Safe Computing

This page is the default web site for the Case Quarantine Network. If you have been automatically directed to this page, then your network faceplate has been quarantined for security reasons. This quarantine network is isolated from the regular Case network to protect other systems from malicious network activity yet provide a means for the end user to remediate the problems which are common causes for the quarantine process. You need to contact the Case Help Desk (368-HELP) as soon as possible.

You will have 30 calendar days from the original quarantine date to address problems with your computer. If a user has not contacted the Help Desk about a quarantined faceplate, the computer associated with the quarantine decision will be de-registered from the network (both wired and wireless). To restore network services, the user will be required to bring the affected computer to a Case walk-in center, have the system evaluated and cleaned, and pay a network restoration fee.

While on the Case quarantine network, the user's computer will have restricted access to the Case networks. Services that are available on the quarantine network are:

mail.case.edu Users can use the Case webmail client to communicate with Help Desk support personnel.
Microsoft's WindowsUpdate service is available to run updates to the Microsoft Operating systsem.
Symantec LiveUpdate can be run from this network to scan and clean an infected computer.

These are the next steps that you should do in order to get your faceplate back onto the Case network as quickly as possible:

The PerceptIS Call Center has already been notified about your quarantine. Call the Case Help Desk at 368-HELP (4357). If there are more computers on the same faceplate (e.g. your room-mate or other lab PCs) your computer may not be the infected one, or may not be the only infected one. Tell them that you are on the quarantine network. Please do not unplug or move your computer. (Note that during some quarantines which are part of a security incident response a technicial analyst may be dispatched to evaluate the computer. If this is the case the Help Desk will inform you to leave the computer unmodified until a first-responder has evalauted the computer.)
The Help Desk will guide you through a clean-up process.
You need to WindowsUpdate and install all Critical Updates. You can do so by clicking here. It is helpful to have Automatic Updates configured.
Update your Symantec antivirus definitions and run a full system scan. Note that antivirus products will find a problem if there is a known signature.
Update your spyware scanner's definitions and run a full system scan.
If your system has a root-kit installed, back up your data and prepare to rebuild. Experience has shown that the time spent cleaning often breaks OS functions, and is better spent in rebuilding the installation and configuring for more managed operations.

Please note the results of each step or if you are unable to perform them.

Common reasons for a quarantine:

part of a larger security incident- to prevent spreading of malicous software
an infected host with a spyware or 'bot client, usually identified as scanning the Case network or excessive malicious activity on network sensors
a user performing activities in violation of the Case Acceptable Use Policy (probing, scanning, unsanctioned 'security testing' of the hosts on the network)
any host that exceeds the mail transfer threshold is auto-quarantined to prevent spambots from causing the case.edu domain from being blacklisted (this has happened to Windows and unix hosts)

What are the root causes of these problems (as reported by the Help Desk)?

"The user was running Windows XP SP1 and had not updatded patches in a long time"
The user had been attacked via AOL Instant Messaging
The user installed a peer-to-peer music service that was vulnerable to network attack.
The server was running a version of Apache which was in need of patching; it was administered by a third party services.
The user's system was compromised by a malicious spam email message that used the WMF extension overflow.
A faculty member demanded the server run an ftp service so they could scan images with the copier and upload them the server. The ftp service was world-writeable, and the server became a covert server for pirated german-language movies.