Slashdot Mirror
Handling Viruses in an Uncontrolled Network?
An anonymous reader asks: "Recently I've gotten a (volunteer) job looking after a small (approximately 500 computer) network, located within a large block of student flats.
We've been having numerous problems with viruses over a few years. They spread like crazy on our network, with 100megabit connections in every residents room. Every so often they 'go off' and start a flood, which of course takes the entire residence network down. I've tried desperately to educate users on the virus problem, but those that are the problem don't care - they ignore every warning they get and just buy a faster computer to compensate for their systems sluggishness. As we only need two or three ping flooding computers to bring down the network it's hard to keep our network up whenever a worm starts its payload. What solutions have Slashdot readers came up with this and similar problems?"
"Keep in mind that I'm doing this on a volunteer basis, and that my own study time and personal life takes first priority. The residence isn't prepared to spend more money bringing help or a replacement in, which I can understand given that I pay them rent that I would prefer not to increase. I also don't have any control over the network infrastructure itself, just over our DHCP server. I can't force users to keep their computers safe, as I don't own the things - all it seems I can do is point them to the *FREE!* virus scanner and local Windows update mirror and urge them to protect their computer, and offer to help out those that need it - (although due to time constraints, personally helping out everyone in a 500 member network isn't a possibility).
I can also email off a request to have certain IPs dropped off at the switch, but those users have to come back online soon enough. Whenever someone is infected I try and sit them down and make them realize that keeping their computer safe is their responsibility, and they always seem very attentive whenever we're discussing when they get reconnected to the network, but soon after they'll be infected again."
I can also email off a request to have certain IPs dropped off at the switch, but those users have to come back online soon enough. Whenever someone is infected I try and sit them down and make them realize that keeping their computer safe is their responsibility, and they always seem very attentive whenever we're discussing when they get reconnected to the network, but soon after they'll be infected again."
There see, that wasn't too hard!
But this is slashdot. A slashdoter who didn't build his own computer is like a Jedi who didn't build his own lightsaber!
If you have gotten a job administrating a network for 500 computers, then it is not an uncontrolled network. YOU ARE THE ONE IN CONTROL. If there is currently no policy for restricting usage of the network based on client problems such as ignoring viruses, then I strongly suggest that you write one up now and implement it. Start blocking the MAC addresses of the users that are the abusers. If you just sit back and don't take control, you will soon find that students have little added value of your network and may start to move out, which might leave you without a job.
I'll leave it to other slashdotters who are network admins to flame the hell out of this guy.
I sure wouldn't want to be the guy tasked with handling this!
#include "forums.h"
int main() {while (bollox) postcount++;}
It sounds like you've been completely neutered. If at all possible, talk to the administration about instituting a "3 strikes" policy. That is, if someone's computer causes a network-wide issue 3 times, their network drop stops working for the remained of the year.
That'll clean their acts up in a hurry, or at least make your life easy.
Even Jesus hates listening to Creed.
Seriously, volunteering to be THE on-site tech support for 500+ users is insane, especially since you're not even getting a discount on your housing. Quit the job or move out so you can worry about your own network.
-EB
Do you ever walk alone like a drifter in the dark?
Isolate the computers that are spreading the virus and shut down their access to the DHCP server based on their MAC address. Then make the reconnect process as painful (yet educational) as possible. >:)
If you can't put the bad users on a slow switch, and force them through an even slower proxy to make their life hell, then see if you can't organise a minimum disconnection period. Say 10 days or so to reconnect the idiots who keep getting infected. Since you control the dhcp server, you could filter them out by their mac address so they can't wander over to someone elses room to connect. Yes, they could probably circumvent this with a little knowhow, but let's face it, an idiot who's managing to become a virus writer's bitch every week isn't likely to have too much in the way of technical knowledge...
Code, Hardware, stuff like that.
It's ok if the professional is paid $0, just as long as the terms of the employement are understood: that the network dude has the authority necessary to be able to do the job.
Then, be that guy. Now you have authority.
Then, kick network abusers off the network. People who run viruses are network abusers.
Problem solved.
It really sounds like you're wasting your time.
You don't have control over the users, the machines, or the routers; so what the hell can you expect to do?
Sounds like the best option is to unplug the offending machines from the patch panel until they can demonstrate they are virus-free. Although that is likely not a viable solution if these are paying customers.
Seriously, it seem like this is an unsolvable problem and neither the users nor the administration seem to want to spend any effort in fixing it. So the sooner you realize that there is nothing you can do, the better. Help out with the IT system at your local Humane Society, womens shelter, or similar instead.
Oh, and get your own DSL or cable modem.
You need more power. Otherwise you will fail in your job ( unless you take to violence ).
Students need to be kicked off the network until their computers are clean. If they are kicked off x times, they are off until they come to you and sign a form saying they understand how to keep their computer clean. y more time(s), they are off for the rest of the semester.
Simple, effective. You will need a couple decent switchs capable of shuting down ports ( or you could just yank the wire ).
If you don't have this level of power over the network, get rid of any access you do have. The higher ups only want a scape goat.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Put the linux and mac users in their own subnet. This won't help *you* any, but it will mean the linux and mac users don't have to deal with constant flooding when the windows boxes go off :)
Send them emails with executable attachments. If they click on the attachments, ban them from the network for a week.
Send these out frequently. Soon they'll instinctually hit the DEL key when something with an attachment comes in.
I'm a big tall mofo.
You could place all the offencive (Read as you like) onto a seperate physical network, firewall it like crazy (like maybe just port 80 outbound), and then send it back to the big pipe. The offencive users still get http access, but can't play games/share files/smtp mail etc... You could say 'Thats for users who know what they're doing. Come back when you've got a clue'
Windows in 6 Bytes (IA-32) : 90 90 90 90 CD 19
You're doing this for free? I wouldn't even do this job for pay -- unless it was something like Bill G's salary. You will never educate kids who will click on anything that promises free porn, download and use every ad/spyware infested P2P program out there, and not think it's their fault because they can't be bothered to even update their anti-virus.
The system will be in trouble continuously because even if most were actually responsible users, it only takes a few irresponsible ones to mess it up for everyone, and it will always be your fault!
And if, pray tell, things actually do run perfectly for a few hours, or days, don't expect any thank you's from that ungrateful crowd.
And as you said, you're not even getting paid for this. Bet this means you have effectively No Authority to fix anything or punish anyone otherwise. Try to kick off a multiple repeat offender and guess whose ass ends up in a sling when they go whining to the university president.
Have fun!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
You need more power. Otherwise you will fail in your job ( unless you take to violence ).
Students need to be kicked off the network until their computers are clean. If they are kicked off x times, they are off until they come to you and sign a form saying they understand how to keep their computer clean. y more time(s), they are off for the rest of the semester.
Simple, effective. You will need a couple decent switchs capable of shuting down ports ( or you could just yank the wire ).
If you don't have this level of power over the network, get rid of any access you do have. The higher ups only want a scape goat.
I couldn't agree with you more about the idea, but the main thing he needs is backing from the providers of the service (the same ones that collect the rent money), in the form of a written policy. You can't kick people off of a network they're paying for unless you have it in writing that those are the consequences of an infected PC on the network., even though it's unfair to those with uninfected PCs.
As far as a technical solution goes, I wouldn't make it a manual process at all if I were you - consider investing in an IDS (intrustion detection system) type of product that will automatically deactivate ports on the network from possible offenders. Then you only have to manage the IDS, and it's not "you" that's removing their access, it's the IDS (and it's automatic). Cisco's IDS product is a very good, albeit expensive, solution that is fairly straightforward in installation and very easy to manage...
I was in the park the other day wondering why frisbees get bigger and bigger the closer they get - and then it hit me.
"those that are the problem don't care - they ignore every warning they get and just buy a faster computer to compensate for their systems sluggishness"
You're not looking at this realistically. The statement above betrays your frustration. You see the users as stereotypes of carelessness and stupidity.
So they buy faster computers when they get infected? And how often does your typical student buy a faster computer? Every day? Every week? I think not! Yet, how often do people get infected? From the way you describe the problem, it is quite often.
Users already have incentives to keep their computers virus free. Nobody likes getting a virus. It slows their computer down and makes it hard to use. They can't just run out and buy a new computer! Your harsh stereotyping is ignoring the reality of what students face.
So, the first step is to get a better understanding of the problem. Why not try talking to some users? Not just your techie friends, talk to the average person who knows only how to turn it on and run the few programs they use? I'll bet you'll find out that the real reason for the problem is not that people don't care, because they can just buy new computers! It is because they don't feel confident in their abilities to download, install and run the AV software, and to continue to use their computers with whatever small operational changes the AV software may impose.
I can't tell you for sure what the solution is, but the first step will be to understand the problem better. Resorting to stereotypes of users as malicious or uncaring is only going to take you farther from the solution.
all parents are correct.
detect these ping attacks, network scans - and shut them off.
after it happens repeatedly, they might not learn.
if not, oh well, at least the other 98% of the students can continue to work unencumbered by the offending assholes that refuse to respect the network that they are only leasing while they're there. (read: they do not own the network no matter how much they pay)
Of many possible technical & organizational approaches, which you employ depends on what is your goal.
1. If your goal is to be a nice guy who doesn't bother anyone and gets all your studying done, then the most practical technique is to quit volunteering.
2. If you're a music or poly sci major who is not really interested in network administration as a career ... then cut your losses ... this sort of volunteering isn't really helping.
3. But if your goal is to get out of college with something helpful to put on your resume, then treat this like a professional opportunity! Show that you can do a top-notch job of network adminstration by learning the techniques, putting in the time including the hard-nosed ejection of malefactors, and allowing for that time in your study schedule.
After all, when you get your diploma, how many of your competitors are going to be able to say, "I managed a 500-node network, achieving X% of whatever metric most impresses employers.Given the choice between someone who got all A's and someone who accomplished something useful while getting decent grades ... who would you hire?
--- Attorneys Assisting Citizen-Soldiers & Families -
It sounds like your hands have been tied. I urge you to first seek more authority to demand that users install antivirus software. If the powers-that-be refuse to grant you the power to enforce that rule, your only solution is a social one.
Whenever someone's computer brings down the network, publicize his name. Find some way to make his neighbors hold him accountable. Believe me, it will happen. It won't take too many hazings (and rumors of hazings) before people shape up and install antivirus. Most people know about the need for antivirus, they're just too lazy and think "It won't happen to me." So motivate them.
Make public who got banned and how often. These guys will start to take care of their security if they get questions like "Surfing porn again, Dude?" and "Why did you get banned _again_ this month? Didnt you just requested access again?"
Others will get aware of the issue too and might be more careful.
Anyone that's smart enough to change their mac address, should be smart enough to keep spyware and viruses off their system.
Also my school used to require that students REGISTER their mac address in order to get access, and the switches / dhcp server would only allow registered macs in.
repeat offender's: Sure I'll clean your system and reconnect you to the network but remember, I'm doing this on a volunteer basis, and that my own study time and personal life takes first priority. ; call for an appointment, I should have some time after Finals. Of course give serious babes preferential treatment
Apocalypse Cancelled, Sorry, No Ticket Refunds
But the problem is these are students and they have work to do.
So what? Crap happens...virus ate your thesis, power went out, printer ran out of ink, blah blah blah. Thing is that if you are a responsible person you have contingencies in place to minimise or eliminate the impact of such incidents. If the work is important, you keep backups, spare ink cartriges, update your antivirus, OS, apps, etc...and most importantly you don't procrastinate to the point where you are in crisis mode. If you don't do all of the above then you should be prepared to follow Murphy's Law. If a mishap is unavoidable, you could be granted an extension.
Thing is, it is standard practice for net admins EVERYWHERE to pull the plug at their discretion should your computer be found to causing network disruption. Taht is a standard condition of almost all terms of service. My ISP would knock you off very quickly should they discover an open mail relay, ping flood or other unusual level of activity, and I pay extra for business-grade service. I agree with other posters here--this guy should put in some F/OSS tools to help manage these problems, and immediately terminate all network connectivity of infected machines ASAP.
"I have work to do" be damned. Seriously. Part of growing up and going to school is to learn--and people have to learn the consequences of their actions or inactions--that's life. You have to keep your house clean, pay your bills on time, obey the speed limit and traffic signals, etc. If you don't there are negative consequences. Same goes for PC use: ignoring the TOS, not updating your machine, downloading comet cursors and talking gorillas and chat icons and P2P warez is just inviting trouble. Users who repeatedly do those things despite warnings deserve no sympathy at all and should recieve all the wrath the BOFH can deliver.
We've heard from the:
//gs had a CRONTAB program!). Set their machine up so it automatically, every day, trys to download the latest and greatest updates for the OS, SpyBot, AdAware (or whatever you use), your virus protection program, etc.... The MOST IMPORTANT THING THOUGH - is to always explain what it is you are doing to the person's computer. Don't just dump a bunch of things onto their system. Bring a flyer that explains what it is you are doing and why. Set their system up so they can win and so they don't have to rely on you to be there to make everything function correctly. All of the virus/cookie/ad checking software out there can be set up to function on its own. Some of them (like most virus checkers) have their own scheduling software built in.
1. "It can't be done" crowd.
2. "Be tough about it" crowd.
3. "Go behind their backs" crowd.
and others....
How about this:
1. Get everyone's e-mail address so you can send all of them e-mail at the same time. How do you do that? Ask them to e-mail you - that's how. Of course, disinfect anything they send you because they probably will have a virus or two.
1a. How do you get all of them to send you the e-mail? Go buy some of those blank business card sheets (Avery I believe makes these), print up your message, get someone to help you break them apart, and then just tape them to each person's door. In this way you: 1)Don't have to talk to them, 2)Don't try to force them to do what they don't want to do, and 3)Can do it on your own time (like on a floor-by-floor basis). Cost: Probably about $10.00.
1b. Your message? It should be something like:
Dormitory SysAdmin needs your help!
We need your e-mail address as we
are trying to remove viruses and want
to be able to keep you informed. Thanks!
myemailaddress@thedorms.edu
1c. Put notices on doors leading into the dorm and/or bulletin boards also asking for e-mail addresses. If you can, have someone hand the things out to people as they come in and out of the dorms.
2. Set up a blog where everyone can meet and talk about problems. Use the e-mail addresses to send your notice out about the blog and how to access it.
3. Set up appointments with people to meet with them to show them how to protect their system from viruses, ads, cookies, and other problems.
Ok, let's say you've gotten some responses and want to start to go to other people's rooms to help them out. You want to:
4. Use the scheduler built in to every operating system currently in use (ie: Mac OS X, Windows98se and up, Linux, BSD, Solaris, etc...). For those OSs which are older (although I can't see anyone currently in college using an Apple ][+ or even Mac OS 9.x or earlier) download and bring with you some sort of a scheduler. (Even the Apple
4a. NOW! Here is the important thing! Set the virus/ad/cookie (or VAC for short) to AUTOMATICALLY e-mail you with the results. This too can be done via the scheduler. Give the automatically generated e-mail a special header (like [VIRUS|AD|COOKIE] REPORT FOR ROOM X). There are e-mailer programs for all operating systems which run from the command line. So just make a little batch program/shell script to create your report and e-mail it to you. Again, write it all down in the flyer you are going to give them so they don't freak when their system suddenly starts doing things (like checking for viruses or sending e-mail).
4b. Most virus software's report will read "VIRUS FOUND" and then tell you where and when the virus was found. Write yourself a short Perl/PHP/C/ script which will read these e-mails and sort out which one have viruses and which ones don't have them. Since you made the title have the room number on it - you automatically know who is having problems. So you can e-mail them back and set up a time to go over to fix any problems they might be having. Further, you can produce statistics on where the greatest problems are and post these fi
Someone put a black hole in my pocket and now I'm broke.
Here's an alternative to the "IF the administration will let you" part. Make use of the fact that nobody else really understands what it is the wizard (you) does behind the curtain:
Implement whatever service termination solution you feel necessary (whether by writing/downloading some automated system, or by doing it manually yourself). When the offender calls to complain, *don't* say that they were shut off administratively. Tell them that the massive traffic from their machine "overloaded" the port they were on (tell them it's kinda like a circuit breaker on house wiring).
They'll say that this never happened before. Tell them that they've got a newer, more-aggressive virus.
They'll ask that their port be "reset". Tell them that, due to all of the machines that they helped infect, and to the convoluted process for "resetting" a port, there's a backlog of a couple days before you can get their port reset.
Maybe they'll ask if you can just plug them into a different port. Tell them that they're all maxxed out.
At some point, Administration might ask why this is happening. Tell them the same thing you told the users... new, nastier viruses. They might ask what new equipment they could get to fix the problem. Tell them that the BFS-9000 can do it... but it's very... very expensive. It would be much cheaper for everyone to just use virus protection.
You should certainly punish the virus writers, if you can catch them. And you should possibly punish M$ for how big of a hole IE still is, even if Windows itself is better than it used to be. But none of that matters.
To use society's resources, you have to follow society's rules. I can go buy any car I want and drive it at 200 mph - on my own track. But if I want to drive on streets I have to follow the rules, as they apply to my actions (hitting things) even when they may not necessarily have a direct negative impact (speeding, driving on the sidewalks) have only a paper impact (licensing, insurance, registration) or only a preventative impact (headlights, brake lights...)
I can also go buy a used car and have the brakes suddenly fail, running over someone's garden. Note that even if I didn't know, I'm still responsible for the cost of that garden, (unless I JUST bought it and can pass the blame to the previous owner) If the brakes were recalled, it's still my fault for not getting them fixed. If they WEREN'T recalled, but should've been, then that's not my fault.
If you're already providing appropriate, simple, free, publicized resources _that they didn't use_ they are being negligent at best. Kicking them off until sometime after they fix it is a MINIMUM penalty for such negligence.
Argueably they should have to pay for the cost of your time to fix their computer (mandatory since they didn't do it the first time) and to repair any problems caused by their problem - and STILL be penalized in terms of being online.
(Personally I believe that a kick-until-fixed first warning is probably a necessary threshold of publicity - but even the second time they aren't listening I think it'd be very reasonable to escalate it.)
To be clear, I don't think it's reasonable in today's world to hold them accountable for anything their computer does. I think it's NECESSARY to hold them accountable for not following your security procedures to defend against it. Which means you're still going to be snuffed by the virus that exploits the OS hole noone has put out a patch for yet - and I wouldn't blame that on the first kid to get it.
I agree with the other posts - you have to get kick/ban/unplug authority, you have to quit, and/or you have to get paid. 1 of those might do...
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
No point beating around the bush - best to nip the whole problem in the bud.
:)
FWIW, in a college I lived in for three years we had absolutely no security for as many as 1000 people, and we never had any significant network issues, despite the constant virii and other malware roaming around.
IMHO, the best solution is to just "shape" bad users down to the slowest speed possible - dialup if your switch supports QoS for it, otherwise just 10 m/bit or similar. One bad user getting disconnected and whining to someone above you could get you in a bit of trouble - but sapping their speed won't be a reprimandable offense, and will curtail a large part of the problem.
And I wouldn't worry too much about being speedy about removing the limits - just tell them the system is updated once a week, and the next update happens to be just under 7 days from whenever they demand it.
You say you only control the DHCP server. In that case that's the end of your responsibility. Make sure the DHCP server remains stable and healthy. Make those who control the network deal with the problem. There are ton's of solutions to this problem but since you are not really in control of many parts of the network its not your problem.
Agreed! Antivirus software is supposed to plug the "wetware hole" of stupid users who run vulnerable attachments, use unpatched software, etc. In exchange for doing this, it gets in the way of every system process, slows down the machine, and occasionally interferes with legitimate business.
Users who're skillful enough not to need antivirus software are also frequently doing things that it gets in the way of. Let them go without.
The penalty for getting infected should be very simple: Post a notice on the dorm bulletin board that anyone who experienced network slowness around [date/time] should be in the quad on Friday afternoon. Have the offender there, strapped to a bunkbed. Arm the victims with bars of soap wrapped in towels. A few public beatings like this should scare the populace into vigilance, and provide an outlet for those wronged by the remaining careless few.
Reading your article, I get the impression that you've tried appealing to both the users and the powers that be without much success. It seems obvious that whatever solution you decide to implement is going to involve a lot of your own time and effort. I suggest you make it worth your while. I don't know what is your particular area of study, but it probably wouldn't be too hard to come up with a way to get some credits for working on this problem. The IT connection is obvious. If you are LA you should be able to work in an angle in psychology, sociology, even some sort of human/technology interface thing for the sciences. Two or three independent study credits might go a long way toward mitigating your frustration. Don't give up if the obvious professors are not responsive - it shouldn't be too hard to find an LA professor delighted to sponsor a program solving a technical problem with a humanistic approach.
As far as method...I suggest you take your lead from the hacker/cracker community. Implement a Social Engineering attack. There are many fine examples of specific techniques to be found in the comments of this thread. I especially like the "scarlet V" approach. I suggest the following:
- "anyone who gets infected is a lamer old school twerp who is so behind the technology curve that they can't even stop high school script kiddies from using them like zombie flesh puppets"
- "allowing your owned machine to infect the local net is dissing everyone in the dorm - especially if you are too clueless to know how to prevent it"
- "you're getting played, you clueless dork, every time you click that stupid 'yes' button it's like bending over and dropping your drawers"
I'm sure you can do a much better job coming up with the proper approach. Just remember that establishing the proper attitude is key - even a few people is a good start. Then public humiliation and shame will work wonders. One advantage of this solution is it will stay with the users after they leave the influence of a network tech fix. Hey, maybe you'll change the world. At least it could help you get a little closer to graduating - and add some stretch to your resume. It might also help you get a little more respect from the powers that be when you slap down your independent study paper with the big, fat 'A' on the cover.
billy - who went to UT - volunteer is NOT a dirty word
How to determine the height of a building with a barometer. Sell the barometer. Buy equipment suitable for measuring the height of a building.
You're trying to solve the problem with the tools you have. This is not adequate. You need better tools. Talk to other people who run networks. Decide what you need to be able to do your job. Explain the problem to the higher ups. Ask for the right to do certain things to protect the network.