Updaters are now available to migrate to 1.0.24

All,

The updater files for migration to 1.0.24 are now posted. The updaters will install the new product, uninstall old product if you have it and then load your new drivers. Migration can be done from any Immunet build from 1.0.14 up to current (1.0.24). You will be prompted for a reboot as we are replacing drivers with this install. Windows XP SP2 is not supported, only XP SP3 and up. Vista SP1 + and Windows 7 are also supported.

The Immunet Protect Beta 1.0.24 32 bit Updater is: Here
The Immunet Protect Beta 1.0.24 64 bit Updater is: Here

Next week or the week after we will be shipping 1.0.25 which is purely a bug fix release. We will also ship updaters for this coming build.

Announcing Immunet Protect Beta Build 1.0.24 – We are in the home stretch!

We’ve now shipped Immunet Protect Beta Build 1.0.24(67). This build represents our introduction of the new ETHOS Protection engine as well as a series of detection improvements to our current Cloud Engine technologies. 

ETHOS Protection is a 'Heuristic' based engine. ETHOS Protection is specially designed to find threats 'generically' and then send them to the cloud so people in the Immunet Community can be protected from them at the same time as you detect them.  ETHOS examines every file executed, downloaded and flash scanned. If you’re wondering what this means in practical terms it is this; our detection rates jump at least 3 times with this new offering.  For the next several weeks ETHOS will be ‘on the job training’. This means the engine will be reviewing data but not yet ‘convicting’ it.  At the end of the ‘training period’ we’ll flip the on switch and people should start seeing a marked increase in malware detections!

This release also marks the beginning of the home stretch for us. We expect only one more build to ship before April, and that will only be shipped if we need to address urgent in-field issues. Our efforts are now going to be directed at getting our 2.0 release shipped to you all by late April or early May. The April release will showcase 2 more engines, a brand new UI and some very exciting and novel features which do not exist in the Anti-Virus community today. Between here and there we’d ask for your patience. We will be heads down getting this work done and may not be as responsive we would like between here and there.

If you are currently running a previous version of Immunet Protect we suggest you do not upgrade right away. We are going to ship a set of updaters to do the work for you so you do not have to uninstall and then re-install manually. These updaters should be out within the next day or two and when they are we will announce them on our Community Forum. Of course, if you really want to upgrade manually, please feel free to do so.

Nicht mehr den Internet Explorer?

For all my German-speaking friends I will start by apologizing if I butchered the title. I was hoping to query "No more Internet Explorer?” That question is probably being asked a fair bit in Germany and France right about now. Both governments recently advised their constituencies to ditch IE in favor of other browsers.

I'd have to be on record that I think this is poor advice because it's at best a short-term fix. It's true that IE has had a long history of security vulnerabilities, but this is also true for all browsers that have been around long enough and have a large enough user bases. 

The more functionality we push into browsers, the more complicated the web becomes, the more we have to add to our browsers to compensate. 'More' in this case means more code, more code means a higher likelihood of mistakes of which some portion will be software vulnerabilities that will be exploited. It's all math at the end of the day and Firefox, Safari and Chrome are no more immune to it than IE.

What makes IE more dangerous is that it has a larger following. People looking to exploit software vulnerabilities for profit are generally going to follow 'Sutton's Law'. Willy Sutton was a famous bank robber who when asked why he robbed banks replied, "Because that's where the money is". People research IE and exploit it's vulnerabilities because it has the largest user base. If you incite people to abandon it in favor of other choices those other browsers will start to suffer the same fate. This is not a problem that's going to be solved as simply as changing browsers.

My advice, consistently, is this:

1. Upgrade to IE 8 - it's much better.

2. Get off XP to Windows 7 if you can.

3. Turn on automatic Windows Update.

4. Run up to date Anti-Virus software

Don’t Want Some Other PC’s Koobface?

Twitter viruses, Facebook viruses and the host of other social networking attacks have reintroduced the world to why malicious code have been dubbed ‘viruses’. An infection starts with one person and spreads through online contact. Social media is thus akin to locking your PC in a room with 10,000’s of other PCs – one sneeze and you’re toast.

Don’t want some other PC’s Koobface, nor do you want self-imposed Facebook isolation for PC health reasons?

This week, Facebook and McAfee joined forces to offer social network virus protection. We think this is a good first step and overlaying Immunet Protect is an even better one. Immunet’s community focus plus the Collective Immunet protection feature is ideal for users on Facebook, and our side-by-side install support with McAfee means no hassle, no fuss. In particular, our footprint (less than 5 megabytes), speedy performance (instant, real-time threat evaluation) and community strength (50,000+ users collectively protecting each other) make a very effective antivirus booster-shot if you’re using McAfee already.

Of course, if you’re concerned about social network hygiene and aren’t interested in investing in yearly license renewals (McAfee on Facebook is only free for six months), well, get Immunet Protect today - it’s free and always will be. 

Watch out for Haitian Disaster Malware Attacks

The US-CERT warned yesterday of potential PC threats via fraudulent search engine results returning malicious links to phishing and malware websites. It’s hard not to follow this unfortunate event as the drama continues to unfold, so make sure your antivirus is up to date as you follow news links and browse content through social network sites.

If you and your community are using ours (Immunet Protect), you’re covered, since we’re cloud-based there isn’t a delay in pushing updated definitions to your PC (it’s always up-to-date).

Beyond a good antivirus program, US-CERT is encouraging people to take the following steps to protect themselves:

• Do not follow unsolicited web links or attachments in email messages.
• Review the Federal Trade Commission's Charity Checklist.
• Verify the legitimacy of the email by contacting the organization directly through a trusted contact number. Trusted contact information can be found on the Better Business Bureau National Charity Report Index.
• Refer to the Recognizing and Avoiding Email Scams (pdf) document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

SANS, Security Bloggers Network and the other usual suspects are doing a good job of spreading the word, so hopefully this doesn’t turn into a large outbreak.

Why you should be skeptical of Google's motives for pulling out of China

If you are part of any community for long enough you become immersed in a great deal of unspoken, but well understood realities. The computer security industry is such a creature. It’s perhaps more true in this industry than in others because it’s a relatively young industry and many people who have been it in for a long time tend to know each other, and often know each other well. People talk in this industry and while discretion to the outside customer might be a virtue, internal to the community that virtue is, let’s say, somewhat porous.

One of the general truths that you learn when you spend enough time in this industry is that state sponsored hacking is commonplace. It’s been commonplace for well north of a decade (or two) and while it’s not generally tough to recognize it for what it is it can be career ending or financially ruinous to discuss it. Governments buy a lot of product and spend a huge outlay on services each year from the security industry. I think we all know it’s bad practice to bite the hand that feeds you.  This state sponsored activity is hardly limited to China of course. Any country with a GDP worth mentioning likely participates in it to some degree.  China just happens to be more aggressive about it than most and it tends to get caught more often.

So what about Google? This is a company, which can hardly be a stranger to this reality. Their security staff is plumb full of sharp edged veterans who know the score. The attack types seen recently are not even remotely new or novel and it’s not likely the first time Google has been targeted (even successfully). If you have been following this story you know (or have read) that doctored Office attachments in email and Instant Message traffic were targeted at selected individuals. These individuals were exploited which resulted in their machines being compromised. Once their machines were compromised they became gateways into their corporations. This is not new either. In fact I would wager it’s nearly a daily occurrence.

So what then is Google’s sudden cause for umbrage? I don’t know but I can say for certain we do not have the full story here. I expect more will follow over time. For years they’ve been willing to abide by China’s onerous net censorship rules in order to happily take advantage of cheap labor, a market presence in china, and revenue from Chinese adwords. Now, they are speaking of leaving because they’ve been personally attacked. The message as I see it from Google is this “We’re happy to curtail the freedoms of others, so long as you don’t do wrong by us personally”.  

When should I update my Immunet Protect Beta?

Well, that’s a good question and not one that we have been clear enough about. This post will hopefully remedy that! Currently the Immunet Protect Beta has the ability to auto-update itself when it’s flagged from our cloud. We have not flagged an auto-update for the last 4 releases. If you are running Immunet Protect 1.0.18 or up there is no reason to manually upgrade at this point unless your trying to fix an issue and our Support group has asked you to upgrade. Our next release is 1.0.23, we’ll post and let you know our thoughts on that one as we get closer to it (it’s going into QA today). 

It’s important to remember that much of the functionality we build in (like our recent rollout of white listing) is driven from our cloud, not our desktop product. So often when we build new functionality you do not need to upgrade to take advantage of it. The same is true of many (but not all) of our virus detection technologies as well.

The reason we are not forcing people to upgrade (through our auto-update) feature is that we are trying to keep people in their builds as long as possible as long as they have no stability issues. This allows us to ‘persistence test’ over the beta period to watch how our software behaves in-field.

When we hit a point with our release schedule where we feel there is really protective (or stability related) benefit to people upgrading, we will perform an auto-update. This will certainly happen by April, quite possibly before. Once we pass out of beta (Immunet Protect 2.0) we will have fully scheduled update features, automated update etc. exposed in the product.

Cheers,

Al

Don't Be Victim to Black (Hat) SEO: Think Before You Click AND Protect Against Malware

In this month's Virus Bulletin, Microsoft's Terry Zink recounts "The top ten spam, malware and e-security stories of 2009" and talks about Black SEO (#7 on his list of top 10 spam/malware stories of 2009):

"7. Black SEO

One of the biggest trends in spam over the past two years has been Black Search Engine Optimization, or Black SEO. 2009 was not the year it started but it certainly was the year in which it really accelerated.

Black SEO comes in two main flavors:

1. Malvertising – This is when sponsored links at the side of the screen in search engines come up, and they are links to malware (which you have the honor of paying for if you so desire).
   
   
2. Page Rank Optimization – This is when a spammer uses various sundry techniques to get his spammy pages near the top of a search result, such as when a user searches for ‘Jessica Biel’.  Of course, there is no ‘Jessica Biel’ but instead is a spam landing page.

Black SEO in each flavor destroys the confidence of the end user. As spam became less profitable except to the elite spammers, they moved onto other techniques and Black SEO is the growth industry of 2009."

VB Subscribers can access the full article by clicking here. Or go to Terry Zink's Anti-malware Blog here.

Black SEO and other malicious methods used by spammers, hackers and scammers to steal sensitive credentials and financial data from consumers are only increasing with the rise of social networks. As millions more users flock online to connect through Facebook, Twitter and other social network sites, the target audience for cybercriminals and the possible financial gain (or loss to consumers) is immense.

Now, as more sites gain access (with your consent) to your Twitter and Facebook login credentials, the risk of having your accounts hacked so that spammers can tweet or post spammy links on your behalf increases. Think your social network account is somehow safe from being hacked? Think again! See Mashable's "Famous Twitter Users Get Hacked" post, and you'll see no one is immune - not even entire Facebook Groups (see Mashable's "WARNING: Facebook Design Flaw Abused; Hundreds of Groups Hacked") or the Chairman of the FCC (FCC Chairman's Facebook Account Got Compromised).

The Bottom Line: Users must constantly be wary of clicking on links when they are unsure if they come from reputable and trusted sources. Even advertisements and text links found on legitimate sites such as Google are not always assured to be malware free. Clicking on a friend's Tweet or re-tweet if their account has been unknowingly hacked can also result in malware, as can any links posted to Facebook Walls. Cybercriminals hack accounts not only for the exploit of embarassing the poor account owner, but mostly for the purpose of spreading malicious software (malware). Ultimately, you must think BEFORE you click on anything. Then go the extra mile to ensure you are protected in case of threats.

Protect Yourself, Protect Your Community/Social Network

To ensure that you aren't downloading malware or unknowlingly spreading it across your social network, consumers must protect themselves with the proper security tools, including AntiVirus. Just having AV protection isn't enough, however, and users must ensure that their AV protection is not only ON, but also up-to-date and able to ensure a sufficient detection level to catch malware fast enough before it's too late.

Our analysis of Immunet's current userbase of 48,000+ users shows that MOST users were unprotected prior to downloading our free Immunet Protect AntiVirus! Over 76% of Immunet users currently have Immunet Protect as their only form of AV protection. Translate that figure to the Internet community as a whole, and you have a significantly exposed population that lies vulnerable to all malware threats. One benefit of having Immunet Protect specifically is that any one threat encountered by a single user in the Immunet Community translates to ALL users in the community being protected from that same threat simultaneously. That is the power of Collective Immunity.

Do you know someone who is currently unprotected? If yes, please share Immunet Protect free AntiVirus with them by forwarding this link: http://www.immunet.com/user/new -- Get Immunet Protect Free AntiVirus.

Immunet Protect is free, lightweight, fast AntiVirus protection. Share it now, because friends don't let friends get viruses.

By sharing Immunet Protect, you are doing your friend a favor and protecting them against malware, but you are also doing yourself a favor as it ensures any friend using Immunet Protect AV is unlikely to infect you from their PC. It's a win-win situation all around.

Become a Friend of Immunet and share Immunet Protect on your blog, website or email newsletter. Read more details about our Immunet Friends Program here.

Don't worry about news-making viruses. Make us worry about them.

Arguably the biggest desktop security story of the last few years was the mass propagation of the Conficker worm.  The worm had all the hallmarks of a great news story as well as a security event.  It was found on millions of computers almost overnight, it touched government and military networks, and it had a mysterious date hard coded where it would "do something different", but no one knew what.  The concern was so great that numerous security researchers formed a task group to actively counter the worm, and people like my parents called knowledgeable friends and family to see if they should keep their PC disconnected on the turn-on date.

The story should have been completely ignored by end users beyond the standard mantras of computer hygiene: keep your backups and AV software fresh.

I am not saying that the thousands of man-hours put in by the security community to stop the virus was for naught.  Their work went a long way towards containing the expansion of the network and keeping the bot authors focused on defense rather than leveraging their network.  I am saying that the average user shouldn't care.

A computer is not like your body.  Your body has an immune system that has evolved to take care of the vast majority of external threats, with modern technology providing augmentation whenever our individual immune systems can't deal with an infection, say smallpox, polio, or hepatitis.  Viruses evolve based upon their environment without a intelligent being behind them trying to figure out how to evade a human's immune system.  A computer has no immune system whatsoever beyond what you install and what your security vendor provides.  Viruses are built by other human beings, and any successes they experience are in turn the failures of your software vendor.

You should be less concerned about the specific strain of virus and far more concerned about why your single vendor can't stop the threat, and what additional software you need to install to have them stop the threat.

I would like to thank an anonymous audience member for a question he submitted that started me on this thread.  We do read all of your e-mails and blog comments, so even if we don't have the time to reply immediately, we do appreciate them and they do help shape our priorities.  For this, I and everyone else at Immunet thanks you.

From the newsletter vault: December's "Ask the Doctor" column

Many of you, my dear readers, are not subscribed to our newsletter.  For shame!  You can easily do so when you download our AV software.  Below you will find some of the pearls of wisdom that you are missing by NOT being on our newsletter list.  

Lillith, from Wauwatosa, WI, writes in:

Q: Can I use my system for online banking if it had a virus and the virus was removed?

A: There are a lot of great anti-virus and anti-malware packages out there that do a fine job of stopping viruses from coming in and removing them from your system if one sneaks past. No technology is 100% effective, however. Even after removal, remnants of the malware may still exist on your system. If a significant portion of the malware is still resident in the computer, then it is possible for the malware to pull down updates and reinfect the machine. While the situation may be rare, there will always be a risk of reinfection after malware removal. As is true with anything in life, there is going to be risk associated with using a PC for any financial transactions after removing resident malware.

Here is yet another reason to keep good, local backups of your system: If you want to be completely certain that there is no remnants of malware on the system, you have to restore the machine from a recent, uninfected, complete system backup. Online backups rarely provide coverage over all of the operating system components, which are likely to contain the malware components. As Sigourney Weaver said in "Aliens", you need to "take off and nuke the entire site from orbit. It's the only way to be sure."

Drop us an e-mail with any other questions you would like us to address at doctor@immunet.com.