Slashdot Mirror

← Back to Stories (view on slashdot.org)

How To Avoid a Botnet Infection?

Posted by CmdrTaco on from the yeah-good-luck-with-that dept.

Taco Cowboy writes "Two of the networks in the company I work for have been zombified by different botnets. They are taken off the grid as we speak. We thought we had taken precautions against infection, such as firewall and anti-viral programs, but for some reasons we have failed. Is there any list of precautionary steps available?" I'd suggest port blocking 80 for any computer that is detected running a web browser, but that might prevent some percentage of legitimate work.

25 of 396 comments (clear)

  1. Yeah... by Pojut · · Score: 5, Insightful

    ...I'm going to go ahead and guess the general answer most people around here are going to give.

    Linux or OSX.

    AmIright?

    --
    Living With a Nerd
    1. Re:Yeah... by Magorak · · Score: 2, Insightful

      Unfortunately you are probably right.

      --
      No matter how fast computers get, you'll always be waiting - Matt Klem
    2. Re:Yeah... by beh · · Score: 5, Insightful

      Yep, most people will say that - even though I had one of my machines broken into years ago - even though it was a linux machine... Even though it *should* have been secure, but I had been somewhat lax in keeping it updated, and hence might have left a potential door open for an attacker due to that, simply by believing linux would have been secure enough.

      But, yes, that would never stand in the way of most people saying 'linux would solve this'. I think more proactive monitoring and regular application of security fixes, etc. would help.
      Another thing that might help, is IF you need to leave users with a web-browser, try and install them in a way that the browsers are properly sandboxed. (yeah, yeah, yeah - I know 'firefox'/'chrome'/'my-other-non-IE-browsers' are safe... Sorry, I've gone past believing that...)

      I don't think there is an inherently secure OS / OS distro - at least, not beyond the moment it gets any kind of software that goes beyond its default installation...

    3. Re:Yeah... by lordandmaker · · Score: 2, Insightful

      If you really want to be sure you avoid being part of a botnet, then yes, Windows is not one of the choices you have. It cant be secured, its like going down the rapids in a colander while trying to plug the holes with cabbage.

      Thing is, though, *everyone* running Windows treats it as holey, exploitable and generally unsafe. So they apply every security mechanism they can, they bother to audit things, and generally treat it as a dangerous thing that needs attention.

      Too many Linux/OSX users sit there thinking "I use Unix. I have no need for security software". Especially the ones who were sold the idea on the grounds that 'there are no viruses for this'.

    4. Re:Yeah... by jimicus · · Score: 4, Insightful

      We've been hoping for competent users (and trying to educate people into competence) for decades. Hasn't happened yet - probably because the usual result of your computer getting a virus which wasn't automatically blocked is you have a legitimate excuse to do no work until such time as someone can clean up the mess.

    5. Re:Yeah... by Lorien_the_first_one · · Score: 4, Insightful

      Amiga.

      --
      The diversity and expression of human opinion is essential to human survival.
    6. Re:Yeah... by Runaway1956 · · Score: 2, Insightful

      Mod parent to at least +50 insightful. Despite all the bragging that Microsoft and MS fanbois do, the botnets are still constructed with Windows. When that changes, then we can discuss that little issue again.

      Meanwhile, migrate to a more secure operating system.

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    7. Re:Yeah... by fuzzyfuzzyfungus · · Score: 5, Insightful

      I don't buy the "competent users" argument.

      It is definitely the case that incompetence users can cause system compromises. "Ooh, free smilies!"(though, IT should ideally have blocked most of their most common avenues of idiocy.

      However, in a world where you can get compromised just by going to a perfectly legitimate website that happens to be running a flash ad with an embedded zero-day of some flavor, the idea that "competence" is going to save you is an unpleasant mixture of naiveté and adherence to the just-world hypothesis.

      Competence doesn't hurt, and is always a desirable quality; but it is a near-worthless foundation for a security system. First and foremost, there are many attacks from which competence will not save you. Second, and also pretty important, is that any organization of reasonable size is going to contain people hired for their competence in something other than computer security. The pool of people competent in skill X and computer security is always smaller than the pool of people competent in skill X. Even if the former pool is large enough to fulfil your needs, recruiting from it will cost more than recruiting from the entire skill X pool. Competent users are a nice perk, when they happen; but depending on them is folly.

    8. Re:Yeah... by Ploum · · Score: 2, Insightful

      Exactly.

      "The day Linux will have Windows marketshare, it will also have botnets".

      Maybe. But, until that day, use Linux. Currently, you have *a lot* less chances to be infected on a Linux computer. When it will change (if it changes someday), we will reconsider the situation.

      Using a broken system for the sole reason that the proposed replacement might be broken too in the future is, at best, stupid.

      --
      Ploum.net.
    9. Re:Yeah... by TheCarp · · Score: 4, Insightful

      An old boss of mine used to call it the "Soft creamy center security model".

      He was also the one who had us implementing packet filtering on each and every individual box. It was some work, but it was worth it.

      Compartmentalization is good, if you are smart about it.

      Another good analogy is "Defense in depth". Should you have a firewall? Yes. You should also patch regularly, sniff packets with an IDS, packet filter on every machine, run tripwire (or equivalent), have antivirus (on platforms that require it :cough: windows :cough:), seperate users segments from server segments, seperate out a DMZ for services, have a password policy, educate users.

      No one of those things is going to protect you fully. All of them together, has a good chance of making you a far less appealing target with a very unsatisfying and sour center, rather than soft and chewy goodness.

      -Steve

      --
      "I opened my eyes, and everything went dark again"
    10. Re:Yeah... by gparent · · Score: 2, Insightful

      Not that that's MS' problem, but yes.

    11. Re:Yeah... by cbiltcliffe · · Score: 2, Insightful

      But those 90% of incompetents are voters, and vote themselves on.

      That's because each and every one of those 90% that are incompetent thinks that there's actually 90% - 1 that are incompetent.

      Either that, or they're so boneheaded that they don't realize that _anybody's_ actually incompetent.

      That's usually my test for incompetence. If I can't see that 90% of the people trying to do "Activity A" are incompetent, then I have no clue what I'm doing, because I must be one of those 90%.

      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
  2. No by Anonymous Coward · · Score: 5, Insightful

    Stop letting users use your computers or just accept that shit happens was my suggestion. Windows, OS X, or linux. If users touch it, they'll fuck it up.

    1. Re:No by spazdor · · Score: 2, Insightful

      They'll have to install it as a superuser, or else the rootkit will have to exploit a local privilege escalation on the workstation.

      Thoughtful selection of your OS/platform can mitigate this risk. (for instance, what if *all* user activities were done in a virtualbox?)

      --
      DRM: Terminator crops for your mind!
  3. educate by orange47 · · Score: 3, Insightful

    teach all the workers about security. disable autorun on all machines. dont let them run as admins. use noscript and adblock and foxit (or similar). update windows and AV regularly...

  4. block some email attachments and facebook by alen · · Score: 4, Insightful

    where i work we've been blocking a long list of email attachments like exe's and others. few years ago we also started blocking facebook.

      i set it up years ago and don't remember myself. we're all windows and have never been zombified. you can buy all the firewalls you want, but in the end it's still idiots clicking on everything in every email and every link they get sent over facebook and twitter

    1. Re:block some email attachments and facebook by coofercat · · Score: 2, Insightful

      Just a decent email filtering solution would probably do what you want, and not look like you were making unilateral decisions. One place I used to work used MessageLabs, which used to report to me just how frequently people were about to receive something dangerous (which for a 20 people company was surprisingly frequently - and more surprising would be the sales people asking to have something taken out of quarantine because 'it might be useful' when it looked pretty obvious it was spam/scam/malware).

      If you don't like the various vendors doing it for you, then you can do it yourself, but honestly, the quickest win would probably to out-source the work for now and move it in-house later on if you decide you want to.

      I'm not a big fan of these corporate website blockers - however, logging where people go at the firewall can be useful - especially if you find a correlation between infections and the 'colourfulness' of the sites people visit. Of course, you need strong management to actually do something about it. I suspect that taking networks off the Internet is getting you some attention, so it's possible you may be able to direct that attention where it's deserved.

  5. Re:What gets around Firewalls and AVS? by Chrisq · · Score: 3, Insightful

    Well, a firewall is usually configured to let some things in; if you give your users internet access then you are at risk of them downloading a virus form the internet, similarly emails may tempt people to open executable attachments.

    Virus writers are constantly trying to find ways to circumvent antivirus programs. Regularly applying updates helps, but you could still be one of the first people hit by a new virus. Once infected some viruses interfere with AV programs so that they can't be removed even by later versions.

  6. Is it really necessary to ask? by magamiako1 · · Score: 5, Insightful

    It really depends on the size of the companies and the resources they're willing to spend on proper security. You should do a cost analysis of the downtime, not to mention the IT time required to fix the ecosystem. You can do it in waves, and some changes will be more well received than others.

    #1. Don't allow users to be Admins of their own machines. I know in this day and age it's harder to push this one on people, but the ultimate reality is that if the user can't infect the system then they aren't going to get very far.

    #2. Managed, host-based firewalls on each of the machines that have rules for incoming and outgoing. This can be any number of centrally managed tools. if you're on XP, your best solution is likely something from say Symantec, Mcafee, or whichever company you want to use. I know with SEP you can manage the firewall portions and prevent worms from auto spreading.

    #3. Transparent, Layer 7 filtering at the network edge. Whether you want to use a proxy or a firewall for this is up to you. Juniper makes some pretty nice layer 7 devices for this purpose.

    #4. NAC/NAP. Again, useful technologies--prevent systems from communicating on the network that don't register as having proper updates or AV settings.

    These are just some basics, there's probably something entirely different based on the specific method these worms are using to spread. Perhaps a centrally managed website policy that locks systems down a bit more is all that's needed? Maybe keeping things more up-to-date, such as rolling out Windows 7 desktops with IE8?

  7. I hope Taco doesn't work in IT by Blakey+Rat · · Score: 1, Insightful

    I'd suggest port blocking 80 for any computer that is detected running a web browser, but that might prevent some percentage of legitimate work.

    Do you mean web *server*?

    The vast, vast, vast majority of companies are going to need port 80 (and 443) opened. I don't know the last time you stepped into a corporate environment, Taco, but that's how you do your timecard, put your vacation time on the calendar, sometimes how you answer email even.

    --
    Comment of the year
    1. Re:I hope Taco doesn't work in IT by Anonymous Coward · · Score: 1, Insightful

      You missed the vast, vast, vast majority of the joke.

  8. The new meme "Terry Childs approach" by way2trivial · · Score: 5, Insightful

    the only way to secure the system- is don't let anyone into the system

    --
    every day http://en.wikipedia.org/wiki/Special:Random
    1. Re:The new meme "Terry Childs approach" by v1 · · Score: 2, Insightful

      the only way to secure the system- is don't let anyone into the system

      Where is my "+1 insightful" when I need it??!

      --
      I work for the Department of Redundancy Department.
  9. Re:What gets around Firewalls and AVS? by Drethon · · Score: 2, Insightful

    Knowing how to write a basic non-networked application with no memory leaks is not the same as knowing how a bot hacks into an OS. I'll look into that if I ever get hired by M$. Meinwhile there are not too many bots trying to hack into my avionics navigation software (Though with Datalink and similar aplications I'm sure this is coming. Still the OS guy's job, not the flight management and navigation developer's).

  10. Re:Block outbound SMTP by Chris+Mattern · · Score: 2, Insightful

    In my world, if someone takes the time to add formatting to an email, it's usually for good reason and makes it more readable

    In my world, if someone takes the time to add formatting to an email, it's usually to use a really ugly font and add a distracting, busy background that makes my eyes bleed.