University traps infected PCs in its web

Network World - ORLANDO -- A team of IT staffers at the University of Indianapolis last week showed off a bundle of open-source tools and scripts it uses to trap and isolate PCs infected by viruses or spyware.
Dubbed Shelob, after the sinister giant spider in J.R.R. Tolkien's The Lord of the Rings, the software identifies suspect traffic patterns, identifies the computers involved and then shunts them to a closed virtual LAN. Users get an appropriate Web screen, explaining what's happened and how to fix their PC or whom to call for help.
Shelob's inner workings were demonstrated here at Educause, the annual user conference for IT professionals in higher education. You can find one instance of Shelob in action in this January alert to students.
The school says that since being rapidly thrown together during the Blaster worm outbreak of 2003, Shelob has helped to keep it free of network or service outages related to virus infections. One limitation: it works only with clients that are plugged directly into the LAN, not wireless devices.
Shelob's creators are Shawn Austin, Matt Wilson, and Steve Corbin, all with the university.
To detect traffic anomalies, Austin says, the team wrote plug-ins for three open-source programs; Snort, an intrusion-detection program; Amavisd, an interface between message transfer agents and various content checking programs; and NMAP, a network scanner. A tool called Bleeding Snort keeps Snort's virus signatures updated daily. Using the output from these programs, Shelob populates a MySQL database table with a list of MAC addresses and other identifiers.
Shelob integrates with the school's own version of the open-source NetReg application, which is used to register an unknown DHCP client before it's granted full network access. When Shelob identifies an infected PC, NetReg assigns it a new IP address. Then, OpenVMPS (an open-source version of Cisco's VLAN Membership Policy Server) reassigns the port to which the PC is connected to a VLAN that only contains other infected computers.
Shelob then redirects the PC's DNS lookup requests to a Web server, which then delivers a page that tells the end user of the infection and gives instructions on how to clean it. The same Web page can be used to distribute McAfee's VirusScan, virus definition files and Windows updates or patches.
The PC is quarantined on the VLAN until the virus is killed or the spyware activity on the PC stops.
False positives occur, but they're fairly rare (about 1 in every 50 or 60 quarantined PCs), Austin says. Creating a Snort rule for a new virus can

Reprinted with permission from

For more information about enterprise networking, go to NetworkWorld.com
Story copyright 2009 Network World, Inc. All rights reserved.