I've been wormed!

[agrimes]

Buried among millions of SLA warnings a warning about a worm came through, now it's loose. I don't know what ports it is using, there is no antivirus or any node-based security. I can delete the virus off of servers BUT IT INFECTS ROUTERS TOO WHICH CANNOT BE DISINFECTED!!!!!!!!!!!!!

I already downvoted this game but to implement this feature without any working tools is just mind boggling...

[suppocosia]

You can forcibly remove worms using the sftp command.

Before the worm event occuring, you'll be warned with an email about the looming threat (its potential source and ports).

[agrimes]

Look, even when I try to cleanroom the network, cleaning both servers and routers, the worm hides in the client machines too and whatever backdoor it's using is __FAST__. Without being able to find the port range it's on or lock some of the endpoints, I'm totally screwed. SCREWED!!! I say.

[agrimes]

ok, found the port scanner, so it is feasible to deploy firewalls...

[Donne]

I don’t have an sftp command and all my machines are infected. How do I get rid of the worm??

[KZ_RAD]

at that point its too late.
what i do is having saves for everyday for when something unexpected happens.
when you get the message that 2 different floors could have worm activity.
you add a firewall with the correct ports blocked to the one with the most users.
then after the time specified you know what user was the problem.
if its not the right one just reload the save and go put it on the correct one.

[RollTheBones]

Am I not understanding how this works correctly? I installed a brand new server behind a firewall with the correct ports blocked. With the tapper I can even see that no traffic from those ports or from the malware is penetrating behind the firewall yet I see the "worm activity" flash above the server and the malware is installed in the list of software on the server... Are firewalls useless or am I missing something?

[b0nehead]

Originally posted by RollTheBones:

Am I not understanding how this works correctly? I installed a brand new server behind a firewall with the correct ports blocked. With the tapper I can even see that no traffic from those ports or from the malware is penetrating behind the firewall yet I see the "worm activity" flash above the server and the malware is installed in the list of software on the server... Are firewalls useless or am I missing something?

Make sure your firewall sits between the users and your back end. Cabled seperately and joined by the firewall alone.

For example. User/switch/unsafe side to port0 and port1 to router or wherever else. It sits in between not inline.

Make sure that you have in netsh:

firewall default deny on (firewallHaddress) *this will block all traffic

then you can:

firewall allow tcp/23 on (firewall)
firewall allow tcp/80 on
firewall allow tcp/443 on
etc etc

This will block everything EXCEPT for what you allow through. Much easier control. Use SFTP to copy the tables from firewall to firewall so you don't do it manually. Keep a spare master firewall to update and copy from. Keep notepad with copy paste fast commands. Or use Cron and automate <--highly suggested.

All users go to switch and/or firewall directly segmented from the entire network. It can infect routers but switches can be on the dirty side.

If already infected, slow down time and separate everything. The router also needs to be cleared of the worm with sftp. (obviously really bad if your tower is huge)

[Thomas595]

Originally posted by suppocosia:

You can forcibly remove worms using the sftp command.

Before the worm event occuring, you'll be warned with an email about the looming threat (its potential source and ports).

hey dev, can you let us know how we are supposed to track down the worm location before it activates? It gives a range of two floors (floor 1 and floor 6) but how do we know who its actually coming from? Also, where are we supposed to deploy firewalls? Its unfeasible to place a firewall before every user/producer port yet not doing so will result in the infection of at least one switch or router, if not the entire network. Plus there is a high chance your first worm will occur before you even have access to SFTP.

[b0nehead]

Originally posted by Thomas595:

Originally posted by suppocosia:

You can forcibly remove worms using the sftp command.

Before the worm event occuring, you'll be warned with an email about the looming threat (its potential source and ports).

hey dev, can you let us know how we are supposed to track down the worm location before it activates? It gives a range of two floors (floor 1 and floor 6) but how do we know who its actually coming from? Also, where are we supposed to deploy firewalls? Its unfeasible to place a firewall before every user/producer port yet not doing so will result in the infection of at least one switch or router, if not the entire network. Plus there is a high chance your first worm will occur before you even have access to SFTP.

You make your own defense so you can ignore it. Switch can be on the dirty side.

Example:
Users>switch>firewallport0/1/ ||||||||||||||||| firewallport2/3/4/etc TO Router
or
User>firewall>etc

Netsh: firewall default deny on 123 (alll ports blocked)

firewall allow tcp/23 on 123 (allows only this port)
etc etc ports

[RollTheBones]

Originally posted by b0nehead:

Originally posted by RollTheBones:

Am I not understanding how this works correctly? I installed a brand new server behind a firewall with the correct ports blocked. With the tapper I can even see that no traffic from those ports or from the malware is penetrating behind the firewall yet I see the "worm activity" flash above the server and the malware is installed in the list of software on the server... Are firewalls useless or am I missing something?

Make sure your firewall sits between the users and your back end. Cabled seperately and joined by the firewall alone.

For example. User/switch/unsafe side to port0 and port1 to router or wherever else. It sits in between not inline.

Make sure that you have in netsh:

firewall default deny on (firewallHaddress) *this will block all traffic

then you can:

firewall allow tcp/23 on (firewall)
firewall allow tcp/80 on
firewall allow tcp/443 on
etc etc

This will block everything EXCEPT for what you allow through. Much easier control. Use SFTP to copy the tables from firewall to firewall so you don't do it manually. Keep a spare master firewall to update and copy from. Keep notepad with copy paste fast commands. Or use Cron and automate <--highly suggested.

All users go to switch and/or firewall directly segmented from the entire network. It can infect routers but switches can be on the dirty side.

If already infected, slow down time and separate everything. The router also needs to be cleared of the worm with sftp. (obviously really bad if your tower is huge)

Maybe that's what I did wrong. I denied the infected ports I could see (tcp/510*519) instead of denying everything else and allowing what I wanted.

I might have to try that again, thanks.

[Ferro]

Originally posted by RollTheBones:

Maybe that's what I did wrong. I denied the infected ports I could see (tcp/510*519) instead of denying everything else and allowing what I wanted.

I might have to try that again, thanks.

well firstly, * is a wild card, not a statement of tcp/510 through 519.
at the current state of the game its safe to do tcp/51* and tcp80**, those two will protect you from worms and text scrape.

though too be honest I prefer working in a white list mode and have actually made an alias for it.

alias setfirewall firewall allow icmp on $1;firewall allow tcp/23 on $1;firewall allow tcp/80 on $1;firewall allow tcp/443 on $1;firewall allow tcp/3306 on $1;firewall allow tcp/5432 on $1;firewall allow tcp/8333 on $1;firewall allow udp/53 on $1;firewall allow udp/67 on $1;firewall allow udp/554 on $1;firewall allow udp/520 on $1;firewall allow udp/5060 on $1;firewall allow udp/6343 on $1;firewall default deny on $1

you'll only need to run the above once. then to use it type:

setfirewall <firewall adress>

and it'll set the rules to allow legitimate traffic through and block everything else.