M$ Says Recovery from Malware Becoming Impossible Options

[dauss]

http://www.eweek.com/article2/0,1895,1945808,00.asp

LAKE BUENA VISTA, Fla.—In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed.

He cited a recent instance where an unnamed branch of the U.S. government struggled with malware infestations on more than 2,000 client machines. "In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden. They had to design a process real fast," Danseglio added.

Danseglio, who delivered two separate presentations at the conference—one on threats and countermeasures to defend against malware infestations in Windows, and the other on the frightening world on Windows rootkits—said anti-virus software is getting better at detecting and removing the latest threats, but for some sophisticated forms of malware, he conceded that the cleanup process is "just way too hard."

.....

[zetec]

Re-imaging 10 machines ? No biggie !


100 ?


Try networks with over 10k client PCs.


Not impossible, but this isn't something that can just happen overnight. (sidenote : hi my name is rocky and im currently on a project of doing just this)

The problems are easy : users are idiots. You can rebuild your workstations and get everybody off to a clean slate, but then people are just going to fuck everything up again.

Spyware, malware, trojans, blah blah blahhh are all smarter than most simple users, so to prevent yourself from having your network turn to shit, people really need to crack down harder on their protective measures. Running a corporate Antivirus product isn't going to just do everything.


It will take more people using shit like Bluecoat proxies and truly utilizing their power, as well as having clean PC builds that are tweaked to hell, as well as god knows what else to be safe.

The fact of the matter is, the best way to help keep businesses from having their PCs goin to shit, is to lock things down as much as possible.

pxe: do it all over the ethernet. Takes a while, but requires no involvement at all.


i think the best method is to set up the users on locked down custom-compiled linux boxes with easy to use GUIs that are similar to windows. Most of them won't know how to fuck them up, most methods of fucking them up won't work, etc etc.

granted there's lots of reasons why that won't work, but meh.