RE: IE Malware / Spyware Control Methods

From: King, Stephen (sking_at_chnct.org)
Date: 01/08/05

  • Next message: gadgeteer_at_elegantinnovations.org: "Re: IE Malware / Spyware Control Methods" 
    Date: Fri, 7 Jan 2005 23:00:16 -0500
To: "Chris Krough" <ckrough@vet.upenn.edu>

    From a preventive standpoint I would check out Faronics FreezeX and
    Deepfreeze. Both are workstation solutions. FreezeX basically builds a
    database of authorized executables. Here's how it works: First you make
    sure the workstation is clean of any malware. Run FreezeX and it builds
    a database of all executable program codes like exe, bat, java, dlls and
    so on. With FreezeX on only the authorized executables in the database
    are allowed to run. Any malware that may enter the computer can not
    execute because its not in the database to do so. Likewise you can't
    install legitimate software without first turning FreezeX off. It's very
    effective with Spyware that can not be picked-up with traditional virus
    checking and spyware checking tools. You save a ton of admin time.

    DeepFreeze another product from Faronics works much differently. Here's
    how it works: First, ensure you have a clean machine configured the way
    you want it. Install DeepFreeze and it freezes the partition. Once in
    the frozen state your end-users can mess with anything that you would
    normally would cringe to but, once the machine is rebooted, its back to
    its original state no matter what. The only drawback is end-users will
    assume they are saving legitimate things locally like files in MY
    Documents and it will appear to do so. But when they reboot everything
    will be lost. The solution is to configure the workstation with two
    partitions. The main partition (C:) is your system files and programs.
    This can be frozen. The second partition (D:) drive can be unfrozen and
    used for file storage and so forth. You can redirect program user files
    by using the Microsoft TWEAK utility. I use both programs, and once you
    set your work stations up and you have good images, its a breeze.

    The amount of time your IT staff will save is astounding. Prevention
    over detection is my motto. Check out their website and see more specs
    on these products. They also have Deepfreeze for servers. Now I can be
    sure of the integrity of my system files at the flick of a reboot. Both
    products have an administrative consoles so you can unfreeze multiple
    machines at once to do software updates or application installs.

    Stephen King, CISSP, MCSE
    Information Security Officer
    Community Health Network of Connecticut, Inc.
    11 Fairfield Boulevard
    Wallingford, CT 06492

    Direct: (203) 949-4065
    Fax: (203) 265-3533

    www.chnct.org
    Email: sking@chnct.org

    -----Original Message-----
    From: Chris Krough [mailto:ckrough@vet.upenn.edu]
    Sent: Friday, January 07, 2005 3:07 PM
    Cc: incidents@securityfocus.com
    Subject: Re: IE Malware / Spyware Control Methods

    Following the concept of least privilege is very effective at preventing

    spyware installation. We've reduced the access level of most of our
    users to 'Domain User'. For users who require frequent administrative
    access we provide them with a secondary, preferably local only,
    administrative account. For users with occasional administrative needs
    we either upgrade their account temporarily or just perform the
    installation/changes ourselves. This practice has almost completely
    eliminated spyware problems from our network.

    Depending on your users needs there is a good chance that lowering
    default account privileges will increase the load on your support staff.

    Installations and low-level configuration changes will require attention

    from someone with administrative privileges but the time saved over
    handling spyware/virus incidents is greater.

    Have you upgraded your clients to XP SP2?

    Illuminatus Master wrote:
    > Hello List,
    > I'm sure you all realize the growing threat of malware and spyware to

    > Internet Explorer. It has been my experience that the initial
    > infection and/or removel of an infection by anti-spyware products can
    > permanently damage a windows workstation. This damage occurs in many
    > forms and often leads too the workstation being reformatted and
    > rebuilt before going back into service.
    >
    > A recent example is earlier this week, in spite of content filtering,
    > a workstation was infected with "wintools", "mysearchtoolbar" etc. The

    > tough part of this is that such malware has multiple instances/threads

    > and renames system files like msconfig to resist removal. Often
    > IE/Windows is so damaged it's more time effiecient to just replace the

    > box and rebuild the infected one.
    >
    > My question is this, I'm batting around the idea of using Group Policy

    > in our Active Directory to try and choke IE down to the point where
    > such Malware has trouble installing itself. Has anyone here ever tried

    > such as this with any degree of success?
    >
    > Other than Group Policy I'm also considering deploying an alternate
    > web browser that isnt subject to malware infection but doing so
    > complicates my patching/reporting routine for our security audits.
    >
    > I look forward to your comments and idea's.
    >
    > Thanks,
    > massa

  • Next message: gadgeteer_at_elegantinnovations.org: "Re: IE Malware / Spyware Control Methods"