IT offensive short-circuits computer worms and viruses

3:30 p.m., Sept. 9, 2003--The University of Delaware was able to avoid major disruptions from computer viruses and worms because move-in day, Aug. 31, was later at UD than many campuses. Computer staff learned from what was happening elsewhere and set up a testing lab to outwit the worm.

“We lucked out because we started later than some other universities, and we heard some of their horror stories,’’ Jason Cash, manager of systems in Information Technologies-Network & Systems Services, said.

With more than a month between the creation of the computer worms that invaded Microsoft Windows-equipped computers and UD’s move-in day, Information Technologies staffers were able to create a testing lab where they set up machines to infect each other and used a “honeypot” machine to try to attract attackers that might potentially victimize campus machines. They also were able to employ new hardware to fight the hackers.

Staffers also sent letters to incoming students instructing them how to clean their machines before they arrived on campus.

Machines that were still vulnerable when they arrived on campus were not connected to the network until they were patched so that the worm or hackers could not invade them.

Because the worm can invade a vulnerable machine in less time than it takes for a student to download an anti-worm patch, the University made hundreds of copies of a CD that would allow students to patch their computers in their dorm rooms before hooking up to the University’s network.

The Wednesday before classes began, staffers worked past midnight installing new hardware that partitioned the University’s Internet address space so that any infected machines could only infect up to two other machines. Unpartitioned addresses would have left up to 250 Internet addresses vulnerable to attack from any one computer, Daniel Grim, executive director of Network & Systems Services, said.

Cash said staffers are still finding one infected machine on campus each hour, but they are able to disable them before they affect many other machines.

IT staffers tested 4,700 computers on move-in weekend, he said, and 421 were found to be vulnerable to worms or hackers. Of those, 395 were quickly patched. The percentage of vulnerable computers was far smaller than on campuses that opened earlier, he said.

Kathy Beardsley, manager of the campus help center, said staffers were on the phone nonstop from 7 a.m. to 5 p.m., beginning on move-in Sunday. Students asked how to run the CDs that provided computer patches, where the electric outlets were and how to hook up their telephones.

“On the whole, I think things went pretty well,’’ Beardsley said. “Most of the students are pretty computer-savvy.’’

Carol Anderer, manager of IT-User Services, said one challenge for staffers was helping foreign students set up computers that use Windows XP—in Japanese or German.

Across the entire campus, only 76 computers were shut down because of the worm over the weekend.

Article by Kathy Canavan

E-mail this article

To learn how to subscribe to UDaily, click here.

[an error occurred while processing this directive]