School traps infected PCs in its web

School traps infected PCs in its web

A team of IT staffers at the University of Indianapolis last week showed off a bundle of open-source tools and scripts it uses to trap and isolate PCs infected by viruses or spyware.

Dubbed Shelob, after the sinister giant spider in J.R.R. Tolkien's "Lord of the Rings," the software identifies suspect traffic patterns, identifies the computers involved and then shunts them to a closed virtual LAN. Users get an appropriate Web screen, explaining what's happened and how to fix their PC or whom to call for help.

Shelob's inner workings were shown off last week in Orlando, at Educause, the annual user conference for IT professionals in higher education. You can find one instance of Shelob in action in this January alert to students.

The school says that since being rapidly thrown together during the Blaster worm outbreak of 2003, Shelob has helped to keep it free of network or service outages related to virus infections. One limitation: it works only with clients that are plugged directly into the LAN, not wireless devices.

Shelob's creators are Shawn Austin, Matt Wilson, and Steve Corbin, all with the university.

To detect traffic anomalies, Austin says, the team wrote plug-ins for three open source programs, Snort, an intrusion detection program, Amavisd, an interface between message transfer agents and various content checking programs, and NMAP, a network scanner. A tool called Bleeding Snort keeps Snort's virus signatures updated daily. Using the output from these programs, Shelob populates a MySQL database table with a list of MAC addresses and other identifiers.

Shelob integrates with the school's own version of the open-source NetReg application, which is used to register an unknown DHCP client before it's granted full network access. When Shelob identifies an infected PC, NetReg assigns it a new IP address. Then, OpenVMPS (an open-source version of Cisco's VLAN Membership Policy Server) reassigns the port to which the PC is connected to a VLAN that only contains other infected computers.

Shelob then redirects the PC's DNS lookup requests to a Web server, which then delivers a page that tells the end user of the infection and gives instructions on how to clean it. The same Web page can be used to distribute McAfee's VirusScan, virus definition files and Windows updates or patches.

The PC is quarantined on the VLAN until the virus is killed or the spyware activity on the PC stops.

False positives occur, but they're fairly rare (about 1 in every 50 or 60 quarantined PCs), Austin says. Creating a Snort rule for a new virus can take time. But once Shelob has been "fed" with the new rule, its web quickly picks up the infected PCs.

Shelob's creators are considering using the school's Windows Software Update Server to report which PCs have checked in, or not, for the latest updates. Any PC that has not checked in for, say, 30 days, would be forced to Shelob's web, where the end user would have to update Windows before being allowed to escape. Shelob could also be used to isolate users who are violating copyright laws, such as those identified by organizations such as the Recording Industry Association of America.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.


ARN Innovation Awards 2022

Innovation Awards is the market-leading awards program for celebrating ecosystem innovation and excellence across the technology sector in Australia.

EDGE 2022

EDGE is the leading technology conference for business leaders in Australia and New Zealand, built on the foundations of collaboration, education and advancement.

Brand Post

Show Comments