Thanks Shiva :)
===- Fwd Mesg ===
###############################################
# Minutes of the ILUGC Meet Sat 10th Jan 2003 #
###############################################
Please forgive any names that I have missed - I have a bad memory
especially for names :-)!!
The official agenda for the meet was
Topic : Virus Filtering using a GNU/LINUX Gateway.
Speaker: Mr KM.Ganesh
The meet started in Midea Labs Aisa Conf Hall (Last min change due to
key problem) as usual - maybe a bit early at about 3.00 or so with
about 10 people with more people trickling in till 3:30 (as usual
:-)).
After getting feedback from the list ,Mr.Ganesh decided to keep the
talk as practical as possible. He started off with the basics,with the
types of malware. Malware is categorized into
1. Host Dependent('live' on systems):
a. Logic Bomb: These come into effect when some wrong input is given
to the software in question.
b. Viruses: Viruses have three basic 'actions':
i) Search and Infect (Search for and infect the targetted app or
file,for example search for and attach itself into the explorer.exe or
excel.exe or something like that.
ii)Trigger: What actually activates the virus, example - open that
mail with vbscript in a lame(!) mail client like outlook express.
iii)Payload: What it actually does! Mail itself to everyone in your
addressbook, or delete windows and install linux for you (you wish!!).
2. Host Independent('lives' on the network):
a. Bacteria: These basically use up resources such as your ram or hard
disk space, filling it up with junk.
b. Worms: These quite essentially live on the network, a typical
example being MSBlaster.
MSBlaster used a buffer overflow hole in some DCOM RPC thingy in
windows. The exploit was known for the past six months, but so far
had no malware exploiting it, until blaster. After is exploited the
hole it downloads a copy of itself from the compromising system and
proceeds to look for other systems to infect.
The ports 135,137,etc are primarily used. The problem with exploiting
a windows system is that even after breaking into the system,
whereupon we have a command prompt available - pretty much nothing can
be done with it, because hardly any tools are available to do
anything. Also, the command prompt that is available at this juncture
is a 16 bit prompt,i.e. only 16 bit apps are available.
A number of apps, such as telnet and ftp which can be used for
transfer are unavailable as they are 32 bit apps. Though the ftp tool
which is command line seems to be a dos app in windows NT/2k, it is
actually a 32 bit app which runs in the dos prompt thanks to some 32
emulation. So, the only tool which 'may' be available that can be used
is the tftp app, which is what blaster used.
Well, thats enough about windows !!
Something I forgot to mention - there are currently 40 known viruses
for linux - though most of them are 'proof-of-concept', they are not
known in the wild and not 'successfull'.
Coming to Virus Filtering in Linux, there are basically three 'places'
where filtering can be done,
1. Mail(in Sendmail, etc)
2. File(Samba)
3. Web(in Squid or Apache(with mod_proxy)
1. Mail Filtering - Mail filtering can be done in three levels:
a. SMTP level-in the gateway itself.The problem with this method is
that notification of the user that a virus has been detected is not
easy, hence not used much.
b. MTA level-Most popular. A number of solutions exist for this level
of filtering.Examples are 'Amavis', 'Mail Scanner',etc.
c. LDA(Local Delivery Agent) level-example. used with procmail, Used
for local delivery of messages,i.e. to another user on that same
system. This again is not used very much.
The focus was hence mainly on the MTA level solutions. Some of te
popular solutions are Amavis and Mail Scanner.
-- Amavis:
One of the popular ones in Amavis (A Mail VIrus Scanner). Amavis
consists of a number of different components:
a. amavis-perl: provides command line filter - works with procmail.
b. amavisd: the daemon
c. amavisd-new: a fork of the daemon. This can filter viruses, works
with spamassasin, and custom content filtering.
d. amavis-ng: filters viruses.
General Operation is as follows:
The scanner picks up the mail from the incoming queue of the MTA, and
scans the mail for viruses,spams, and other custom filters. Then the
mail is sent to the outgoing queue of the MTA if no virus is detected.
If there is a virus ,then a mail is sent ot the sender,reciever and
admin(depending upon the config). Sometimes the headers(sender) get
spoofed by worms, and Ganesh said that he had disabled the 'send to
sender' option because of this.
The Amavis scanner usually listens on the 10,025 port. After it scans
the messages it puts them in the queue directory of the MTA. The queue
runner checks the queue dir for messages periodically, and then
processes them.
The amavisd-new scanner can invoke more than one virus scanner, and
integrates well with sendmail,postfix, qmail,etc and even has an
inbuilt smtp server.
The scanner is independent of the virus scanner. The only open source
virus scanner is CLAM. This virus scanner is called by amavis.
2. File Filtering:
File filtering is used with Samba mainly. The scanning can be done in
the Samba VFS or Unix VFS. Scanning is mainly done as 'on-access
scanning',i.e. on open,close,save,etc.
For Unix VFS scan, a kernel module has to compiled in DAZUKO.
This module inserts hooks into the kernel to call the virus
scanner(which is in userspace ofcourse). The test is usually done with
the eicar.com virus(which is the standard test for all
virus scanners).
SambaVFS scanning can be used for scanning in Samba.
The problem with scanning on samba is that notification of users that
there is a virus that is detected is a problem, as there is no option
in the protocol for messaging the user. So, samba just tells the user
that access is denied or some such equally cryptic windows error
message(I'd personally vote for a BSOD!).
There are some hackup jobs to fix this problem - one is to use Jabber,
installed in all machines and message the user about the virus, or
else to use an app called winpopup-to popup a dialog box in the user's
screen.
But, file scanning usually results in a quite a bit of I/O and cpu
usage. So certain directories should be excluded as necessary.
3. Web Filtering:
Web filtering through the Squid proxy server(of http and ftp was
talked about. A number of problems exist in this area. There is no
proper notification system which exists in the http and ftp protocols.
Also when a file that is being downloaded, the file cannot be scanned
until it is fully retrieved. However if no data is sent to the client,
that connection may die - therefore 'TRICKLE'ing is used, where a
small amount of data is sent to the user so as to keep the connection
alive, while the proxy server downloads the file to its own buffer.
Once the file has been downloaded and scanned, it is sent to the user.
Another problem is that resuming cannot be done, when this sort of
scanning is done.
Some proprietary solutions exist in check point firewalls(CVP
protocol) - where, when a file download is requested, the file data is
not sent to the user ,but instead a html file is sent, with the status
of the download, and finally when the download is complete and has
been scanned, a link to the file is provided. The problem with this
approach is that when wget is used, we will end up downloading the
html file instead of the file data. Another approach to this is ICAP
(Internet Content Adaption Protocol).
Antivirus Solutions:
Opensource : CLAM
Proprietary (usually with per user licenses) : Trend, Kaspersky,
mcafee,antivir,sophos,etc.
Also there was a lot of talk about Spam and Spam handling. There are
a number of blacklists that are maintained, which contain IPs which
are originators of large amounts of spam. Bharathi related how his
mail to srs got declared as spam because of Dishnet being in the
blacklist.
There was also a short and interesting discussion about the kernel
source getting compromised recently. In that case, a equivalency
testing(==) was changed to an assignment(=), and an attemp was made to
check in this. Howver, this was detected and corrected. Also a point
was made of the possibility of some other such hole in the 10 million
lines of code that is the kernel source. Also a reference was made to
a guy(sorry forgot the name) who proved that it was possible to hack
the compiler to insert code into a otherwise clean source of ,say the
kernel.
There was an announcement by Mr Venki@Collabnet - saying that Mr.Brian
Founder of Apache, was visiting India(for the LinuxAsia meet) and also
interested in meeting some of the people in the local LUG during his
Chennai visit. Date and Place is yet be decided.
There was also an announcement by Bharathi, saying that he would not
be able to attend the meets on 2nd saturdays because of work. So It
was decided that meets would probably be shifted to 1st/3rd week of
each month.
The meet dissolved by around 6:30, with some stragglers hanging
around. Overall it was cool!! :-)
Thanks,
Shiva KM (kmshiva@xxxxxxxxxxxx)
--
Bharathi S | MeTel Team,
TeNeT Group | DONLab, IIT-M,
OMC Group | MidasComm.com.
Known is drop, Unknown is OCEAN.
