Virus Hunters<@VM>Inoculate your computer system with one of these antivirus products and some common sense
Computer attacks have became increasingly devious over the years, but antivirus software is wise to their wily ways BY KEVIN JOHAH
| SPECIAL TO GCN
It has been 12 years since the first real Internet virus scare. On Nov. 2, 1988, Cornell University graduate student Robert Morris unleashed a 'worm' program that used e-mail protocols to propagate itself across the Internet.
It was a sophisticated program, written in c, and its primary effect was to slow Internet e-mail to a crawl.
The Morris worm was a mere sneeze compared with what the latest crop of malicious programs has done to computer systems worldwide in the last two years.
First, there was Melissa. Then in May, a computer student at a vocational school in the Philippines unleashed a worm of his own. This time, the program was written in Visual Basic Script, disguised as an e-mail attachment, a love letter.
And it did a lot more than just slow down Internet message delivery. It destroyed data on infected systems and brought countless corporate mail systems to their knees. Because of a lack of laws criminalizing computer vandalism, the suspected author of the Love Bug was never prosecuted. A series of copycat viruses, essentially modifications of the original ILOVEYOU worm code, continued to attack computer systems throughout the rest of the spring and summer.
With the world increasingly linked by the Internet, and with tools making software development less difficult, the potential threats to computer security have grown exponentially over the last few years. And recently, the number of incidents of politically motivated Internet attacks has increased dramatically.Diagnose the problem
There are two widely used methods of detecting malicious programs. One is recognizing a known virus' signature, or code pattern. The other is identifying malicious behavior by a program and isolating it.
Signature-based scanning uses pattern recognition software to identify malicious code or files infected with a virus. The software examines the binary structure of a file and checks it against a database of the patterns of known threats. When the scan results in a match, the software can identify the problem file and isolate, repair or delete it.
What is it? A virus hunter, more commonly referred to as antivirus software, detects and either removes or isolates a virus, or piece of malicious code.
How does it work? Most antivirus programs work one of two ways, either
by scanning for the signatures or code patterns
of known viruses, or by scanning for suspicious behavior.
Why do you need it? If your system receives information from any source other than your own keyboard'whether via e-mail, the Internet, dial-up connections, floppy disks or any other source'it is vulnerable to attack. Antivirus software is essential to ensuring that you protect your data.
When might you not need it? If it's 1960 and you have a closed, mainframe, stovepipe system, you're probably safe. Otherwise, see above.
Ballpark price? Prices vary depending on such factors as the type of product and number of users, but most average between $20 and $70 per user.
Must-know info? You are never finished protecting your system from attack. Once you have selected and installed your antivirus software, you should be sure to update the software at least every few weeks. Some vendors provide automatic updates, others make Web downloads available.
Signature scans work extremely well with known viruses but often can be easily circumvented by new threats. These programs are heavily dependent on frequent and timely updates from the software's manufacturer.
Fortunately, most software packages that use signature scans support automated downloads from the Internet of updates to their databases. But in some cases, the software must be restarted after the updates are downloaded'not always an acceptable option if the protected system is a server.
Symantec Corp. deals with this issue in its Norton AntiVirus Corporate Edition 7.5 by separating the scanning engine from the rest of the software architecture, allowing new definitions and software updates to be loaded without a restart.
Behavior-based, or heuristic, scanning is a bit more complex. Rather than looking for specific known viruses or malicious applications, it watches for suspicious activity by a program, intercepting any application code that performs actions that could be damaging to the operating system. This can offer a high level of protection, but it can also be intrusive to system users.
Also, some heuristic scans still depend on signature files to identify virus-like behavior with a specific threat, so they might not act against new threats that behave in ways the scans don't expect. This happened with ILOVEYOU, which many antivirus products did not immediately perceive to be a threat because it was a script-based attack and ran within a trusted application'Microsoft Outlook.On the defense
Also essential to defending against viruses is the matter of where to catch them. Most virus protection programs traditionally have run on the desktop computer. This approach was fine when the main point of entry of viruses was through infected floppy disks, and it still offers a great deal of protection to individual users. But more layers of defense are required for an Internet-connected network.
The first line of defense for most networks is at the entrance'the firewall or Internet mail gateway. Some firewall products can screen for malicious code in Simple Mail Transfer Protocol message packets before letting them on the network, preventing infection of systems from the outside.
Firewall packet screening can be effective against already identified threats, as it is almost always dependent on pattern recognition. It also works well in blocking viruses and other threats coming in over nonmail protocols like File Transfer Protocol and Hypertext Transfer Protocol.It's all in the content
Another type of interceptor, usually running on the mail relay server or on a groupware server, is a content filter. It can check for specific attachment types and quarantine them, preventing them from being delivered.
Trend Micro's InterScan, for example, provides behavioral analysis and signature checking for not just SMTP but FTP and HTTP as well, to block both viruses and malicious Java and ActiveX Web components in Web pages before they even get on the network.
Another effective point of defense is the organizational mail or groupware server; protecting this point can prevent infected files from entering from outside the organization or being propagated internally if brought in through other means.
Some antivirus products integrate directly with groupware products such as Lotus Domino and Microsoft Exchange, screening attachments to mail messages.
With large client installations, reporting is an essential part of catching attacks early. Reporting can help set up protection against new threats before they spread. Some products, such as Symantec's Norton and Network Associates' McAfee, offer a central console from which administrators can control how the product is deployed and check activity logs and other reports from client systems.
But just as important as any virus protection product is applying rigorous administrative policies to networks and teaching users to apply a little common sense.
By now, users should know the danger of opening an unknown file type. But every day, it seems another user double-clicks on yet another version of a script virus and launches yet another barrage.
User education is very important to ensuring that the threat from viruses, malicious code and other attacks on system security are maintained at a level that can be managed by the safeguards put in place.Kevin Jonah is a network manager and free-lance technology writer in Maryland.
|Company||Product||Type of product||Detection method||Platforms||Update service||Checks e-mail attachments before launch||Detects script files in e-mail||Warning before launching scripts||Deployment tools||Price|
|GFI Fax & Voice USA|
|MailEssentials for Exchange/SMTP||E-mail security, content gateway that removes all types of e-mail threats before they are delivered to users||Content screening||NT, Win 2000||Automatic||Yes||Yes||Quarantines script files and inline scripts||Deployed at mail server||$275 up for 10 users; government discounts available|
Santa Cruz, Calif.
|Achilles' Shield||Behavior-based intrustion detection||Analyzes any unknown code, alerts users of intrusive tendencies, can certify good known code||NT, Win9x, Win 2000||Not required; upgrades available||Yes||Yes||Yes||Network administration program with log-in scripting||$29 per user, $1,500 for 100 users; $2,500 for 1,000 users|
|Network Associates, Inc.|
Santa Clara, Calif.
|McAfee Active Virus Defense||Scans for viruses at Internet gateway, groupware server, file server, desktop PC and PDA||Scans for known viruses by signature and by heuristic analysis of the code||NT 4.0, Win9x, Win 2000, WinCE, Palm OS, NetWare, Unix, Linux, Microsoft Exchange, MS-DOS Lotus Domino||Automatic, with options for scheduling and for selecting download locations||Yes; also checks them before they reach recipient||Yes, at the Internet gateway e-mail server||No||Through McAfee ePolicy Orchestrator, or through software deployment tools such as Microsoft SMS||$70 up per seat for 2-year license; PC and PDA $105 up per seat for perpetual license; both prices 50-100 users; discounts for larger volumes|
|GoBack Enterprise Edition 2.23||A system-undo software package; does not screen for viruses, but can return a system to pre-virus state||No||NT, Win9x, Win 2000, Win Me||Updates on Web site||No||N/A||No||Network installation||$63 for 1 user; $265 for 5; $487 for 10; $2,095 for 50 $3,832 for 100 $14,995 for 1,000|
|Sophos Anti-Virus (OS-based)||SWEEP provides on-demand and scheduled virus checking of files on file servers or workstations; InterCheck provides local on-access virus-checking on workstations and server-based on-access virus-checking for networked workstations; Sophos Anti-Virus Interface allows third-party software developers to integrate their firewalls, gateways and similar applications||Scans for known viruses by signature, using file scanning and pattern recognition||For servers: NT, Win 2000, NetWare, OS/2,Unix, OpenVMS; For clients: Win9x, NT,Win 2000, OS/2, Mac OS, MS-DOS Windows 3.1||Yes||Yes||No||Will not let a known malicious script run||Via central installation on network and provided admin tool||$1,495 for 50 users|
|Sybari Software Inc.|
East Northport, N.Y.
|Antigen for Exchange; Antigen for Lotus Notes||Mail server virus protection provides mail attachment filtering and content checking||Content screening||NT and Win 2000 with Exchange Server 5.0 and up; NT, AIX and Solaris with Lotus Notes||Automatic or on-demand||Yes||Yes||Yes, will quarantine scripts||None (through mail server)||$4,995 for 250 users with a two-year license|
|Norton AntiVirus Corporate Edition 7.5||Desktop and server virus detection and prevention; allows administrators to centrally deploy to clients; provides centralized event logging||Scans for known viruses by signature, using file scanning and pattern recognition||MS-DOS, Win 3.x, Win9x, NT, Win 2000, NetWare||Scheduled and on-demand||On Notes, Outlook, cc:Mail||Yes||No||Through management console or HTTP intranet deployment||Based on site licensing requirements|
|Trend Micro Inc.|
|Interscan Virus Wall||Internet gateway; stops viruses and other malicious code in SMTP, HTTP and FTP traffic before it gets to servers and users; optional eManager adds spam blocking, content filtering, and e-mail scheduling||Scans for malicious activity using signature pattern matching or behavioral analysis||NT, Solaris, Linux, HP-UX||Scheduled or on-demand updates via the Internet or regular mail||Yes||Yes||No||Managed through browser or Windows-based management console||$725 up for 25 users|
|Scan Mail for Exchange; ScanMail for LotusNotes||ScanMail for Exchange detects and cleans viruses from inbound and outbound e-mail on the Exchange server in real time and provides manual and scheduled scans of the information store database; ScanMail for LotusNotes detects and removes viruses hidden in Notes mail, shared databases and during Notes replication||Scans for malicious activity using signature pattern matching or behavior analysis||NT 4.0 and Win 2000 for Exchange; NT, Solaris, OS/390, AIX and OS/2 for Notes||Scheduled or on-demand via the Internet or regular mail||Yes||Yes||No||Managed through browser or Windows-based management console||$600 up for 25 users|