M$ Says Recovery from Malware Becoming Impossible Options

[dauss]

http://www.eweek.com/article2/0,1895,1945808,00.asp

LAKE BUENA VISTA, Fla.—In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed.

He cited a recent instance where an unnamed branch of the U.S. government struggled with malware infestations on more than 2,000 client machines. "In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden. They had to design a process real fast," Danseglio added.

Danseglio, who delivered two separate presentations at the conference—one on threats and countermeasures to defend against malware infestations in Windows, and the other on the frightening world on Windows rootkits—said anti-virus software is getting better at detecting and removing the latest threats, but for some sophisticated forms of malware, he conceded that the cleanup process is "just way too hard."

.....

[impala454]

hey dauss, what do you think of this?

[Seussninja]

I think fuck yes, wipe and reloads are the easiest damn things on the planet.

[dauss]

hopefully when the next version of windows comes out, there won't be a problem. I've never really had any problems, but I keep anti-spyware software running, anti-virus, and firewall.

[zetec]

most businesses already have ghosted or cloned images of their drives on backup, and at least one IT guy that knows how to use the "dd" command in linux

[impala454]

yeah and most of the time the PCs in a company that are the most messed up are just some stupid secretary bitch's solitaire machine

[Rocky]

I think fuck yes, wipe and reloads are the easiest damn things on the planet.

Re-imaging 10 machines ? No biggie !


100 ?


Try networks with over 10k client PCs.


Not impossible, but this isn't something that can just happen overnight. (sidenote : hi my name is rocky and im currently on a project of doing just this)

The problems are easy : users are idiots. You can rebuild your workstations and get everybody off to a clean slate, but then people are just going to fuck everything up again.

Spyware, malware, trojans, blah blah blahhh are all smarter than most simple users, so to prevent yourself from having your network turn to shit, people really need to crack down harder on their protective measures. Running a corporate Antivirus product isn't going to just do everything.


It will take more people using shit like Bluecoat proxies and truly utilizing their power, as well as having clean PC builds that are tweaked to hell, as well as god knows what else to be safe.

The fact of the matter is, the best way to help keep businesses from having their PCs goin to shit, is to lock things down as much as possible.

[zetec]

Re-imaging 10 machines ? No biggie !


100 ?


Try networks with over 10k client PCs.


Not impossible, but this isn't something that can just happen overnight. (sidenote : hi my name is rocky and im currently on a project of doing just this)

The problems are easy : users are idiots. You can rebuild your workstations and get everybody off to a clean slate, but then people are just going to fuck everything up again.

Spyware, malware, trojans, blah blah blahhh are all smarter than most simple users, so to prevent yourself from having your network turn to shit, people really need to crack down harder on their protective measures. Running a corporate Antivirus product isn't going to just do everything.


It will take more people using shit like Bluecoat proxies and truly utilizing their power, as well as having clean PC builds that are tweaked to hell, as well as god knows what else to be safe.

The fact of the matter is, the best way to help keep businesses from having their PCs goin to shit, is to lock things down as much as possible.

pxe: do it all over the ethernet. Takes a while, but requires no involvement at all.


i think the best method is to set up the users on locked down custom-compiled linux boxes with easy to use GUIs that are similar to windows. Most of them won't know how to fuck them up, most methods of fucking them up won't work, etc etc.

granted there's lots of reasons why that won't work, but meh.

[Rocky]

Assumption that everybody even has PXE capabilities.


Also, do you seriously understand the logistics of just trying to fire off that many remote installations ? Talk about crippling the network. It's obviously under production from 8-5, but there are more proccesses going on after hours as well.

You can't just switch over to Linux. It sounds so e-cool, but when you have god knows how many millions of dollars of projects nonstop underway that rely on current GIS apps and more that engineering teams are trained to work on under MS environments....not an option.


I'm just tryin to say; its so easy to spout off things about how large networks are dealing with issues like this and more, but its another thing when you actually work with it, and actually are talking about a real network in production.

[Dogmeat]

Any IT manager/tech/whoever who doesn't already have a quick and easy way to restore their users' machines after a crash is a fucking tool.

Christ Norton Ghost, Veritas Backup, there are *TONS* of solutions available for this and it shouldn't take longer than 30 minutes to build a new machine.

Christ even 6 years ago I had a setup to where if a machine wrecked itself or was even acting freaky I would clone a new one, set it up, and have it shipped in less than an hour, and the user would receive it in less than 36 hours ....

I swear to god %90 of the problems with malware, security, etc, are all caused by lazy ass system administrators who don't wanna do tedious preparation work, even though it saves them time in the long run.

[Rocky]

Bootable cds with images can install fast, and if you use something super sexy like Acronis, you can get incredibly fast network speeds and pull down an image quickly as well.

No shit.


The issue isn't restoring a fucked machine - its trying to get a fully clean slate. Every machine.

[Dogmeat]

Bootable cds with images can install fast, and if you use something super sexy like Acronis, you can get incredibly fast network speeds and pull down an image quickly as well.

No shit.


The issue isn't restoring a fucked machine - its trying to get a fully clean slate. Every machine.

Norton Ghost re-writes the disk from the most basic level up though, it completley rewrites each track and sector on the hard drive from the ground up ... The only thing lower than that is doing a low-level format on the hard drive.

[Rocky]

Dude, I've used multiple imaging tools. I could go into details of how they work as well as new features that Symantec doesn't have a grasp on yet (You can boot up a machine and start working WHILE it is being imaged on a bare metal box with the latest Acronis builds).

[Dogmeat]

Dude, I've used multiple imaging tools. I could go into details of how they work as well as new features that Symantec doesn't have a grasp on yet (You can boot up a machine and start working WHILE it is being imaged on a bare metal box with the latest Acronis builds).

That's fine, but why would you have a problem getting a "clean slate" then? Unless the malware somehow manages to trick the head on the hard drive into causing physical damage to the disk then you should have a completley clean slate, easy.

[Rocky]

That's fine, but why would you have a problem getting a "clean slate" then? Unless the malware somehow manages to trick the head on the hard drive into causing physical damage to the disk then you should have a completley clean slate, easy.

You aren't getting the point as I've said repeatedly.

Doing one machine, a few - no biggie.


Doing All of your machines for a truly clean slate, that's what I've been talking about since the first post