12

At several places I've done some work at, I have a suspicion that some of the executives browse porn on their work computers. It appears this porn surfing has lead to virus infections on their computers despite the presence of an anti-virus. Filtering theses specific users' browsing is not an option, so what would be my next best solution be? I put Firefox + Adblock pro on their computers. I'm tempted to add NoScript, but I'm worried they'll start calling when noscript interferes with browsing on legit websites. Is there anything else I can due to mitigate this risk?

13 Answers 13

5

Might want to try a sandboxing app like Microsoft's Steady State: http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx

I'd also recommend a real time malware scanner, such as Windows Defender, on top of whatever anti-virus you're running. Perhaps add in a cloud based malware scanner like Threatfire or Prevx as well.

7

Use OpenDNS Low filtering and tell them that you are securing the company against malware, phishing, etc. You can put in legitimate exceptions by "Manag[ing] individual domains". They're not going to come to you to except porn sites, now are they? ;-)

Cheers

2
  • 2
    I already have exceptions for them in place for everything.... as per their request.
    – Brett G
    Jul 29, 2009 at 21:49
  • @Brett Well.... !!!
    – Alex Angas
    Aug 6, 2009 at 13:10
7

You say: "It appears this porn surfing has lead to virus infections on their computers despite the presence of an anti-virus.".

I see too many answers focusing on the porn aspect of the issue.

One might land on a porn type "trap site" even when searching for something as innocent as a cookie recipe or pcitures of the latest Corvette model.

Since you are already using an antivirus product, it is probably time to review its usefuleness and replace it.

But above else, you need to be certain what is actually causing the infections other than "..this porn surfing..."

2
  • I have yet to find an anti-virus product that catches everything....
    – Brett G
    Aug 5, 2009 at 4:40
  • -1 Does it really matter how they ended up at the porn site? Does it really matter if it even was a porn site?
    – Ian Boyd
    Sep 1, 2009 at 13:26
6

Use IE8 or Chrome, which run at a security level below standard user. Run them as a standard user on Windows XP/Vista, so that they cannot harm their machines.

And on Windows Vista: IE8 and Chome run at a lower integrity level.

2
  • 1
    Why not Opera or Firefox? Jul 29, 2009 at 19:20
  • @grawity Because Firefox and Opera cannot run at lower integrity levels (aka Protected Mode) as Chrome and IE can.
    – Ian Boyd
    Sep 1, 2009 at 13:24
3

Filter - but don't block porn. AV and page analysis at the gateway. Block exes. Show them how firefox is the porn fiend's browser-of-choice.

TBH, I would even be careful admitting you know why, never mind vocalising those thoughts... whatever you need to do has to be fair invisible to the user. Good luck!

2
  • AV and page analysis at the gateway?
    – Brett G
    Jul 29, 2009 at 21:54
  • Yeah - some kind of proxy which does AV (do you have an existing web filter that can do this, but still not block the porn?), perhaps has anti-malware URL lists, and maybe looks for suspicious javascript. Definitely block exes - those "codecs" (actually trojans) are some of the worst offenders.
    – Tom Newton
    Jul 30, 2009 at 16:28
2

Back when I first got into IT, I worked in a small mom-and-pop shop where we went to a lot of small offices. We'd work on their personal computers too for the same rate, and whenever there was a frequent porn surfer I'd just burn them a copy of knoppix, show them how to boot to a CD and go.

Edit: Have you tried addressing the fact that they are using work computers to look at porn with your boss? You may not have influence over them but someone up the chain can give them a "cmoonnnnnnn"

1
  • The OP does specify these are "executives" - not a lot of "up the chain" for them, usually... Jul 29, 2009 at 19:05
2

Another option possible option, install Hyper-V on their machine and once you have a clean .VHD of their computer setup you can let them go. Especially if they're using networked profiles this would allow them to trash their local machine and for you to restore the original VHD and their network profile will still be the same so you could have them recovered instantly.

Word of advice, I'd be very careful with bringing up the topic of why these computers keep having issues if they're at the executive level. Said to the wrong person you might end up with a pink slip.

4
  • 4
    Its good not to work in the US:)
    – James
    Jul 29, 2009 at 19:04
  • 3
    +1 on keeping your lips zipped. If it makes you uncomfortable, you should probably start quietly searching for a new job. Jul 29, 2009 at 19:06
  • You said it, aside from that the way I also see it, if they're an executive in a company and they feel they're entitled to look at porn at work I'd sure feel it's not my job to tell them it's not their place. If your company has a legal department (or even singular lawyer) you could consider working with them about drafting a new company memo about the dangers of porn in the work place, sexual harassment issues etc and make it just seem to be company wide information and they might really take to that themselves quietly. Jul 29, 2009 at 19:11
  • 1
    No, aside from mentioning it here... I'm never planning on telling anyone. I'm not going to dictate to them where they can surf and where they can't (which is why I have an exception for them in the web filters). The only thing I'm worried about is keeping the computer safe from viruses wherever they go on the web.
    – Brett G
    Jul 29, 2009 at 21:24
2

Sandboxie can be useful for this purpose. Generally it tries to intercept all disk and is stores them in a sandbox folder. I find it works particularly well when combined with instance of Portable Firefox.

1
  • Please note that it only works on 32 bit Windows (2000/XP/Vista/7), not 64 bit versions. Jul 29, 2009 at 22:50
2

Options I'd look into...

1) inline filtering. I thought I ran across this setup before; basically having HTTP traffic filtered for malware as they're surfing (filter for content of malware, not block the porn...wanted to make that clear). Something like the implementation for HAVP-Squid Secure Proxy or WebScan from this page. There may be others on that list too.

2) Sandboxie. There may be other software similar to this.

3) Faronics Deep Freeze; however, users can only save data to network drives, their profile, or external drives (or other partitions you configure for saving data to). When you reboot, the computer goes back to the way it was when frozen. We don't run antivirus on systems with this on it since anything that infects it will disappear at reboot (we found deleting c:\Windows to be cathartic...rebooting recovers the OS). This will still let them infect their profile but their system will be safe.

4) Use something like Partimage or other imaging software that will let you create hard drive snapshots in order to recover their systems when they're infected.

That's everything off the top of my head that I would explore as possibilities...

1
  • If you're looking at something like Deep Freeze preventing changes to persist across reboots, also take a look at Windows SteadyState: microsoft.com/windows/products/winfamily/sharedaccess/… It's a no-charge package from MS that may accomplish most or all of you likely would want Deep Freeze to be able to "re-fresh" a PC.
    – damorg
    Jul 30, 2009 at 14:07
1

There are ways to deal with these issues but you're going about it all wrong. First, you need to get your facts together. Suspicions and assumptions are useless. This is a simple and routine admin task.

  • Find out why the AV software appears to be ineffective and either fix or replace it
  • Find out where the infections are coming from, without the guesswork
0

My recommendation would be to find whitepapers from companies like Finjan, McAfee, etc that talk about "drive-by Malware". I recall that Finjan in particular has case studies about major retailers whose sites were hacked used to distribute malware.

Use that pretense to wave your hands and get a few executive-types excited, then use the chaos to implement a few improvements, like:

  • Upgrade to Vista/7
  • Have them run as unprivileged users
  • Provide them with an admin account without internet access
  • Install appropriate tools to protect the network (like a local firewall)

You also need to manage the political situation. If you have multiple people in IT, designate one the "Executive Support" person, and make executive work the priority 1 and track the work. When other projects drag, the reason becomes the amount of cycles that VP Fred and EVP Bob are using up. (Don't mention the porn) You can't just whine about it -- you must explicitly document it.

Keep in mind that you cannot solve the world's problems. If it is acceptable for people to use company assets to futz around with porn, your options are limited. Just make an honest effort to mitigate the risk to the enterprise as a whole, and cover your ass in the process.

-1

Enable a group policy that forces IE browser history to be kept for say 30 days. Then have it hide the tab that has the clear history on it. I think the tab can be hidden, I know you can set prevent them from clearing.

Make it company wide, it's simply a new security policy....... :)

Caught in the act would be what you're going for.

If not, then go with the CD idea. Release a company policy that says we understand when travelling one may need to use company assets for visiting personal sites. As such we are providing all laptop users with a bootable CD that will allow seperation of personal and company internet browsing. They'll clue into it without it actually being said.

or do both :) That forces them to use the CD.

-3

Give them a bill for your time fixing the PC and suggest they simply subscribe to a site. I'm sure it would be less expensive and give them a "clean" path to what they seek.

5
  • They are top executives ... company anyways would pay the bill and they wouldn`t care much . You know, you can make company to pay for computer fixing, but not for pr0n site :)
    – Kristaps
    Jul 29, 2009 at 20:05
  • If they're going to insist on using business resources for their non business habits, you should be able to straight faced suggest that they subscribe to an electronically safe source of content so that they do not trash their machines. After all, if this is condoned by management, why shouldn't a paltry monthly subscription be in order? Jul 29, 2009 at 20:28
  • 1
    I'd love to see the tax deducation for a subscription to "xxxmidgetsintightpants.com" explained to an auditor! Jul 30, 2009 at 0:11
  • 1
    There's nothing quite like telling the person who already pays the bills, or at least signs for them, that they have to pay you extra to fix their computer. Yep, that's one heck of a career move. Jul 30, 2009 at 5:41
  • Then again, if you can't explain it to the auditor...MAYBE you shouldn't be doing it Jul 30, 2009 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .