Did I Infect my Friends? Part 2: Phishing

This week, we’re taking on phishing attacks. Phishing is basically when hackers “fish” sensitive information from their victims by tricking them into deluging their credit card number, bank account, or even social security number. During a phishing attack, it’s common for hackers to pretend to be the IRS, banks, or other trustworthy entities to convince people to give them their private data. Yes, it’s that simple. Scary right?

It gets worse. A shocking new phishing attack, often called “tabnapping,” manipulates browser tabs, in a tactic that is far more sophisticated and sly than traditional phishing attacks. The way it works, the attack replaces the contents of the tab using Javascript. Then, after you’ve switched over to another tab, the contaminated one morphs its page into the Gmail log-in screen. Switched’s Terrence O’Brien explains:

Between the convincing fake page and the Gmail favicon in the tab bar, it's likely that many will simply assume they left the tab open and were logged out. After collecting your log-in credentials, it simply forwards you to the correct page (in this case Gmail), because you were never actually logged out. The attack script can be triggered on a delay so that it will only change the page if it has not been touched for several minutes, or hours, preying on the inaccuracy of a user's memory. It can even mine your browser history to target the sites you're currently logged-into without special coding.

Firefox is most susceptible to the attack, while Internet Explorer, Chrome, and Safari, don’t always successfully deploy the malicious code. Aza Raskin, of Firefox, actually demonstrates how the sneak attack works on his blog here. Simply switch to another tab after opening the link. The fake Gmail site does seem a bit off, but perhaps we just felt that way because we were expecting it to be bogus. The unsuspecting will not be as vigilant.

So how do you stay safe? The FTC offers basic tips, like don’t respond to emails asking for personal information or pop-up messages prompting you to submit personal data; only call phone numbers on an organization’s official Web site – not numbers that you are sent via email; and of course, use antivirus software. But new techniques, like tabnapping, mean phishing attacks are becoming increasingly advanced and basic common sense will not be enough to stop them.



Doing Our Part to Ensure Facebook Safety

Yesterday, Facebook’s CEO Mark Zuckerberg promised new privacy controls in the Washington Post, amid some criticism of the site’s recent changes. Kudos to Zuckerberg for stepping up and reinforcing Facebook’s commitment to users. In the Washington Post, Zuckerberg  points out, "there needs to be a simpler way to control your information.” And "in the coming weeks, we will add privacy controls that are much simpler to use." Great! But what he didn’t address was the troubling influx of malware on the site in recent weeks.

Let’s recap. There was the free giftcard scam, the Facebook worm, the beach babe virus, the “sexiest video ever,” among others. The malware that users share on Facebook spreads like wildfire because Facebook's viral sharing hooks really work, even if the content being shared is damaging to end users. 

We know that Facebook’s security team is hard at work trying to combat the malware issues that arise when criminal hackers are financially motivated to prey upon Facebook’s 400 million active users. However, while Facebook is doing what it can to keep us safe through their own security controls and through user education (like the Facebook Security page), ultimately the responsibility to protect -  both ourselves and our networks - falls on us. Facebook has no control over what software you do or don't have installed on your PC to protect yourself, but you can see why Facebook would be a safer community if every user on Facebook had real-time, effective antivirus protection that they could easily share for free. 

With antivirus products like Immunet Protect that are specifically tailored protect users of social networks like Facebook, it’s never been easier to be safer online, or easier to protect your community. It takes seconds to download protection that will last you a lifetime. What are you waiting for?

Did I Infect my Friends? Part 1: Trojans

People think viruses aim to destroy their computers. But actually, different types of malware have different impacts on your computer. This is the first in a series spotlighting various types of malware.

Unlike traditional viruses, Trojans actually want your computer to run flawlessly…until you log-in to check your bank account. Makes you shudder, eh? It gets even more chilling. Last year, the “super Trojan” Zeus 2.0 made it possible for hackers to empty a bank account in seconds, bypassing security safety checks through social engineering and hijacking.

Uri Rivner, a consumer identity protection expert at RSA, explains in his recent blog post.

Zeus 2.0 records almost everything you do on your PC: credentials to just about any site of interest to the fraudsters; HTTPs traffic; even HTTP forms. It grabs data stored in your browser’s protected storage area. It even copies your clipboard: who knows, maybe this will become useful. The result: terabytes of data stolen by each Z-bot.

At its core, a Trojan is like having someone peering over your shoulder while you’re on your computer. Only this person has a photographic memory to memorize your passwords and other vital info.

So how do you stay safe? Most Trojans find their way onto computers when victims click on links from friends, colleagues, and co-workers. The troubling part is, in most cases, the victim won’t know they’ve just downloaded a Trojan, as this type of malware isn’t readily apparent. Your best option is to know who within your network has AntiVirus protection, so you know whether their links are safe. Immunet Protect’s new version, launching next month, actually lets you do this. Stay tuned for more.    



Immunet Protects Against New Attack Method That Outsmarts Desktop AVs

Last week, researchers at Matousec.com revealed a new attack technique that traditional desktop AntiVirus products can’t defend against . But Matousec has confirmed that Immunet Protect is the only AntiVirus product that can protect against the vector. 

According to ComputerWorld’s Gregg Keizer, this is how it works:

…attackers could exploit the kernel driver hooks that most security software use to reroute Windows system calls through their software to check for potential malicious code before it's able to execute.

What this boils down to is, a hacker can trick a computer into accepting a benign code but then swap out this code for a malicious one just before execution. ComputerWorld asked Al Huger, VP of engineering at Immunet, for his thoughts on the gravity of this new method.  Huger responded:

 "This is definitely very serious," said Alfred Huger, vice president of engineering at Immunet, a Palo Alto, Calif.-based antivirus company. "Probably any security product running on Windows XP can be exploited this way." Huger added that Immunet's desktop client is not vulnerable to the argument-switch attacks because the company's software uses a different method to hook into the Windows kernel.

Vulnerabilities like this highlight the necessity for added protection. It’s simply not enough to depend on traditional AntiVirus products to protect against all threats. Taking the recommended layered approach is the only surefire way to protect against the plethora of known threats – as well as the ominous unknown dangers. If you know someone who could benefit from Immunet, pass along this post or send them information on downloading Immunet.



Rogue Antivirus is on the Rise. Don't Get Scared, Get Smart.

I recently attended a Stanford Security Seminar talk on An Analysis of Fake Antivirus, given by Moheeb Abu Rajab of Google's Anti Malware team. The talk summarized the recently released research report by Google's security team called The Nocebo Effect: An Analysis of Rogue Antivirus Distribution; included here are the key trends from the report and from the security talk that are most relevant to Web users:

The Web continues to provide a very attractive platform for distributing malware to millions of consumers

• Social engineering attacks that prey on the naivete and intrinsic human motivations of users has become a rising attack trend. Social engineering "tricks" users into engaging in behavior that makes their PC vulnerable to further attacks, increasing the likelihood that they will be infected with malware. 

• These social engineering attacks are on the rise both in absolute volume of attacks, and also relative to drive-by downloads that focus on exploiting vulnerabilities in the browser or plugins to deliver malware. It has become much easier to trick a human being using psychology and playing on user fears than it is to exploit a technology weakness in a machine.

• Fake antivirus (Fake AV) or rogue security software is a form of social engineering attack that displays fake pop-ups on the user's PC that are designed to look like the operating system status alert, or a browser window status alert, that "tricks" the user into thinking they have a virus on their computer when they in fact DO NOT have a virus.  Users become scared (thus the term "scareware") that the virus is going to damage their computer, and as a result end up paying the fake AV vendor with their credit card details for a subscription that will not remove the fake virus, but may in fact deliver more malware to the PC.

• Fake AV is responsible for 50% of all malware delivered via Ads, which represents a five-fold increase from just a year ago. Google's malware detection infrastructure found over 11,000 malware-ridden domains through its process between January 2009 - January 2010.

Why Should You Care About Fake Antivirus?

While you may be savvy and security-conscious enough not to fall victim to scareware or rogue antivirus programs, your friends, family and colleagues may not be as well informed. They probably aren't reading this blog post (unless you've forwarded it to them), and may not be aware that there is a difference between legitimate antivirus and rogue antivirus. A simple "heads up" or "share this" action from you may actually save your friends a great deal of headache and financial worry.

Here are some Smart Tips to Share on Avoiding Rogue Antivirus:

1. Keep your antivirus up to date. If you use signature-based virus detection like Microsoft Security Essentials, Norton, AVG, McAfee, Avira, Avast, etcetera, make sure you have the latest virus updates. As Niels Provos of Google states, “We found that if you have anti-virus protection installed on your computer but the [malware detection] signatures for it are out-of-date by just a couple of days, this can drastically reduce the detection rates. It turns out that the closer you get to now, the commercial anti-virus programs were doing a much worse job at detecting pages that were hosting fake anti-virus payloads.” 

2. Always use real-time antivirus protection like Immunet Protect, even if you already have traditional antivirus. Immunet is ideal as an extra, light, companion layer of added protection that will help catch viruses that your other AV may not always detect (did you know that on average traditional, signature-based security solutions only catch 50% of threats?)

3. Install a firewall and keep it on at all times

4. Keep your Windows operating system software set to "automatic updates"

5. Don't click on pop-up windows, or ads that "scare" you into taking immediate action. Beware of ads with flashing exclamation points, and urgent calls to action that include the words "infection, infected, virus detected", for example.

6. Be aware of top "trendy keywords" and be particularly mindful of clicking on links or search results for these top trendy keywords. A trendy keyword is a keyword that has risen in popularity in a short timeframe as a result of a time-based event, such as a natural or man-made disaster (e.g. Haiti earthquake, Gulf oil spill, hurricane, flood, etc), a celebrity event or celebrity news trend, or media-driven news story.

To find out what the current trendy keywords are, which malware promoters are likely ALSO targeting via advertising and fake links on search engines, you can use the keyword tools like Google Trends.

7. Stay calm, and think before you click, especially links in e-mail or on social networking Web sites.

8. If you are presented with scareware alerts, even after taking the above precautions, read this helpful tutorial that Brian Krebs wrote for The Washington Post called “What To Do When Scareware Strikes"

9. If you believe you have encountered malware on your PC via a rogue antivirus program, Immunet may be able to help! You can submit the suspicious file (or files) you believe to contain a virus or some other form of malicious code to submit@samples.immunet.com.

10. You can report the website that delivered the rogue AV to the FTC Bureau of Consumer Protection via their Online Complaint Wizard.

11. If you provided any credit card data to a company that you believe may be behind a social engineering attack, be sure to notify your credit card company immediately of potential fraud, and consider registering for identity protection services, which will prevent anyone from using the information you provided (including your name, billing address, and credit card information) to steal your identity for criminal purposes.

12. Do your part as a safe online citizen, and pass this message along to a neighbor, a friend, a family member, or a colleague. Don't get scared, get smart, and share the knowledge to keep the people you care about safe online.

Computer Viruses Make for Gripping (Often Real) Urban Legends

Three of Snopes’ top five urban legends today are related to computer threats. Ever since PCs have become a part of our daily lives, the destruction they can cause has captured our imaginations. People are mystified by the seemingly unlimited power computers have to both devastate and restore our lives, all with the click of a button.  

Many of the most calamitous or ridiculous (like the infamous Hackers List) scenarios, remain, thankfully, in the realm of fantasy for now. But unlike Snopes’ rap sheet for urban legends about taxes, secret ingredients, or even war; the computer viruses and hoaxes page is generously peppered with green dots, signifying “urban legends” that actually happened. This means the vast majority of computer viruses aren’t just matter of folklore. They in fact, have actually lived in some form, menacing unsuspecting computer users.

It’s also no coincidence that some of the most persuasive viruses have involved public figures, social networks, or other topical buzz words. New metrics show the most “shareable” words on Facebook include Obama, Facebook, and other cultural phenomena. The popularity of these terms will inevitably fuel many more urban legends. But remember, the next time you hear an  urban legend about a prolific computer virus -- it’s, sadly, more likely to be fact than fiction.  



The desktop security battle is just beginning

Jeremiah Grossman from Whitehat Security posted an interesting Blog on Thursday entitled ‘Ceding the desktop security battle, almost the war’ which was followed by an article from Dennis Fisher on ThreatPost, ‘Have We Lost the Desktop Security Battle?’.

Both posts draw the same conclusion (with Dennis really hitting it home) – AntiVirus vendors have lost and virus authors have won.  Since this debate has been percolating in the security space for well over a decade now, let’s look at some real facts on how well today’s leading AntiVirus vendors are doing.

To do this, let’s look at one of the few impartial industry reviews that actually measures how well we are all doing.  The best measure for this is AV Comparatives, run by Andreas Clementi in Germany.  His review, the Proactive / restrospective test is designed to measure a product’s detection rate on new, previously unseen threats.  AntiVirus vendors all do very well on known threats, regularly achieving over 99% detection.  Known viruses, however, are shared by vendors across the industry and everyone has them, including the reviewers; so these numbers come as no surprise.  It is how well vendors do on unseen threats that REALLY matters and ultimately dictates how protected Consumers are as they browse the Internet each day.  This is what the retrospective test measures.

Andreas’ last retrospective review was released in November of 2009 and can be obtained here (PDF document).  Note that Immunet has not participated in the review (our product is still in beta as we improve our own detection capabilities).  The below picture pretty much sums it up:



As we can see, average proactive detection rates hover at 50% or less, including those of the two market leaders.  There is a caveat to this test – products that use execution based detection (such as emulation or behavioral monitoring) are not able to benefit from them in this test. 

This is a stark reminder as to what a typical Consumer should expect from their AntiVirus product:

A less than 50% chance of being protected when they encounter a new threat. 

As a result, Financial Institutions (as Jeremiah discusses) are more than justified in assuming that all Consumers are compromised, and in accepting transactions despite this.

Despite these numbers, I would argue that the AntiVirus industry has not ceded the battle, nor has it lost it, but it is struggling to maintain high efficacy rates in the face of a growing number of threats.  The traditional approaches to this problem are not working.  We need game changing technologies to make a dent in this problem, since the status quo just won’t do. 

I remain convinced that by using the latest technologies in cloud computing, collective intelligence, data mining and machine learning, we can make a big leap forward from where we are today and turn the table on these threats.  The AntiVirus problem has turned into a data management and timing problem.  It is about how much temporal data about files you can collect, and how quickly you can process that data in order to make a basic decision on its disposition; ultimately a YES or NO decision.  These concepts are exactly what we are working on here at Immunet and we have certainly not given up.  

Rather than seeing the war as being lost, we at Immunet believe that the battle is just beginning.  We are just starting to see the benefits from these game changing technologies.  We are building technologies that will have the ability to be far more effective than what has been built before us, and we are all devoting our lives to this fight in the here and now.

The State of the Net 2010 is Sobering: Why Protecting Your Lifeboat Matters More Than Ever

I just read a recent blog post by Tory Jennings of CoreTrace that mentions Symantec’s new Internet Security Threat Report (ISTR). The threat report is a must-read for any security professional, as it highlights current trends in the threat landscape based on real data taken from the world's largest security software maker.  Consider this statistic:  Symantec blocked an average of 100 potential attacks per second across its userbase in 2009, or 6,000 potential attacks per minute, 360,000 attacks per hour, or 8.6 million attacks per day.  The key takeaway from these numbers? Internet users are TRULY "under attack", and as millions more users embrace social networking sites and interact with each other online, the issue of collective security and protection against malicious threats becomes even more important for every Netcitizen.

A Symantec article titled, “Cybercrime’s Financial and Geographic Growth Shows No Slowdown during the Global Economic Crisis" shows that hackers were more active than ever last year. The multitude of cyber threats has not only increased, but become more sophisticated, more global in reach, better funded, and caused greater damage from a financial perspective.

The Threat Report, coupled with June's Consumer Reports State of the Net 2010 Report, drives home the point to consumers and security professionals alike that Internet threats and user security are key concerns requiring a radically different and collaborative approach to what is ultimately a community-wide problem.

Consider these statistics from the State of the Net 2010 Report:

 The report, available on newsstands and in summary format from the Consumer Reports website, states:

• Within the past year, 9 percent of social network users experienced some form of abuse, such as malware infections, scams, identity theft, or harassment.

• Among all computer users, established threats, such as spyware and phishing e-mail scams, persist at alarmingly high levels, and virus infections increased significantly since last year. Forty percent of online households surveyed reported that they had at least one virus infection in the past two years. 40%!

What percentage of the 40% who were infected with at least one virus infection actually had antivirus protection that didn't work effectively enough? We don't know for sure, but we do know that approximately 50% of online users have inadequate, expired, or no antivirus protection at all.

Consumer Reports estimates that cybercrime cost American consumers $4.5 billion over the past two years and prompted over 2.1 million computers to be replaced as a result of the havoc wreaked. Imagine what the global damage from those same threats must be? The report also states that these findings "provide a reminder that it's still important to use the best anti-malware software available." [hint hint -- get Immunet, it's always up-to-date and it works as extra protection beyond your existing antivirus, plus it's free].

Seriously, these are sobering statistics, and they are ones that keep the team here at Immunet up late at night (in addition to working hard on product improvements and launching the new release of Immunet Protect for June...). We truly do care about making the Internet a safer place, one Immunet user at a time, one community of friends and family at a time.  

Of the features we have developed for the new 2.0 release is a simple community tool that makes it incredibly easy for users to extend antivirus protection to their contacts. Why would you want to extend protection beyond your own PC to those of your friends, family members, coworkers, and most frequent contacts? Here's why...

At Immunet, we believe that security begins with the end user, but it certainly shouldn't end there. If you are a community of one, you can take the "every man/woman/child for herself" approach and say, "I don't care if my friends don't have antivirus, at least I have it". But as we know in the age of Web 2.0 and social networks, NO one is an island, and the Internet is about connection, sharing, collaborating. Connecting online should not include inadvertently infecting someone you just emailed or shared a URL link with because it was full of malware that your antivirus software didn't detect. Talk about a social networking faux pas.

We believe that engaging and connecting with others' online, whether it's via Facebook, email, Twitter, games, or other means, that act of connecting online comes with certain responsibilities, such as socially "safe", security-conscious behavior. What are some examples of "socially safe, security conscious" behaviors?

1.  Make sure you are protecting yourself and your PC against threats. Make sure your antivirus is up to date. If you turn your protection off, or haven't scanned in a while, make a habit to turn it back on or scan frequently at regular intervals.

2. Use strong passwords, use a different password for each site, and don't give your password out to anyone, especially via email, which is not secure. 

3. Adjust your privacy settings to "Maximum" if you can. Check privacy settings on all services you use, including Facebook, Twitter, LinkedIn, any online groups, forums, and even Web services.

4. Only share with known people. Don't accept friend requests from total strangers, even if it looks like someone you know knows them...it might be a fake identity. Don't be fooled. See the article on "Online Con Artists" for more reasons why you should be wary.

5. Only share information, content, photos and posts about yourself that you would not be embarrassed about if somehow your privacy settings suddenly stopped working temporarily (as in the Facebook case from this week, where private Facebook chats and pending friend requests were exposed due to a Facebook security flaw).

6. Do not share content, photos or information about your friends, family or coworkers that you did not get explicit permission to share -- they may be more private than you and don't want all YOUR friends knowing that they had a party this weekend that their own social contacts may not have been invited to.

7.  Finally, protect your most beloved people -- the friends, family members, and frequent contacts that you TRULY care about. I call these people your "lifeboat", or those social contacts whom you communicate with most frequently. These are people who trust you to help them out, and whom you know would help you in return. No, these are not your 5,000 Facebook "friends" including someone you went to preschool with that you don't even remember anymore.  Your lifeboat people would call you for help if they were ever a victim of identity theft, or an online scam, or had their PC hacked by a cybercriminal, because they know you care about them and can do something to help. 

PLEASE suggest that they protect themselves. In fact, don't just suggest it to them, actually HELP THEM OUT.  Recommend what YOU use, whether it be to download free antivirus software, or the install a helpful password manager tool since it's challenging to memorize strong passwords, or to sign up for identity theft protection to prevent fraud.

Explain to them why they should change their behavior, if you know it is risky, such as implementing the Top 7 Things You Should Stop Doing on Facebook as recommended by Consumer Reports.

Call them up and walk them through the steps for what to do. If you can, better yet, go to their house and help install it for them (like I did with my parents, who are technically clueless and THOUGHT they had updated antivirus on their home PCs but hadn't renewed their subscription in months. Now they do have real-time protection because I installed Immunet for them, and I see their status online so know they are safe...). 

Why does protecting your lifeboat matter a lot? Because you have influence to protect them, and they are the ones that are most likely to infect you or affect you if they are practicing socially unsecure or unsound online behavior. If their privacy settings are off, the data you've shared with them becomes less private for you (your chat with them is now exposed, your postings on their wall now made public to everyone). If their antivirus is not updated or they don't have antivirus, they are the ones most likely to infect you with malware. If their email gets hacked, then your contact information that resides in their address book is now going to get spammed by hackers. All this means damage to your friend, and collateral damage to you in some way.

Please be a friend and help your friends be safer and more secure online. It will give them greater peace of mind to know you care enough to help protect them, and you'll have greater peace of mind knowing that the people you care about the most are better protected as a result of your personal efforts.

Protect a friend with Immunet

Consumer Reports Panel on Social Network Insecurity

Yesterday, Consumer Reports convened a panel, "Social Insecurity: Risky Consumer Behavior during the Era of Social Networks," that raised some disconcerting realities about social networking. The fodder for the panel - which featured reps from the Federal Trade Commission, Electronic Frontier Foundation, as well as Mashable’s Adam Ostrow –stemmed largely from the newly-published 2010 Consumer Reports State of the Net survey.

What we found most unsettling was the sheer number of people impacted by online threats. For example, an estimated 5.4 million online consumers had submitted personal information to phishing scammers during the past two years and a projected 1.7 million online households faced online identity theft. 

Unfortunately, many of these victims probably unwittingly engaged in some risky online behavior. And what’s considered chancy online is far more innocuous than people realize. For example, publicly displaying your full birth date on the site, your address, or other private information makes it easier for cybercriminals to engineer attacks against you. But this doesn’t have to be the case. There’s no reason why you shouldn’t be able to share your birthday on Facebook or post family photos – just make sure your AntiVirus protection and privacy settings are up-to-date. 

While the statistics surrounding net security are gripping, they are still just numbers – until they impact us personally. And what online security is ultimately about is keeping our family and friends safe online.  How are you making this happen?