and privoxy come to mind first. This kind of solution requires only one or two medium spec'ed boxes and some experimentation, not a $50,000 investment and the need for either training or consulting to get it up and running.
As said before, convincing them to pay you to install Citrix to lock down IE is nearly a scam! Then again, this is usually how businesses get ahead... by scamming people
Windows is like a high maintenance wife. Everything is nice to look at, but it cleans out your wallet and there is a lot of down time.
I don't know about you, dude, but I'd be a happy man if my girlfriend went down as much as my Windows install does.
Dealing with lawyers would be a lot less tedious if they all looked like Casey Novak.
citrix is a bit overkill
firewall/proxy access only to certain sites required for use.
use mozilla etc for everything else.
note you need to lock down windows.. alot of spyware is installed by the user because they simply don't care.. they just want access to the latest pic of britney or whatever even if it means running this or that or clicking ok to an active x control you can be sure they will.
and despite what the stats of these anti spyware companies say a cookie ain't spyware in my book.