VIRUS HUNTERS<@VM>Inoculate your computer system with these antivirus products
By Kevin Jonah
Special to GCN
It has been 12 years since the first real Internet virus scare. On Nov. 2, 1988, Cornell University graduate student Robert Morris unleashed a 'worm' program that used e-mail protocols to propagate itself across the Internet.
It was a sophisticated program, written in C, and its primary effect was to slow Internet e-mail to a crawl.
The Morris worm was a mere sneeze compared with what the latest crop of malicious programs has done to computer systems worldwide in the last two years.
Computer attacks have come a long way in the last 12 years, but so has antivirus software
First, there was Melissa. Then in May, a computer student at a vocational school in the Philippines unleashed a worm of his own. This time, the program was written in Visual Basic Script, disguised as an e-mail attachment, a love letter.
And it did a lot more than just slow down Internet message delivery. It destroyed data on infected systems and brought countless corporate mail systems to their knees. Because of a lack of laws criminalizing computer vandalism, the suspected author of the 'Love Bug' was never prosecuted. A series of copycat viruses, essentially modifications of the original ILOVEYOU worm code, continued to attack computer systems throughout the rest of the spring and summer.
More recently, Microsoft Corp.'s corporate network was breached through the use of another malicious e-mail attachment'a Trojan horse that transmitted user passwords to an e-mail account in Russia. As a result, Microsoft's source code for several of its products, including Windows, might have been compromised.
With the world increasingly linked by the Internet, and with tools making software development less difficult, the potential threats to computer security have grown exponentially over the last few years. And recently, the number of incidents of politically motivated Internet attacks has increased dramatically. Diagnose the problem
There are two widely used methods of detecting malicious programs. One is recognizing a known virus' signature, or code pattern. The other is identifying malicious behavior by a program and isolating it.
Signature-based scanning uses pattern recognition software to identify malicious code or files infected with a virus. The software examines the binary structure of a file and checks it against a database of the patterns of known threats. When the scan results in a match, the software can identify the problem file and isolate, repair or delete it.
Signature scans work extremely well with known viruses but often can be easily circumvented by new threats. These programs are heavily dependent on frequent and timely updates from the software's manufacturer.
Fortunately, most software packages that use signature scans support automated downloads from the Internet of updates to their databases. But in some cases, the software must be restarted after the updates are downloaded'not always an acceptable option if the protected system is a server.
Symantec Corp. deals with this issue in its Norton AntiVirus Corporate Edition 7.5 by separating the scanning engine from the rest of the software architecture, allowing new definitions and software updates to be loaded without a restart.
Behavior-based, or heuristic, scanning is a bit more complex. Rather than looking for specific known viruses or malicious applications, it watches for suspicious activity by a program, intercepting any application code that performs actions that could be damaging to the operating system. This can offer a high level of protection, but it can also be intrusive to system users'particularly software developers or system administrators who create or run applications that the antivirus software might identify as high-risk behavior.
Also, some heuristic scans still depend on signature files to identify virus-like behavior with a specific threat, so they might not act against new threats that behave in ways the scans don't expect. This happened with ILOVEYOU, which many antivirus products did not immediately perceive to be a threat because it was a script-based attack and ran within a trusted application'Microsoft Outlook.
Tips for buyers
- Deploy virus protection at every level of the network. This closes the door to the spread of viruses'and inadvertent re-infection'from all sources.
- Protect Unix servers, too. Even though most viruses have their origins in Microsoft Windows or MS-DOS, they can infect any file system exposed to Windows workstations.
- Update early and often. Automate downloads of virus protection updates when possible and bypass the need for user intervention to keep systems up-to-date.
- Hide it from your users. Lock down virus software options with policies that keep users from tinkering with their settings.
- Educate users about computer hygiene. Teach them about the hazards of file attachments, malicious Web sites and mail scripts. Get them to use the maximum level of security when browsing untrusted sites outside the firewall.
InDefense's Achilles' Shield is based entirely on behavior-based detection. It records a snapshot of a clean system at the time of installation and monitors all future changes to the system. When it detects what it classifies as a 'viral' change to the system, it halts the process responsible.
GoBack, a product from Adaptec Inc. spin-off Roxio Inc., uses a similar method. GoBack is not specifically an antivirus program'instead, it lets users roll back a system configuration on any corrupted or damaged system to a previous working configuration. Although this doesn't prevent the system from wreaking havoc on other computers before the problem is detected, it does let administrators essentially hit an undo button on damaged systems once a problem is discovered.
Some antivirus packages, such as Network Associates Inc.'s McAfee Active Virus Defense, use a combination of techniques. McAfee combines signature scanning with behavioral analysis of code through heuristics.
Also essential to defending against viruses is the matter of where to catch them. Most virus protection programs traditionally have run on the desktop computer. This approach was fine when the main point of entry of viruses was through infected floppy disks, and it still offers a great deal of protection to individual users. But more layers of defense are required for an Internet-connected network.
The first line of defense for most networks is at the entrance'the firewall or Internet mail gateway. Some firewall products can screen for malicious code in Simple Mail Transfer Protocol message packets before letting them on the network, preventing infection of systems from the outside.
Firewall packet screening can be effective against already identified threats, as it is almost always dependent on pattern recognition. It also works well in blocking viruses and other threats coming in over nonmail protocols like File Transfer Protocol and Hypertext Transfer Protocol.
Another type of interceptor, usually running on the mail relay server or on a groupware server, is a content filter. It can check for specific attachment types and quarantine them, preventing them from being delivered.
Trend Micro's InterScan, for example, provides behavioral analysis and signature checking for not just SMTP but FTP and HTTP as well, to block both viruses and malicious Java and ActiveX Web components in Web pages before they even get on the network. An optional module will even screen for spam.
Another effective point of defense is the organizational mail or groupware server; protecting this point can prevent infected files from entering from outside the organization or being propagated internally if brought in through other means.
Some antivirus products integrate directly with groupware products such as Lotus Domino and Microsoft Exchange, screening attachments to mail messages'and, in the case of Domino, files attached to Notes databases. Sybari Software Inc.'s Antigen for Exchange and Antigen for Lotus Notes products actually wrap other companies' virus protection engines'Norman Data Defense, McAfee, Sophos'to run on the groupware server.
Some of these products, such as GFI Fax & Voice USA's MailEssentials do full-blown content scanning and protect against specific attachment types, such as vbs scripts.
With large client installations, reporting is an essential part of catching attacks early. Reporting can help set up protection against new threats before they spread. Some products, such as Symantec's Norton and Network Associates' McAfee, offer a central console from which administrators can control how the product is deployed and check activity logs and other reports from client systems.
But just as important as any virus protection product is applying rigorous administrative policies to networks and teaching users a little common sense.
By now, users should know the danger of opening an unknown file type. But every day, it seems another user double-clicks on yet another version of a script virus and launches yet another barrage. User education is key to ensuring that the threat from viruses, malicious code and other attacks on system security are maintained at a level that can be managed by the safeguards put in place.Kevin Jonah is a network manager and free-lance technology writer in Maryland.
| Company || Product || Type of product|| Detection |
| Platforms|| Update service || Checks|
| GFI Fax & Voice USA|
| MailEssentials for Exchange/SMTP|| E-mail security, content checking,and antivirus gateway that removes all types of e-mail threats before they are delivered to users.|| Content screening|| NT, Win 2000|| Automatic || Yes|| Yes|| Quarantines script files and inline scripts|| Deployed at mail server|| $275 up for 10 users; government discounts available|
| InDefense Inc.|
Santa Cruz, Calif.
| Achilles' Shield|| Behavior-based intrustion detection|| Analyzes any unknown code, alerts users of intrusive tendencies, can certify good known code|| NT, Win9x, Win 2000|| Not required; upgrades available|| Yes|| Yes|| Yes|| Network administration program with log-in scripting|| $29 per user, $1,500 for 100 users; $2,500 for 1,000 users|
| Network Associates Inc.|
Santa Clara, Calif.
| McAfee Active Virus Defense|| Scans for viruses at Internet gateway, groupware server, file server, desktop PC and PDA|| Scans for known viruses by signature and by heuristic analysis of the code|| NT 4.0, Win9x, Win 2000, WinCE, Palm OS, NetWare, Unix, Linux, MS-DOS Microsoft Exchange, Lotus Domino|| Automatic, with options for scheduling and for selecting download locations|| Yes; also checks them before they reach recipient|| Yes, at the Internet gateway e-mail server|| No|| Through McAfee ePolicy Orchestrator, or through software deployment tools such as Microsoft SMS|| $70 up per seat for 2-year license; $105 up per seat for perpetual license; both prices 50-100 users; discounts for larger volumes|
| Roxio Inc.|
| GoBack Enterprise Edition 2.23|| A system undo software package; does not screen for viruses, but can return a system to pre-virus state|| No|| NT, Win9x, Win 2000, Win Me|| Updates on Web site|| No|| N/A|| No|| Network installation|| $63 for 1 user; $265 for 5; $487 for 10; $2,095 for 50 $3,832 for 100 $14,995 for 1,000|
| Sophos Inc.|
| Sophos Anti-Virus (OS-based)|| SWEEP provides on-demand and scheduled virus checking of files on file servers or workstations; InterCheck provides local on-access virus- checking on workstations and server-based on-access virus- checking for networked workstations; Sohpos Anti-Virus Interface allows third-party software developers to integrate their firewalls, gateways and similar applications|| Scans for known viruses by signature, using file scanning and pattern recognition|| For servers: NT, Win 2000, NetWare, OS/2,Unix, OpenVMS; For clients: Win9x, NT,Win 2000, OS/2, Mac OS, MS-DOS Windows 3.1|| Yes|| Yes|| No|| Will not let a known malicious script run|| Via central installation on network and provided admin tool|| $1,495 for 50 users|
| Sybari Software Inc.|
East Northport, N.Y.
| Antigen for Exchange; Antigen for Lotus Notes|| Mail server virus protection provides mail attachment filering and content checking|| Content screening|| NT and Win 2000 with Exchange Server 5.0 and up; NT, AIX and Solaris with Lotus Notes|| Automatic or on-demand|| Yes|| Yes|| Yes, will quarantine scripts|| None (through mail server)|| $4,995 for 250 users with a two-year license|
| Symantec Corp.|
| Norton AntiVirus Coporate Edition 7.5|| Desktop and server virus detection and prevention; allows administrators to centrally deploy to clients and schedule or manually launch scans; provides centralized event logging|| Scans for known viruses by signature, using file scanning and pattern recognition|| MS-DOS, Win 3.x, Win9x, NT, Win 2000, NetWare|| Scheduled and on-demand|| On Notes, Outlook, cc:Mail|| Yes|| No|| Through management console or HTTP intranet deployment|| Based on site licensing requirements|
| Trend Micro Inc.|
| Interscan Virus Wall || Internet gateway; stops viruses and other malicious code in SMTP, HTTP and FTP traffic before it gets to servers and users; optional eManager adds spam blocking, content filtering, and e-mail scheduling|| Scans for malicious activity using signature pattern matching or behavioral analysis|| NT, Solaris, Linux, HP-UX|| Scheduled or on-demand updates via the Internet or regular mail|| Yes|| Yes|| No|| Managed through browser or Windows-based management console|| $725 up for 25 users (GSA)|
| Scan Mail for Exchange; ScanMail for LotusNotes|| ScanMail for Exchange detects and cleans viruses from inbound and outbound e-mail on the Exchange server in real time and provides manual and scheduled scans of the informationstore database; ScanMail for Lotus Notes detects and removes viruses hidden in Notes mail, shared databases, and during Notes replication|| Scans for malicious activity using signature pattern matching or behavior analysis|| NT 4.0 and Win 2000 for Exchange; NT, Solaris, OS/390, AIX and OS/2 for Notes|| Scheduled or on-demand via the Internet or regular mail|| Yes|| Yes|| No|| Managed through browser or Windows-based management console|| $600 up for 25 users (GSA)|