School Traps Infected PCs

ORLANDO -- A team of IT staffers at the University of Indianapolis recently showed off a bundle of open-source tools and scripts it uses to trap and isolate PCs infected by viruses or spyware.

Dubbed Shelob, after the sinister giant spider in J.R.R. Tolkien's "Lord of the Rings," the software identifies suspect traffic patterns, identifies the computers involved and then shunts them to a closed virtual LAN. Users get an appropriate Web screen, explaining what's happened and how to fix their PC or whom to call for help.

Shelob's inner workings were demonstrated at Educause, the annual user conference for IT professionals in higher education, here.

How it Works

The school says that since being rapidly thrown together during the Blaster worm outbreak of 2003, Shelob has helped to keep it free of network or service outages related to virus infections. One limitation: it works only with clients that are plugged directly into the LAN, not wireless devices.

Shelob's creators are Shawn Austin, Matt Wilson, and Steve Corbin, all with the university.

To detect traffic anomalies, Austin says, the team wrote plug-ins for three open source programs; Snort, an intrusion detection program; Amavisd, an interface between message transfer agents and various content checking programs; and NMAP, a network scanner. A tool called Bleeding Snort keeps Snort's virus signatures updated daily. Using the output from these programs, Shelob populates a MySQL database table with a list of MAC addresses and other identifiers.

Shelob integrates with the school's own version of the open-source NetReg application, which is used to register an unknown DHCP client before it's granted full network access. When Shelob identifies an infected PC, NetReg assigns it a new IP address. Then, OpenVMPS (an open-source version of Cisco's VLAN Membership Policy Server) reassigns the port to which the PC is connected to a VLAN that only contains other infected computers.

Shelob then redirects the PC's DNS lookup requests to a Web server, which then delivers a page that tells the end user of the infection and gives instructions on how to clean it. The same Web page can be used to distribute McAfee's VirusScan, virus definition files and Windows updates or patches.

Related Projects

The PC is quarantined on the VLAN until the virus is killed or the spyware activity on the PC stops.

False positives occur, but they're fairly rare--about 1 in every 50 or 60 quarantined PCs, Austin says. Creating a Snort rule for a new virus can take time. But once Shelob has been "fed" with the new rule, its Web quickly picks up the infected PCs.

Shelob's creators are considering using the school's Windows Software Update Server to report which PCs have checked in (or not) for the latest updates. Any PC that has not checked in for, say, 30 days, would be forced to Shelob's web, where the end user would have to update Windows before being allowed to escape.

Shelob could also be used to isolate users who are violating copyright laws, such as those identified by organizations such as the Recording Industry Association of America.