When Exactly Is One Infected In A Drive By? And What Do Ya'll Tell Your Customers/Bosses?
Hey All.
Had two drive by's of the Personal Anti Virus occur this week. CE 10 (most current version of this product and currently supported by Symantec) didn't even blink. And, from what I've been reading, EP latest incarnation doesn't blink either.
On the one system, the PAV was completely installed. Had desktop icon, system tray icon and looked really good as a GUI. Aero interface and all. The only way that one could tell this wasn't a legit app was all the broken english. This system was horked. The app installed and on a reboot disco'd from the network it still loaded into sys tray and was loadable via a desktop icon.
On the second system after speaking with the end user, they stated that they visited a google search link, and immediately upon arrival was told they were infected with a trojan. They were told to "click here" to fix the problem. This user did not click and instead, shut down their computer. On inspection of this box, there was nothing showing that would indicate an infection. A full scan of the box on with Symantec 10 (as referenced above) showed nothing.
So food for thought here .....
- Roger Grimes has stated that if any malware shows on a PC that one should format and reinstall. That once malware is in place one can never be sure that it is cleaned 100%. In the 1st PC case, malware for certain is in place. Should one wipe this system? Hey, if Symantec EP can't detect this stuff (as noted in an earlier post) why the heck even bother with trying to clean this PC?
- On the second system, there would appear to be no infection. But, how can one be certain? In the case of this system. if this was one of your customers and that client was a financial advisor with lots of sensitive data passing in and out of that PC, how would you advise that clients ownership group?
- How on a totally patched system does a drive by happen? Even if one took away local box admin rights, I understand that wihin the security context of the local docs\settings folder structure that malware can be written to exercise the user rights in that folder to do it's dirty work. So, in the end what is one to do? is this a hopeless cause?
So, I guess the main question is, on box #2 do you wipe or assume all is well?
I must admit that after years of working in this industry I am WEARY of the Internet. It seems that allowing users to access the internet even on boxes that have restricted local admin rights is a VERY RISKY ADVENTURE these days.
User education? Don't make me barf!
Internet Not safe anymore
Internet is not safe any more google not at all safe..
3 out of 10 results will point to malicious/Compromised site
tons and tons or mailicious files are loaded on the internet daily..which is unknowingly downloaded by the people worldwide..When a malicious file is created they make sure no one is detecting it ( atleast not the famous ones )
If any Antivirus would have been 100% safe these botnets wouldn't have been so much hit in the recent times..
Now coming to SEP..there have been lots of posts on PAV..
do you really think SEP doesn't detect any PAV variants...
I can quarantee daily many PAV's samples are being submitted to Symantec security response some by Customers/Tech Support/Symantec Sensors etc..
but every hour they come up witha new variants..the PAV authors are working in more speed than AV companies its just because they want to earn from this software..
However I agree that if your system is once compromised it can never be trusted..
However if you plan to re-image the PC..always make it a best practise to submit the threat to Symantec security response at https://submit.symantec.com/basic / essential depending on your contract.
So that you cannot be infected with the same one in the future..i.e. you ( or anybody on the unsafe internet ) wont have to re-image any other PC because of the same files..
Now coming on your second computer--u cannot go by users word..
Last night even i was hit by a similar threat on my production system in office..I disconnected the LAN immideate..still i was able to find 2-3 exe's in my content.IE and %temp% and and 2-3 DLL's lying here and there..well i ran rapidrelease defs did a scan..all were detected..
Then wheni further analysed it had created about 100 services...which i had to remove manually ( it was only services entry no sys file was found on the system ).
So you never know what all has been downloaded on your system..if you want you can run some rapidrelease and freewares to find it if really it downloaded something..or if its possible just go ahead and re-image it..
Celebrating 2 years as a community member....
Some cannon fodder :)
" Roger Grimes has stated that if any malware shows on a PC that one should format and reinstall. That once malware is in place one can never be sure that it is cleaned 100%. In the 1st PC case, malware for certain is in place. Should one wipe this system? Hey, if Symantec EP can't detect this stuff (as noted in an earlier post) why the heck even bother with trying to clean this PC?"
>> Rightly said, but he overlooks one fact. If you simply go ahead and reimage the system, chances are that the malware that infected your PC(s) might be detected too late in order to have an effective response to it. Best option, if you have a threat, submit it to Security response and get it detected as well.
Even with a fully patched system if the threat is infecting, chances are that it's a possible new variant / offshoot program of the existing threat out in thw wild that IS BEING DETECTED.
With the limited user rights option enabled, we actually dont take away the rights of the users to be able to change wall papers and / or install BHO's (Browser Helper Objects). In such a case, this particular threat loads itself as a Wallpaper and persistently loaded desktop icon by creating entries in the HKLM\System\.....\Currentversion\Run and setting a seemingly legit DLL / OCX file to rename itself to EXE and execute and create the icons / other stuff.
Furthermore, this is just the tip of the iceberg. The actual threat is not yet present on your system(s). When the user clicks on Scan Now or something sililar, thats when the actual payload is doanloaded in the form of seemingly innocuous updates or accitional files required for the program to work, and these execute immediately on coming onto the system, and create several other load points / trigger points that again download the payload time and again in case we delete one part of it. This is done by creating several additional entries in the registry.
Unless the parent payload file is determined and dealt with, the system is actually never free from the threat.
HTH
Abhishek Pradhan, MCT, PMP
ISMS Internal Auditor (ISO 27001), SIG Lead - Microsoft Pune User Group
http://hackatac.blogspot.com | http://www.puneusergroup.org
"You can always spot a happy biker by the bugs in his teeth....."
My thoughts
Personally I always tell people security is a layered apporach and any AV product is the last line of defence. I would recommend a URL filter that provides frequent updates to some security categories. Websense does a pretty good job on this. Also making sure machines and applications are fully patched and up to date. If the threat uses an exploit to get in and the exploit is not there it can't get in. Having users unable to install applictations helps prevents them from accidently doing something bad while it will not prevent everything it does help. Also user education plays a part making them aware of the stupid things people do.
Rick. Of these systems, one
Rick.
Of these systems, one was fully patched for all software installed. On this system we have been given the go ahead to manage all aspects. So, monthly we verify that all patches are in place with the secunia software program. This was the system I refer to where the user stopped and restarted. That seems to be OK.
On the other system, we manage MS updates using WSUS, but, the client has not taken us up on managing 3rd party apps. So, I know that Flash, reader and Java were flawed on this system when it was hacked. This was the system that for sure was hacked and that we wiped clean. Note, not a reimage, but a delpart // fdisk/mbr and then reinsstall.
Still is seems though two things:
1) How on a system that is fully patched does a drive by occur? And, is there really anything that can be done to stop this? It seems to me that short of a whitelist that a user is no longer safe on the internet.
2) Does one wipe the system that seems to be OK, but was prompted with the initial PAV lead in. That is visited a link that then prompted them that they are infected and to click here to fix.
My suggestion to clients is
My suggestion to clients is to update windows and other software also which are installed.
Nothing can make you 100%
Nothing can make you 100% secure on internet.Threats use Social Engineering to drive by..
Some link that user will be forced/lured to click on.
Once he clicks on the links its not more Exploit.Now it uses the Logged in user priviledge to come in.,
There are threats which loook for vulnerablility and exploit them..but if the user is clicking on some link and telling it to install ( un-intentionally ) it won't need a vulnerability..
For every Fake AV PAV ,AV360, etc etc...they all use the same technique to lure and scare users that they are already infected..then you click on YES it will start installing the exe's on your computer.
SOmetimes the files will be download to your computer but you will have to click on some pop-up to install them on your computer...Sometimes once you click on a link they start installing them on your computer using some vulnerability like IE or Flash etc..
Celebrating 2 years as a community member....
Re
Most of the websites today scam people so that they can track the users activity for their research. So one of the best thing to do is to educate the users.
For administrators, teach them the flow of SEP from the start (e.g. installation of av, virus infection, virus submission etc..)
You need additional security
You need additional security to protect yourself against malicous code on the internet. To get rid of viruses nowadays usually demands a lot of work. The real trick is to make sure you do not get any viruses in the first place.
Using a proxy solves this issue pretty well especially if it is bought by an external provider that will scan all sites before allowing them to be accessed by a user. Any site that is not reliable (or not up to code by a predefined filter) will be blocked for the user. This proxy can be installed in a way that it cannot be removed by the user and will be active also if they change network to an unprotected network like home office or internet cafe.
Security
you need lyered security approach
Network Firewall
gateway Proxy+Antivirus+Content Scanning
Then Host based HIPS and Antivirus.
you need to block unwanted websites and monitor user habbits.
So, my understanding then on
So, my understanding then on this is that we need to have all internet content reviewed before we allow user to get to the url they have requested? Anyone have suggestions on a good proxy, content scanner and HIPS system?
A second thought on this is, are these systems automated in the sense that the filters are automatically updated? And is the automater a 3rd party vendor and not myself :-)
Is it legal to monitor user browsing?
SEP is the best HIPS ... (
SEP is the best HIPS ... ( host based intrution prevention system ) in the Network threat Protection feature..
For Symantec has a Gateway antivirus which also does Content Scanning...i am not sure about its Proxy capabilities though..they best way would be to get in contact with Symantec Customer Care..
These products get the automatic updates for URL monitoring and blocking Websense has a good name..
Celebrating 2 years as a community member....
Yes, the proxy is automated
You do not need to administrate it if you do not want but then you might get blocked from access to legitimate sites. This is the downfall with automated services that they are not perfect. But nowadays they are pretty good so that it will not cause you to do to much unnecessary work.
Check out www.scansafe.com (example of external proxy solution). I am not sure if Symantec yet has a similar service. Anyone?
Would you like to reply?
Login or Register to post your comment.