Re: Antispyware and Solaris

darklupine wrote: 
Greetings! My school is running a management tool called Campus
Manager. In order to have your computer on the network, you have to
download an ActiveX control and let it scan your computer, where it
checks to make sure your Windows, antivirus and antispyware are
updated. Obviously, this only works on Windows machines. I have no idea
what is going to happen when they force a scan at the beginning of next
semester, when it hits my shiny Solaris 10 install.

In order to give myself some ammunition incase it doesn't allow my
computer access to the network, I am trying to get my Solaris install
as close to the requirements as possible, with an updated antivirus, OS
and antispyware. The first two I have, however, the antispyware is
proving difficult.


Just install tripwire ( http://sourceforge.net/projects/tripwire/ )
or something along those lines.  It serves a similar purpose even
though it goes about it differently.

Years ago, I had a friend named Jeff who worked as a lab assistant in
one of the CS department's labs at the university we both went to.
Part of Jeff's job was to ensure nobody left clutter on the hard drives
of the DOS machines (I said it was years ago, right?) that were in
one of the labs.

So, Jeff wrote a program that resided on floppy disk and scanned the
PC's hard drive for (a) any files that should not exist, or (b) any
files that did not match the proper checksum, (c) any files that should
exist but didn't.  They weren't concerned about viruses at the time
(and spyware didn't exist); the purpose was just to eliminate scratch
data files that users would leave on the hard drives when they left,
since hard drives averaged around 20-40 MB back then and disk space
was precious.

Anyway, one day Jeff ran the program after the lab was closing and
it found a virus.  It wasn't meant to find a virus.  It was just
meant to detect changes.  But find a virus it did, much to his
surprise (and delight, since nothing else found that virus, and
they weren't regularly scanning for viruses anyway).

The point is this:  a good checksumming program will detect viruses,
spyware, and any other unintended changes to the system.

By the way, have you thought of configuring a firewall on the Solaris
machine so it's in "stealth" mode as much as possible, i.e. doesn't
respond to TCP SYN packets with a reset, doesn't respond to any ICMP,
and so on?  If your machine drops all incoming packets when they
scan it, perhaps they will just ignore it.  And even if they don't,
it's not a bad security practice, so you'll have a justification
for doing that.  :-)

  - Logan
.

Relevant Pages

  • Re: Typical Bray Ignorance - Mighty Mouse
    ... Even Apple's //'s had Hard Drives long before PC's were even around... ... Remember what I was saying about grandmothers and eggs, ... I had an ICE drive and an Omninet; I am fully aware of what was available for the Apple II - including the very existence of EXPANSION SLOTS in those machines. ... Not only did I have a Lisa when I was 10, but part of the reason I had one was because my family's firm was one of the first to use Macintosh computers, and one of the first to produce magazines using the system. ...
    (comp.sys.mac.advocacy)
  • Re: F7: Trying to figure out why kernel crashes with journal commit I/O error
    ... I just got 2 new computers, ... First I suspected a hard drive error on both machines. ... replacement hard drives came in. ... I tried using the original kernel that came with F7 ...
    (Fedora)
  • Re: Lab OS Choices
    ... Is there a benefit to performing pen tests on physical machines vs ... somewhere...then you lab can grow. ... I think I'd start with an unpatched Windows 2000 server. ... wipe the drives before you mess with 'em. ...
    (Pen-Test)
  • RE: Lab OS Choices
    ... I've found a few tests that worked against virtual machines but did not ... I also have some routers in my lab. ... to the client how to make their network more secure. ... I think I'd start with an unpatched Windows 2000 server. ...
    (Pen-Test)
  • Re: Lab OS Choices
    ... physical machines, ... somewhere...then you lab can grow. ... I think I'd start with an unpatched Windows 2000 server. ... wipe the drives before you mess with 'em. ...
    (Pen-Test)