The CERT Coordination Center publishes incident notes to provide
information about incidents to the Internet community.
<h2>Malicious Code Propagation and Antivirus Software Updates</h2>
Release Date: July 2, 2003<p>
<p>
Recent reports to the CERT/CC have highlighted two chronic problems:
<ul>
<li>The speed at which viruses are spreading is increasing. This
echoes the trend toward faster propagation rates seen in the past few
years in self-propagating malicious code (i.e., worms). Beginning
with the Code Red worm (<a href="/advisories/CA-2001-19.html">CA-2001-19</a>, <a href="/advisories/CA-2001-23.html">CA-2001-23</a>) in 2001 up through
the Slammer worm (<a href="/advisories/CA-2003-04.html">CA-2003-04</a>) earlier this year,
we have seen worm propagation times drop from hours to minutes.
<p>A similar trend from weeks to hours has emerged in the virus (i.e.,
non-self-propagating malicious code) arena. The effectiveness of
antivirus software suffers as a result. Several recent malicious code
incidents involving variants of <a href="http://www.cert.org/current/current_activity.html#bugbear">W32/BugBear</a>
and <a href="http://www.cert.org/current/current_activity.html#sobig">W32/Sobig</a>
have achieved widespread propagation at rates significantly faster
than many previous viruses. This increased speed is, unfortunately,
also faster than many antivirus signatures can be identified and
updated, regardless of the update method (including automated
signature updates). The CERT/CC has received reports of successful <a href="http://www.cert.org/current/current_activity.html#sobig.e">W32/Sobig.E</a>
compromises from users whose signatures were up to date for the prior
versions of W32/Sobig.</p>
<p> Signature-based antivirus software is not the only type of
antivirus software at risk: antivirus software that uses heuristics to
determine malicious behavior may be circumvented by malicious code
that employ new techniques. They should not be unconditionally
trusted either, as they may not always block malicious code from
executing. Additionally, we are aware of instances where corrupted
antivirus software updates have caused the software to be disabled
without the user's knowledge.</p> </li>
<li>In a number of the reports, users who were compromised may have
been under the incorrect impression that merely having antivirus
software installed was enough to protect them from <b>all</b>
malicious code attacks. This is simply a mistaken assumption, and
users must <i>always</i> exercise caution when handling email
attachments or other code or data from untrustworthy sources.</li>
</ul>
</p>
<p> In general, it is important to remember
that while antivirus software vendors continue to improve the speed
and reliability of their signature update mechanisms, there will
always be some window of time when a system does not contain
signatures to detect a particular worm or virus. Several recent research papers that have
placed estimates on the magnitude of "worst-case scenario" malicious
code propagation rates also illustrate the risk to systems during the
window of time before signatures are available.[<a href="#1">1</a>][<a href="#2">2</a>]
</p>
<h3>Solutions</h3>
<h4>Apply "defense in-depth"</h4>
<p>As mentioned above, it is not sufficient to rely solely on
antivirus software for complete protection. Therefore, we recommend
users apply a strategy of "defense in-depth" (where several layers of
security or access controls are used) when considering ways to protect
their computers from attackers. Although it may not be practical for
all users, another way of achieving defense in-depth is to use diverse
software and operating systems when possible. Some additional ways of
improving security beyond the use of antivirus software follow.</p>
<p>In addition to following the steps outlined in this section, the
CERT/CC encourages home users to review the "<a href="http://www.cert.org/tech_tips/home_networks.html">Home Network
Security</a>" and "<a href="http://www.cert.org/homeusers/HomeComputerSecurity/">Home
Computer Security</a>" documents.
<h4>Run and maintain an antivirus product</h4>
<p>While an up-to-date antivirus software package cannot protect
against all malicious code, for most users it remains the best
first-line of defense against malicious code attacks.</p>
<p>Most antivirus software vendors release frequently updated
information, tools, or virus databases to help detect and recover from
malicious code, including W32/Bugbear.B and W32/Sobig.E. Therefore,
it is important that users keep their antivirus software up to date.
The CERT/CC maintains a partial list of <a href="http://www.cert.org/other_sources/viruses.html#VI">antivirus
vendors</a>.
<p>Many antivirus packages support automatic updates of virus definitions.
The CERT/CC recommends using these automatic updates when available.</p>
<h4>Do not run programs of unknown origin</h4>
<p>Never download, install, or run a program unless you know it to be
authored by a person or company that you trust. Email users should be
wary of unexpected attachments, while users of Internet Relay Chat
(IRC), Instant Messaging (IM), and file-sharing services should be
particularly wary of following links or running software sent to them
by other users, as these are commonly used methods among intruders
attempting to build networks of distributed denial-of-service (DDoS)
agents.</p>
<h4>Disable or secure file shares</h4>
<p>Best practice dictates a policy of least privilege. For example,
if a Windows computer is not intended to be a server (i.e., share
files or printers with others), "File and Printer Sharing for
Microsoft Networks" should be disabled.</p>
<p>For computers that export shares, ensure that
user authentication is required and that each account has
a well-chosen password. Furthermore, consider using a firewall
to control which computer can access these shares.</p>
<p>By default, Windows NT, 2000, and XP create certain hidden and
administrative shares. See the
<a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314984&sd=tech">
HOW TO: Create and Delete Hidden or Administrative Shares on Client Computers
</a> for further guidelines on managing these shares.</p>
<h4>Deploy a firewall</h4>
<p>The CERT/CC also recommends using a firewall product, such as a
network appliance or a personal firewall software package. In some
situations, these products may be able to alert users to the fact that
their machine has been compromised. Furthermore, they have the
ability to block intruders from accessing backdoors over the network.
However, no firewall can detect or stop all attacks, so it is
important to continue to follow safe computing practices.</p>
<h4>Recovering from a system compromise</h4>
<p>If you believe a system under your administrative control has been
compromised, please follow the steps outlined in</p>
<dl><dd><a href="http://www.cert.org/tech_tips/win-UNIX-system_compromise.html">Steps
for Recovering from a UNIX or NT System Compromise</a></dd></dl>
<p>
<h3>References</h3>
<ol>
<a name="1"></a>
<li>Paxson, V., Staniford, S., Weaver, N. "How to 0wn the Internet in Your Spare Time"
<a href="http://www.icir.org/vern/papers/cdc-usenix-sec02/index.html">http://www.icir.org/vern/papers/cdc-usenix-sec02/index.html</a></li>
<a name="2"></a>
<li>Moore, D., Paxson, V., Savage, S., Shannon, S., Staniford, S., Weaver, N. "The Spread of the Sapphire/Slammer Worm"
<a href="http://www.cs.berkeley.edu/~nweaver/sapphire/">http://www.cs.berkeley.edu/~nweaver/sapphire/</a></li>
</ol>
<hr noshade="" width="100%"/>
<b>Authors</b>: <a href="mailto:cert@cert.org?subject=IN-2003-01%20Feedback">Chad Dougherty and Allen Householder</a><br/>
<!--#include virtual="/include/footer_nocopyright.html" -->
<p>Copyright ©2003 Carnegie Mellon University.</p>
</p></p></p></p> |