Extension 437

Anatomy of a blended threat

Trojan.Ascetic.C

This is the first virus I have had to deal with at a Scheduled Support client.

It is a good example of a blended threat--that is, it's not a hacker, not a worm but a little of both. Here's how I think it worked at my client:

Part 1: Vulnerability is created.

1. Hard drive crashes on PC.
2. Office manager replaces hard drive and reinstalls Windows along with any needed applications--except for antivirus software.

Part 2: Security incident occurs.

1. Some time later user receives spam-type message, possibly innocuous-looking, possibly purporting to be from a friend.
2. User clicks through to the Web site linked from the email. Web site exploits a vulnerability in IE to install a trojan horse spam engine on her PC.
3. Constituents, board members, staff, receive tons of spam messages from PC. Complaints flood in.

Part 3: Response to security incident.

1. Office manager spot-checks computers and discovers this one does not have anti-virus software.
2. She tries to install the anti-virus software from the installer located on the server, but could not because she was confused by the options in the installer menu.
3. She uses the free online Trend Micro online virus scan, which consistently mis-identifies the infection and declares each time that it has been removed.
4. Upon installing SAVCE and running a scan, no virus is found. But we're still suspicious.
5. Using Autoruns from Sysinternals we check the programs that are set to start up automatically and find one that looks legit but is not. The process cannot be killed from the Task Manager.
6. Removing the autorun from the list and restarting kills the process (pskill.exe from Sysinternals would also do it).
7. Now running the scan with SAVCE locates and quarantines the virus.
8. Now that we know what the virus really is we're able to get more information from the Symantec Web site.
9. We discover that the trojan normally would have made some changes to the HKEY_LOCAL_MACHINE portion of the registry, but since this user (like most of the people on networks I administer) did not have admin rights on her computer, those entries were not created. For all the good that did. But it still is a good example of why I recommend users run with reduced rights.

Part 4: Remediation of security measures

There are a few things that could be done to prevent a recurrence of an incident like this.

1. Regular audit of anti-virus installations to ensure complete coverage.
2. Implementing a filtering web proxy (such as Websense) to prohibit visits to malicious sites.
3. Improving the security of Internet Explorer through Group Policy, or moving to a less-targeted browser such as Firefox.
4. Behavior modification and training for end users to reduce liklihood of clicking through to malicious Web sites.

We'll try to implement the first one. Whether the other steps are taken or not is up to the client.

Desktop Security article at Microsoft

Microsoft offers a TechNet article on managing desktop security.

"Set up a digital defense that will help you enhance the security of a primary gateway to your company: its desktops. Find information on how to better protect your company's desktops against external and internal threats."

Link: Desktop Security.

CryptBruce Schneier on Safe Personal Computing

Bruce offers an intimidating list of challenges faced by home users. Comments by other readers offer further insight:

"I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually "Nothing; you're screwed." But it's really more complicated than that."

Link: Crypto-Gram: May 15, 2001.

Free security training from Microsoft

Microsoft is offering free training on how to use their products in a secure fashion. Both online clinics and hands-on labs are available.

Link: Security Clinics & Labs.

Enforcing password policy compliance

So let's say that your organization has a password policy. Passwords must be of this length, must include certain characters, etc. Maybe the policy is even enforced by a software policy on your Windows domain controller. But how do you know those passwords are actually secure?

One way is for someone tasked with responsibility for information technology to try and break them. If it's too easy to break the passwords, they're not secure enough! This sort of password auditing should only be performed by an authorized person with responsibility for computer security.

LophtCrack can perform passwords audits of this nature. LC 5 is offered by computer security firm @stake, which was acquired last October by Symantec.