School nixes malware with open source

ORLANDO - A team of IT staffers at the University of Indianapolis last week showed off a bundle of open source tools and scripts it uses to trap and isolate PCs infected by viruses or spyware.

Dubbed Shelob, after the sinister giant spider in J.R.R. Tolkien's "Lord of the Rings," the software identifies suspect traffic patterns, identifies the computers involved and then shunts them to a closed virtual LAN. Users get an appropriate Web screen, explaining what's happened and how to fix their PC or whom to call for help.

Shelob's inner workings were shown off last week in Orlando, Fla., at Educause, the annual user conference for IT professionals in higher education.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

ORLANDO - A team of IT staffers at the University of Indianapolis last week showed off a bundle of open source tools and scripts it uses to trap and isolate PCs infected by viruses or spyware.

Dubbed Shelob, after the sinister giant spider in J.R.R. Tolkien's "Lord of the Rings," the software identifies suspect traffic patterns, identifies the computers involved and then shunts them to a closed virtual LAN. Users get an appropriate Web screen, explaining what's happened and how to fix their PC or whom to call for help.

Shelob's inner workings were shown off last week in Orlando, Fla., at Educause, the annual user conference for IT professionals in higher education.

The school says that since being rapidly thrown together during the Blaster worm outbreak of 2003, Shelob has helped to keep it free of network or service outages related to virus infections. One limitation is it works only with clients that are plugged directly into the LAN, not wireless devices.

Shelob's creators are Shawn Austin, Matt Wilson and Steve Corbin, all at the university. Currently, Shelob is not publicly available, but that could change as early as this week,says Wilson, who is the school's network manager.

To detect traffic anomalies, Austin says, the team wrote plug-ins for three open source programs - Snort, an intrusion-detection program; Amavisd, an interface between message transfer agents and various content checking programs; and NMAP , a network scanner. A tool called Bleeding Snort keeps Snort's virus signatures updated daily.

Using the output from these programs, Shelob populates a MySQL database table with a list of media access control addresses and other identifiers.

Shelob integrates with the school's own version of the open source NetReg application, which is used to register an unknown DHCP client before it's granted full network access. When Shelob identifies an infected PC, NetReg assigns it a new IP address. Then, OpenVMPS (an open source version of Cisco's VLAN Membership Policy Server) reassigns the port to which the PC is connected to a virtual LAN that contains only other infected computers.

Shelob then redirects the PC's DNS lookup requests to a Web server, which then delivers a page that tells the end user about the infection and tells how to clean it. The same Web page can be used to distribute McAfee's VirusScan, virus definition files and Windows updates or patches.

The PC is quarantined on the VLAN until the virus is killed or the spyware activity on the PC stops.

False positives occur, but they're fairly rare (about one in every 50 or 60 quarantined PCs), Austin says. Creating a Snort rule for a new virus can take time. But once Shelob has been "fed" with the new rule, its web quickly picks up the infected PCs.

Shelob's creators are considering using the school's Windows Software Update Server to report which PCs have checked in, or not, for the latest updates. Any PC that has not checked in for, say, 30 days, would be forced to Shelob's web, where the end user would have to update Windows before being allowed to escape. Shelob also could be used to isolate users who are violating copyright laws, including those identified by the Recording Industry Association of America.