Feeds

Confessions of a sysadmin

I found a virus on my network today…

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

Blog I would like to say that it has been a few days since my last malware infected computer. I have been dealing with a string of these lately, and I’ve had quite enough of them for now, thank you.

I would also like to say my network was the epitome of configuration perfection, with every system fully patched, and a team of network ninjas facing off against hired pirates in a never ending battle for security perfection. The truth, however, is less ideal. My network has some systems that can’t ever be patched, and others where IT can’t force automatic patches. Configuration errors will inevitably exist due to a combination of lack of time, lack of knowledge or prioritization of IT tasks.

According to the email of article topics in my inbox, this one is supposed to be about the importance of proper configuration and patch management. Instead of being able to stand atop an ivory tower and reveal to you the secrets of perfect network management, I am forced to humble myself before the entire internet with a confession:

I discovered the Conficker worm on my network today.

I am shamed by this because the infection was entirely preventable and all the more because this discovery occurred the day this very article was due. While I had a lovely sermon prepared in which I would discuss why proper configuration and patch management are so very important, I think that doing a post-mortem on exactly how I contracted these bugs will be both far more entertaining, and perhaps even a little enlightening.

I discovered the infection today on Windows 2000 systems running Service Pack 4. Each system serves as a network and command and control interface for a large piece of equipment (think the size of a small car).

The hardware they are running on is fairly old (they talk to their attached equipment via a truly ancient SCSI card) and the software is remarkably picky and brittle. If installed exactly as directed, the computers (and their attached equipment) run just fine. Install the wrong windows update or change the wrong setting and they will refuse to work.

As an added bonus, the hardware specifications on the provided kit is so exact that if you were to (for example) load an anti-malware scanner on the system then the performance decrease would very negatively affect the productivity of the unit. Any decrease in output capacity of these units simply will not be tolerated.

The more I delve into the situation the more I am convinced these systems were infected a while ago. We had a user who opened an infected attachment (Windows XP, and yes they had to be running as an administrator to get their work done). For the curious it was a pdf. This turned out to be Conficker, which in turn ate every vulnerable computer on the entire network in about 15 minutes flat, and a fun night was had by all.

After we had sent the initial conficker infection shrieking back into the void from which it arose, we ran around to every single computer on the network and checked them one at a time. We remoted into each one in turn, ticked them off against both our IT internal list of systems, DHCP and even a Languard scan. After a few hours of fighting this particular brushfire, we were satisfied the network was clean and went home. By the time we arrived the next day we were on to the next problem, and the infection was almost completely forgotten.

This is where I made a big mistake.

The systems I discovered as infected today were, at the time we started cleaning the network, simply turned off. At the end of every work day, when the staff who use that equipment are done with it, they shut it down. They must have been active when the initial infection took place, and were turned off by staff member leaving for the night after we booted everyone off the network.

What’s worse, I completely forgot that those systems had Windows computers in them. They were, as computers integrated into larger pieces of equipment, out of sight and thus out of mind. (Let that be a lesson to you all: computers are integrated into everything these days. Think really, really hard about what’s on your network before declaring it bug-free.)

Knowing how these systems got infected, let’s delve into how I could have prevented this from occurring. The first and most obvious problem is that of patch management. I have a Windows Server Update Services (WSUS) server on my network to distribute patches, and I am very fastidious about testing patches against existing software and releasing the updates as soon as possible.

Beginner's guide to SSL certificates

More from The Register

next story
It's Big, it's Blue... it's simply FABLESS! IBM's chip-free future
Or why the reversal of globalisation ain't gonna 'appen
'Hmm, why CAN'T I run a water pipe through that rack of media servers?'
Leaving Las Vegas for Armenia kludging and Dubai dune bashing
Microsoft and Dell’s cloud in a box: Instant Azure for the data centre
A less painful way to run Microsoft’s private cloud
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
CAGE MATCH: Microsoft, Dell open co-located bit barns in Oz
Whole new species of XaaS spawning in the antipodes
AWS pulls desktop-as-a-service from the PC
Support for PCoIP protocol means zero clients can run cloudy desktops
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.