Could RES Workspace Manager have prevented the spread of the xDocCrypt Virus?

Written by Patrick Kaak

Translation & editing, Max Ranzau.

Editors note: This article is an english translation of Patrick's original Dutch article, available here. If my translation leaves room for improvement (80% Google, 20% guesswork :), feel free to comment.

Recently, the Netherlands and the rest of the world has been under the spell of a nasty piece of viral code, spreading quickly, causing damage to office documents. This virus is called xDocCrypt / Dorifel. Most virus scanners did not have the signature of the virus in time, hence there's already quite an outbreak on the loose. Most are however updated at this point

The xDocCrypt virus does not infect a computer in the usual manner. Normally, a virus enters a system via infected external drives, via downloaded files or arrives by mail. In the case of xDocCrypt, the virus is downloaded and installed by existing malware (Citadel / Zeus) which already is on the computer. This software is already sitting dormant on the machine, routinely connecting to a server hosted by it's creator, waiting for orders. The order in this case is downloading a virus, which once active will start infecting documents. It appears the malware payload now includes a new virus (Hermes), which can cause even more damage as it focusses on obtaining bank details.

As virus scanners may be slow to learn and intercept the virus, the question must be asked. Is there a way to prevent this from happening preemtively?. Our answer to this is that you can never prevented 100% off all attacks but you can sure make it very difficult by means of a good Workspace Management security solution.

If we look at Microsoft Windows itself, we already have an option to block the virus from starting by using the AppLocker feature in Windows Vista, 2008 or higher to protect against the execution of unknown binaries. RES Workspace Manager provides a similar yet much more flexible feature, which blocks the launch of executables that the user has no rights to, or that are unknown in the system. Configuring things like this usually would take a lot of time as you specify exeptions on a whitelist of allowed executables. Fortunately RES Workspace Manager has the ability to quickly learn what the user should be allowed to execute. In addition to these learned authorizations, the executables for the managed apps assigned to a given user, are automatically authorized by WM for only that user. Another advantage of the Workspace Manager, is that a user can launch applications which normally requires administrative privledges.

Additionally the RES Workspace Manager can log any executables being blocked. These logs can be forwarded to any administrator or security officer via email or SNMP through the Workspace Manager Alerting feature (available in the Advanced Administration module, Ed.). This is a great way to detect the initialization of the Citadel / Zeus malware, as these will be unknown executables.

Besides Application Security, RES Workspace Manager also has a Network Security feature. This feature makes it possible to white- or blacklist individual executable's TCP/UDP access to given IP ranges. If you chose a whitelist approach and the virus was already present on your network, it would never get any access to the outside world, being blocked by the Workspace Manager. Alternatively, knowing the servers where the virus downloads from, one could also employ a blacklisting scheme to block any traffic to/from those sites.

Finally, the Read-Only Blanketing security feature in RES Workspace Manager provides a good protection against writing to the local disks. This ensures that unauthorized processes/applications can't deposit any kind of data payload on for example the system drive. Read-Only Blanketing will per design not protect the following paths:

• The Recycle Bin on each local drive (so user's actually can delete files)
• %allusersprofile% and %userprofile (where %appdata% resides per default)
• Tmp and temp locations (user processes may write data here)
• Spool directory (if write permissions were removed here, users couldn't print)Debug\usermode in Windows folder
• The server console

However, in the case of the malware discussed here, this feature will not be able to protect you as the malware stores it's payload under %appdata%. Since the virus lives in the user's profile, there is something to be said about how you handle your profile. If you use the combination of a Mandatory Profile with RES Workspace Manager's User Settings feature, you can explicitly specify what is to be retained when the session is ended and the profile and it's contens (including the virus) are henceforth destroyed. That would not be the case with default configured roaming profiles.

The above features RES Workspace Manager are suggested to work with the advice given by the Dutch National Cyber Security Center of the Ministry of Security and Justice. The configuration of any Workspace solution, however, is not just something you do in a few minutes without knowing what you're doing. For more information, please visit my company at Centric.eu. There you can also read more about how to resolve the damage caused by the virus, specifically what ports and hosts to block.

Sources:

• damnthoseproblems.com
• blog.fox-it.com/2012/08/09/xdoccryptdorifel-document-encrypting-and-network-spreading-virus/
• ressoftware.com

Closing note: While RES Software has never intended nor marketed the Workspace Manager product as an antivirus solution, it is self-evident from the examples above that the 6 current security subsystems may be employed to take a huge bite out of the looming threats of malware, spyware and vira floating around out there. As they say; an ounce of prevention is worth two pounds of cure. While we're at it, you might also want to have a look at the RESguru article here, which discusses working with the RES Workspace Manager's security model.

Combining non-persistent images and user installed applications – A really bad idea!

This article stems from that the fact that I’ve been asked several times the same question: “So, I’m looking to do VDI, and I want to use non-persistent / perishable images – but at the same time I want to allow my users to install their own apps. Can you software support that?”. That is what I’m going to address in this article.

For those of you wondering, this article had initially absolutely nothing to do with the whole Citrix/Ringcube thing, as I started writing a month prior to the press release last week. However since it’s a now a reality, it needs to be factored in. I now get questions like; “So, the RingCube/Citrix acuquisition – how does it affect RES?“. The short and precise answer is:

Not At All.

If I was in the business of, oh say… User Virtualization, perhaps I would have reason to worry, however neither layering nor virtualization has ever been in RES Software’s technology sphere. Seen from the point of the RES Workspace Manager, the RingCube offering is just another carrier platform, into which we can inject dynamic settings and manage security on top. Another thing to be aware of: Security around a layered environment is still very relevant to be managed as I presume that certain applications, such as games, torrent clients and other non-business apps aren’t wanted there either. The RES Workspace Manager can control what you are allowed to install, on a very granular level. I will explain this further into this article…

Read more »

New Intel-RES Whitepaper

From the VDX Inside dept. On behalf of my good colleague Jeff Fisher, I would like to share with you all a new whitepaper which was joint developed by Intel Corporation and RES Software.The paper highlights the value add of RES VDX, when dealing with the challenges of deploying server-based VDI.  Intel has been running a campaign around “Intelligent Client” for a while now, with the goal of evangelizing a hybrid approach to Desktop Virtualization. Clearly Intel as well as RES Software believes that one size doesn’t fit all. As a consequence Intel has created messaging which states (and I happen to agree with this), that although there is a time and place for VDI in the enterprise, a wholesale move to this kind of environment doesn’t make sense because it ignores increasingly capable rich endpoints.

Obviously, this is a great fit with RES Software’s VDX technology and Intel has been working with it for around 6 months now.  They are showcasing VDX in a number of demo environments, including their client virtualization lab in Folsom, CA, which is often visited by Intel enterprise business development managers and their customers. As a result, Intel have started a joint effort with RES Software around VDX and Intelligent Client which so far has seen us included in both a media event they held about a month ago (see Jeff’s post here), a Cloud Builder event that we attended last month in Belgium and now, a published white paper that I’ve attached for your use. The whitepaper contains some very interesting benchmark numbers to contemplate.

You can download the whitepaper right here: