Handling Viruses in an Uncontrolled Network?

An anonymous reader asks: "Recently I've gotten a (volunteer) job looking after a small (approximately 500 computer) network, located within a large block of student flats. We've been having numerous problems with viruses over a few years. They spread like crazy on our network, with 100megabit connections in every residents room. Every so often they 'go off' and start a flood, which of course takes the entire residence network down. I've tried desperately to educate users on the virus problem, but those that are the problem don't care - they ignore every warning they get and just buy a faster computer to compensate for their systems sluggishness. As we only need two or three ping flooding computers to bring down the network it's hard to keep our network up whenever a worm starts its payload. What solutions have Slashdot readers came up with this and similar problems?" "Keep in mind that I'm doing this on a volunteer basis, and that my own study time and personal life takes first priority. The residence isn't prepared to spend more money bringing help or a replacement in, which I can understand given that I pay them rent that I would prefer not to increase. I also don't have any control over the network infrastructure itself, just over our DHCP server. I can't force users to keep their computers safe, as I don't own the things - all it seems I can do is point them to the *FREE!* virus scanner and local Windows update mirror and urge them to protect their computer, and offer to help out those that need it - (although due to time constraints, personally helping out everyone in a 500 member network isn't a possibility).

I can also email off a request to have certain IPs dropped off at the switch, but those users have to come back online soon enough. Whenever someone is infected I try and sit them down and make them realize that keeping their computer safe is their responsibility, and they always seem very attentive whenever we're discussing when they get reconnected to the network, but soon after they'll be infected again."

Comments

Is this really that hard?

[Scott Lockwood]

Hm... Seems pretty simple to me.

1. Have someone at the school make them sign something that says they will have virus protection and spyware protection on their machines, and that it be kept up to date. Failure to keep the machine clean can result in suspention of service at any time.
   
2. When one of them has an infected machine that starts pinging the shit out of your network, Unplug them!
   
3. Point to document mentioned in step 1 above when they start whinging about it.
   

There see, that wasn't too hard!

Re:Is this really that hard?

[_Sharp'r_]

Or slightly faster:

1. IDS set to trigger on specific patterns and events (if you have been seeing this stuff on your network constantly, you'll know what to look for already.), you can even set some up free using FOSS.
2. the IDS alerts then trigger shutting down their switch port and notify an admin. Depending on your switch port mapping database, you can even email the user.
3. See Scott's post above for signature/cleaning cycle.

Re:Is this really that hard?

[Anonymous Coward]

Have someone at the school make them sign something that says they will have virus protection and spyware protection on their machines, and that it be kept up to date.

The problem with that, is that nobody should care whether or not you have virus protection -- the thing they should care about, is whether or not you run viruses (and that they are noisy viruses that create traffic on the network). If a user doesn't have a policy that running viruses is ok, then that user doesn't need virus protection. So telling them that they're required to run some type of arbitrary, and possibly completely useless software, is draconian. It's inappropriate micromanagement.

The virus' network activity should be the sole criterion, not the users' methods of preventing it. Users should be allowed to avoid viruses however they see fit.

Re:Is this really that hard?

[Anonymous Coward]

But theproblem is these are students and they have work to do. by pulling their plug you are not allowing them to get the work done that they are I presume there to do. So thats not an option.

That's like saying you can't take a drunk driver's license away, because he needs it to drive to work.

His "need" is his problem, not yours. He should have thought about that, before he decided to engage in activity that threatened other people.

Fuck this whole "buy more filters" thing. Place the burden on the users, and then users who behave intelligently, won't have any burden. That is the fair thing to do.

Re:Is this really that hard?

[Chyeld]

To put this politely, if they can't be bothered to keep their system clean, they can't have access to the free network.

To say that 'they have work that must be done' is ignoring the fact that the umpteen (insert hyperbolic number) other users ALSO have work to that must be done and in this case the good of the many out weighs the good of the few or one (damn, did I actually find a good excuse to use that line?).

Yes, by all means, research methods to contain and control any outbreaks to reduce the issue when they do occur; but in this case prevention is far, far, more effective than mitigation.

Re:Is this really that hard?

[BlueJay465]

I have a better solution: become a BOFH, get your hands on a used LART, learn how to properly use it, and the students will be eating out of your hand in no time.

If that doesn't work, have a little chat with the Admin, present the security scenario, and ask to yank the plug on any offending machine as a security threat. Corporations in the real world don't tolerate unsecure boxen, why should the school? Students will learn VERY quick not to cross you.

Re:Is this really that hard?

[Houkster]

His "need" is his problem, not yours. He should have thought about that, before he decided to engage in activity that threatened other people.

I have to agree.

The IT mantra should be: "Lack of planning on your part does not nessecarily constitute an emergancy on mine."

A better example though would be: Imagine, your car has a blown gasket spewing smoke all over the road and is barely moving under its own power, then add all 4 tires are flat further impeeding your movement. Would you keep driving it cause you had to get to work? Would you be pissed at the cop who pulls you over because your car is causing a 10 mile traffic jam on the 405?

Need I say anything more to get the point across?

3 Strikes policy?

[fahrvergnugen]

It sounds like you've been completely neutered. If at all possible, talk to the administration about instituting a "3 strikes" policy. That is, if someone's computer causes a network-wide issue 3 times, their network drop stops working for the remained of the year.

That'll clean their acts up in a hurry, or at least make your life easy.

Move out?

[Eezy Bordone]

Seriously, volunteering to be THE on-site tech support for 500+ users is insane, especially since you're not even getting a discount on your housing. Quit the job or move out so you can worry about your own network.

Ban them

[nadamsieee]

Isolate the computers that are spreading the virus and shut down their access to the DHCP server based on their MAC address. Then make the reconnect process as painful (yet educational) as possible. >:)

Re:Ban them

[morcego]

I'm sorry, but I always thought that painful is by itself rated educational: "Don't mess with the netadmin".

Serious now, I have been administering networks for about 15 years now (a lot less than many people on /., I know), but one thing is for sure. Unless your userbase respects you, there isn't anything you can do. The way to institute that degree of respect will change from network to network. Sometimes it takes a message from a company director, sometimes it take imposing fines for people breaking the rules. Sometimes, all it takes is to let the network crash and burn, so they can see that network administration is important, and it is up to THEM to have it working.

Seems simple enough.

[FyRE666]

If you can't put the bad users on a slow switch, and force them through an even slower proxy to make their life hell, then see if you can't organise a minimum disconnection period. Say 10 days or so to reconnect the idiots who keep getting infected. Since you control the dhcp server, you could filter them out by their mac address so they can't wander over to someone elses room to connect. Yes, they could probably circumvent this with a little knowhow, but let's face it, an idiot who's managing to become a virus writer's bitch every week isn't likely to have too much in the way of technical knowledge...

Wasting your time

[ibpooks]

It really sounds like you're wasting your time.

You don't have control over the users, the machines, or the routers; so what the hell can you expect to do?

Sounds like the best option is to unplug the offending machines from the patch panel until they can demonstrate they are virus-free. Although that is likely not a viable solution if these are paying customers.

Re:Wasting your time

[Knara]

It can be viable if the students had to sign an AUP from the campus IT department when they moved in (which I get the feeling is fairly common these days on major campuses). Worked at a place where they just turned off the switch port of offending machines, and then if the student wanted to get access back, they had to call in to the help desk and go through the process of setting up a schedule technician visit, which may be pretty far off depending on the time of year.

Was kinda hairy the first couple weeks of fall semester for the techs and the helpdesk (which will happen no matter what), but very few repeat offenders.

Stop volunteering

[lelitsch]

Seriously, it seem like this is an unsolvable problem and neither the users nor the administration seem to want to spend any effort in fixing it. So the sooner you realize that there is nothing you can do, the better. Help out with the IT system at your local Humane Society, womens shelter, or similar instead.

Oh, and get your own DSL or cable modem.

Simple.

[grasshoppa]

You need more power. Otherwise you will fail in your job ( unless you take to violence ).

Students need to be kicked off the network until their computers are clean. If they are kicked off x times, they are off until they come to you and sign a form saying they understand how to keep their computer clean. y more time(s), they are off for the rest of the semester.

Simple, effective. You will need a couple decent switchs capable of shuting down ports ( or you could just yank the wire ).

If you don't have this level of power over the network, get rid of any access you do have. The higher ups only want a scape goat.

Stage virus drills

[bigtallmofo]

Send them emails with executable attachments. If they click on the attachments, ban them from the network for a week.

Send these out frequently. Soon they'll instinctually hit the DEL key when something with an attachment comes in.

It's just terms of service

[WebCowboy]

But the problem is these are students and they have work to do.

So what? Crap happens...virus ate your thesis, power went out, printer ran out of ink, blah blah blah. Thing is that if you are a responsible person you have contingencies in place to minimise or eliminate the impact of such incidents. If the work is important, you keep backups, spare ink cartriges, update your antivirus, OS, apps, etc...and most importantly you don't procrastinate to the point where you are in crisis mode. If you don't do all of the above then you should be prepared to follow Murphy's Law. If a mishap is unavoidable, you could be granted an extension.

Thing is, it is standard practice for net admins EVERYWHERE to pull the plug at their discretion should your computer be found to causing network disruption. Taht is a standard condition of almost all terms of service. My ISP would knock you off very quickly should they discover an open mail relay, ping flood or other unusual level of activity, and I pay extra for business-grade service. I agree with other posters here--this guy should put in some F/OSS tools to help manage these problems, and immediately terminate all network connectivity of infected machines ASAP.

"I have work to do" be damned. Seriously. Part of growing up and going to school is to learn--and people have to learn the consequences of their actions or inactions--that's life. You have to keep your house clean, pay your bills on time, obey the speed limit and traffic signals, etc. If you don't there are negative consequences. Same goes for PC use: ignoring the TOS, not updating your machine, downloading comet cursors and talking gorillas and chat icons and P2P warez is just inviting trouble. Users who repeatedly do those things despite warnings deserve no sympathy at all and should recieve all the wrath the BOFH can deliver.

Ok....

[Audacious]

We've heard from the:

1. "It can't be done" crowd.
2. "Be tough about it" crowd.
3. "Go behind their backs" crowd.

and others....

How about this:

1. Get everyone's e-mail address so you can send all of them e-mail at the same time. How do you do that? Ask them to e-mail you - that's how. Of course, disinfect anything they send you because they probably will have a virus or two.

1a. How do you get all of them to send you the e-mail? Go buy some of those blank business card sheets (Avery I believe makes these), print up your message, get someone to help you break them apart, and then just tape them to each person's door. In this way you: 1)Don't have to talk to them, 2)Don't try to force them to do what they don't want to do, and 3)Can do it on your own time (like on a floor-by-floor basis). Cost: Probably about $10.00.

1b. Your message? It should be something like:

Dormitory SysAdmin needs your help!
We need your e-mail address as we
are trying to remove viruses and want
to be able to keep you informed. Thanks!
myemailaddress@thedorms.edu

1c. Put notices on doors leading into the dorm and/or bulletin boards also asking for e-mail addresses. If you can, have someone hand the things out to people as they come in and out of the dorms.

2. Set up a blog where everyone can meet and talk about problems. Use the e-mail addresses to send your notice out about the blog and how to access it.

3. Set up appointments with people to meet with them to show them how to protect their system from viruses, ads, cookies, and other problems.

Ok, let's say you've gotten some responses and want to start to go to other people's rooms to help them out. You want to:

4. Use the scheduler built in to every operating system currently in use (ie: Mac OS X, Windows98se and up, Linux, BSD, Solaris, etc...). For those OSs which are older (although I can't see anyone currently in college using an Apple ][+ or even Mac OS 9.x or earlier) download and bring with you some sort of a scheduler. (Even the Apple //gs had a CRONTAB program!). Set their machine up so it automatically, every day, trys to download the latest and greatest updates for the OS, SpyBot, AdAware (or whatever you use), your virus protection program, etc.... The MOST IMPORTANT THING THOUGH - is to always explain what it is you are doing to the person's computer. Don't just dump a bunch of things onto their system. Bring a flyer that explains what it is you are doing and why. Set their system up so they can win and so they don't have to rely on you to be there to make everything function correctly. All of the virus/cookie/ad checking software out there can be set up to function on its own. Some of them (like most virus checkers) have their own scheduling software built in.

4a. NOW! Here is the important thing! Set the virus/ad/cookie (or VAC for short) to AUTOMATICALLY e-mail you with the results. This too can be done via the scheduler. Give the automatically generated e-mail a special header (like [VIRUS|AD|COOKIE] REPORT FOR ROOM X). There are e-mailer programs for all operating systems which run from the command line. So just make a little batch program/shell script to create your report and e-mail it to you. Again, write it all down in the flyer you are going to give them so they don't freak when their system suddenly starts doing things (like checking for viruses or sending e-mail).

4b. Most virus software's report will read "VIRUS FOUND" and then tell you where and when the virus was found. Write yourself a short Perl/PHP/C/ script which will read these e-mails and sort out which one have viruses and which ones don't have them. Since you made the title have the room number on it - you automatically know who is having problems. So you can e-mail them back and set up a time to go over to fix any problems they might be having. Further, you can produce statistics on where the greatest problems are and post these fi

Re:Simple.

[jemenake]

You need more power. Otherwise you will fail in your job

Just about all of the posts thus far have been along the lines of "Pull the plug on the people who don't care until they *do* care.... IF the administration will let you."

Here's an alternative to the "IF the administration will let you" part. Make use of the fact that nobody else really understands what it is the wizard (you) does behind the curtain:

Implement whatever service termination solution you feel necessary (whether by writing/downloading some automated system, or by doing it manually yourself). When the offender calls to complain, *don't* say that they were shut off administratively. Tell them that the massive traffic from their machine "overloaded" the port they were on (tell them it's kinda like a circuit breaker on house wiring).

They'll say that this never happened before. Tell them that they've got a newer, more-aggressive virus.

They'll ask that their port be "reset". Tell them that, due to all of the machines that they helped infect, and to the convoluted process for "resetting" a port, there's a backlog of a couple days before you can get their port reset.

Maybe they'll ask if you can just plug them into a different port. Tell them that they're all maxxed out.

At some point, Administration might ask why this is happening. Tell them the same thing you told the users... new, nastier viruses. They might ask what new equipment they could get to fix the problem. Tell them that the BFS-9000 can do it... but it's very... very expensive. It would be much cheaper for everyone to just use virus protection.

You are NOT punishing the wrong person.

[arete]

You should certainly punish the virus writers, if you can catch them. And you should possibly punish M$ for how big of a hole IE still is, even if Windows itself is better than it used to be. But none of that matters.

To use society's resources, you have to follow society's rules. I can go buy any car I want and drive it at 200 mph - on my own track. But if I want to drive on streets I have to follow the rules, as they apply to my actions (hitting things) even when they may not necessarily have a direct negative impact (speeding, driving on the sidewalks) have only a paper impact (licensing, insurance, registration) or only a preventative impact (headlights, brake lights...)

I can also go buy a used car and have the brakes suddenly fail, running over someone's garden. Note that even if I didn't know, I'm still responsible for the cost of that garden, (unless I JUST bought it and can pass the blame to the previous owner) If the brakes were recalled, it's still my fault for not getting them fixed. If they WEREN'T recalled, but should've been, then that's not my fault.

If you're already providing appropriate, simple, free, publicized resources _that they didn't use_ they are being negligent at best. Kicking them off until sometime after they fix it is a MINIMUM penalty for such negligence.

Argueably they should have to pay for the cost of your time to fix their computer (mandatory since they didn't do it the first time) and to repair any problems caused by their problem - and STILL be penalized in terms of being online.

(Personally I believe that a kick-until-fixed first warning is probably a necessary threshold of publicity - but even the second time they aren't listening I think it'd be very reasonable to escalate it.)

To be clear, I don't think it's reasonable in today's world to hold them accountable for anything their computer does. I think it's NECESSARY to hold them accountable for not following your security procedures to defend against it. Which means you're still going to be snuffed by the virus that exploits the OS hole noone has put out a patch for yet - and I wouldn't blame that on the first kid to get it.

I agree with the other posts - you have to get kick/ban/unplug authority, you have to quit, and/or you have to get paid. 1 of those might do...