The Register is reporting that, according to Panda Software (AV company), the two most common families of malware that are causing infections are Sdbot and Gaobot. I suggest that you follow those links to read over what is causing this havoc.
Lets look at a few things.
Both of these forms of malware are OLD. Microsoft has old software updates that are relevant to these malware products. This is not a new story. Nimda, SQL Slammer and Blaster all used vulnerabilities that MS had released updates for many months in advance. These days, there are no excuses for not maintaining patch levels. You’ve got a free solution like WSUS, SMS 2003 Inventory Tool for Software Updates and HFNetChk Pro all available to use. Don’t fall into the trap that thinking updates are only necessary for MS products. I only read today that 3 Cisco Wifi products had found to be vulnerable. Many UNIX/LINUX’s have updates but they are never applied. More importantly, every now and then you hear of problems with Checkpoint … funny … I can’t remember hearing of any problems on ISA 2004 or ISA 2006 🙂
Seeing as these products are old, you’d think that AV would protect people. I can’t recall how many sites with Symantec or Norton I’ve visited where they’ve had problems with agents becoming orphaned or updates were failing. And what’s worse? These organisations accept these behavior and continue to subscribe to these "solutions". My suggestions? A) Replace these products with better solutions. Check out AV-Comparatives for an idea how these companies rate. And ask around. Don’t just accept the word of a salesman or some marketing bluff. B) Use a third party solution to audit your AV status. I’ve used SMS in the past to audit the DAT files of Trend Micro OfficeScan, even though I had useful reports from the product itself.
Control access to non-relevant services. What do I mean? These products are spread by the likes of IRC … that’s a chat tool that is full of the sorts of advertising that … shall we say … isn’t child friendly. What has this product got to do with doing your work? For the vast majority of organisations it is totally irrelevant. The solution is to set up your firewall(s) to only allow necessary outbound traffic from limited resources and to install a proxy server with proxy filtering software. Using these you can control what is being done over your Internet link. Depending on your jurisdiction and agreements with employees, you may even be able to monitor and report on their activity. Check this out with all necessary lawyers/solicitors before attempting this.
How did this software install itself? I can’t say for sure but it sounds like it requires local administrator access. The truth is, most malware is pretty dumb. It usually requires local admin access to install. For years experts, including MS, have been saying that ordinary users should be running without admin access and admins should be running using "least privilege". What’s that? If you are a domain admin, do you really need to be logged into your PC as a domain admin to read your mail or surf the net? Instead, why don’t you run a virtual machine (using one of the free products out there) on your PC that has all of your admin tools on it? Log into your PC as an ordinary user and into your virtual machine as a admin/domain admin. Your risk is limited and you have not made your job any more complicated. In fact, it’s probably easier because VM’s are mobile and can be quickly replicated or reset to a previously known acceptable state. And there’s better news if you have Windows Vista. By leaving UAC enabled, you can log in as admin but still not run anything as admin unless it’s required and been OK’d by you when the OS asks. E.G. you are browsing the net and a website tries to run a program on you PC without you initiating it. It will require admin access, thus elevating it’s rights. You’re actually logged in as an admin but you’re not actually using those rights. The OS will request a rights change from you. You’ll know something is wrong and can prevent the program from running.
Finally, you can take things a step further and lock down your desktop network. Group Policy is a simple and quick way to accomplish this. Lock down features of Windows that are not required or are considered a realistic risk. You can use security templates to control rights assignment. Make sure you understand this technology before trying it out! You can use tools such as Desired Configuration Management from SMS 2003/CM 2007 to audit machine configurations. And you can also use the SMS 2003 R2 Scan Tool for Vulnerability Assessment or the free Baseline Security Analyser to audit security configurations of your PC’s and servers against MS best practices.
I hope you can see that a few simple things will protect you. Considering that these two families of malware are so effective, it would indicate that not everyone is listening to the advice.
Credit: The Register.