About Us

The Immunet Blog is maintained by the Immunet team as a forum for discussing news and issues related to AntiVirus, security and cloud technology.

Search

Entries in cloud antivirus (11)

Tuesday
Jul132010

New Threats Call for Layered Security Approach 

Cyber attacks are reaching pandemic levels, according to a recent report by the Wharton School of Business at the University of Pennsylvania. As the threat mushrooms, protecting against it has become ever more complex. According to the report: 

"Security is always a cat-and-mouse game between hackers and security vendors," says Kartik Hosanagar, a professor of operations and information management at Wharton. "What has changed is that both companies and hackers have grown sophisticated. So the good news is that most security software will protect us from the most basic threats, which was not the case in the past. But the bad news is that malware and viruses have become more sophisticated, so even advanced users can fall prey to them."

Worms associated with interactive media and malware affecting social networking sites are         particularly dangerous, he notes, because "for example, you are less likely to be suspicious of a message from a friend on Facebook asking you to click on a video link. And yet, this kind of attack is on the rise" even as Facebook, Twitter, and other such sites are increasingly being used by businesses.

This is why Immunet Protect advocates taking a layered approach to antivirus security. Today’s threat landscape is far more sophisticated than the security industry has ever seen and using just one antivirus product isn’t enough. Running two antivirus programs at once was previously frowned upon, but as the threat landscape – and antivirus solutions evolved – the layered strategy has become the advised approach.

Immunet Protect is 100% compatible with most major antivirus products. View our complete list of compatible products. No matter how protected you are, there is no absolute guarantee that your PC will be free from viruses. But you can ensure that you have real-time protection against malware (like Immunet Protect) and share Immunet Protect for free with your network.



Thursday
May202010

Immunet Protects Against New Attack Method That Outsmarts Desktop AVs 

Last week, researchers at Matousec.com revealed a new attack technique that traditional desktop AntiVirus products can’t defend against . But Matousec has confirmed that Immunet Protect is the only AntiVirus product that can protect against the vector

According to ComputerWorld’s Gregg Keizer, this is how it works:

attackers could exploit the kernel driver hooks that most security software use to reroute Windows system calls through their software to check for potential malicious code before it's able to execute.

What this boils down to is, a hacker can trick a computer into accepting a benign code but then swap out this code for a malicious one just before execution. ComputerWorld asked Al Huger, VP of engineering at Immunet, for his thoughts on the gravity of this new method.  Huger responded:

 "This is definitely very serious," said Alfred Huger, vice president of engineering at Immunet, a Palo Alto, Calif.-based antivirus company. "Probably any security product running on Windows XP can be exploited this way." Huger added that Immunet's desktop client is not vulnerable to the argument-switch attacks because the company's software uses a different method to hook into the Windows kernel.

Vulnerabilities like this highlight the necessity for added protection. It’s simply not enough to depend on traditional AntiVirus products to protect against all threats. Taking the recommended layered approach is the only surefire way to protect against the plethora of known threats – as well as the ominous unknown dangers. If you know someone who could benefit from Immunet, pass along this post or send them information on downloading Immunet.



Sunday
Mar072010

How Immunet Detects Threats, In a Nutshell

I often get asked what makes Immunet’s approach to detecting threats different than the mainstream Anti-Virus companies.  In a nutshell, our goal is to find threats which are in small parts of our community, analyze them and then protect the whole community from them as fast as possible, often in near real time.

We do not focus on obscure threats, or threats which circulate outside of our community. We are not big fans of the 'boil the ocean' approach to doing Anti-Virus. It works well for reviewers (who test with everything under the sun) but it rarely really helps your community. There is a reason people are still getting viruses and it's time we rethink our (the industry) approach to tackling this problem.

As to 'how' we convict files. All of our current approaches entail communication back and forth with the cloud so that rarely is a decision made in 'decision support isolation’. This allows you to work with the most current, up to the minute, information that we have. Here are some of the approaches we use:

  1. Generic detection of threats through broad hashing. We look for things that look 'like' threats we know of and try to further analyze them for conviction so we can protect the community. This can also be called a 'heuristic' engine if you like.  Our generic engine is ETHOS; we have another planned for May, which is called SPERO.
  2. Context conviction, this is where we make decisions based off the data we receive about a file in field. From community collected data we can make assumptions about whether a file is a virus or not. For example, did our AV stop working after it was installed? Did the system start to see other viruses after it was installed? Questions like this will often lead to answers, which make us highly suspicious of a file.  
  3. One-to-One conviction, this is where there is a known threat we've collected from the community, through collection trading or gathered from web crawling. For each of these collected (and verified malicious files) we generate a signature. When users do file look-ups this signature is sent to us, if it matches a known threat we convict the file as a virus.


There are a few other ways as well and each of those approaches above could be a daylong chat on their own but that's the mile high view today (March 7, 2010).

 

Sunday
Feb072010

Immunet Protect earns a Techie Buzz Rating: 4/5 (Excellent)!


Clif Sipe over at Techie Buzz just gave Immunet Protect 1.0.25 a very thorough review that is worth a read. You can find the review here. The upshot is that we recieved a 4/5 rating from Clif who has been watching the product for a few months now.

 

Tuesday
Feb022010

Immunet beats out Microsoft Security Essentials and Avira in MRG Rogue AV Test!

Immunet Protect Beta 1.0.24 was recently put through its paces by the folks over at Malware Research Group (MRG). MRG is doing a well thought out monthly review of 30 anti-malware products to see how well they detect fresh, real world, active Rogue Anti-Virus programs.  The report titled “Rogue Software Infection Prevention Test, Januaryshowed Immunet Protect Beta performed quite handily. In fact, we beat out both Microsoft Security Essentials and Avira  at detecting these in-field threats. It’s great vindication for our community (and the development team of course..), particularly given we are in beta with some ways to go before all of our detection engines are deployed!

Tuesday
Feb022010

1.0.25 Updaters Posted

All,

The updater files for migration to 1.0.25 are now posted. The updaters will install the new product, uninstall old product if you have it and then load your new drivers. Migration can be done from any Immunet build from 1.0.14 up to current (1.0.24). You will be prompted for a reboot as we are replacing drivers with this install. Windows XP SP2 is not supported, only XP SP3 and up. Vista SP1 + and Windows 7 are also supported.

The primary changes in 1.0.25 are:

  • Fixed an installer issue where some driver failures were occurring on non-native English OS installs.
  • Fixed an 'Offline Mode' issue related to DNS under certain platforms.
  • Increased efficacy of the ETHOS engine and reduced it's memory footprint.
  • Fixed an issue with the local system cache which causes some look-ups to fail.


The Immunet Protect Beta 1.0.25 32 bit Updater is:Here
The Immunet Protect Beta 1.0.25 64 bit Updater is:Here

Our intention is for this to be our last update for the product until our April release.

Thursday
Jan282010

Updaters are now available to migrate to 1.0.24

All,

The updater files for migration to 1.0.24 are now posted. The updaters will install the new product, uninstall old product if you have it and then load your new drivers. Migration can be done from any Immunet build from 1.0.14 up to current (1.0.24). You will be prompted for a reboot as we are replacing drivers with this install. Windows XP SP2 is not supported, only XP SP3 and up. Vista SP1 + and Windows 7 are also supported.

The Immunet Protect Beta 1.0.24 32 bit Updater is: Here
The Immunet Protect Beta 1.0.24 64 bit Updater is: Here

Next week or the week after we will be shipping 1.0.25 which is purely a bug fix release. We will also ship updaters for this coming build.

Friday
Jan152010

Don’t Want Some Other PC’s Koobface?

Twitter viruses, Facebook viruses and the host of other social networking attacks have reintroduced the world to why malicious code have been dubbed ‘viruses’. An infection starts with one person and spreads through online contact. Social media is thus akin to locking your PC in a room with 10,000’s of other PCs – one sneeze and you’re toast.

Don’t want some other PC’s Koobface, nor do you want self-imposed Facebook isolation for PC health reasons?

This week, Facebook and McAfee joined forces to offer social network virus protection. We think this is a good first step and overlaying Immunet Protect is an even better one. Immunet’s community focus plus the Collective Immunet protection feature is ideal for users on Facebook, and our side-by-side install support with McAfee means no hassle, no fuss. In particular, our footprint (less than 5 megabytes), speedy performance (instant, real-time threat evaluation) and community strength (50,000+ users collectively protecting each other) make a very effective antivirus booster-shot if you’re using McAfee already.

Of course, if you’re concerned about social network hygiene and aren’t interested in investing in yearly license renewals (McAfee on Facebook is only free for six months), well, get Immunet Protect today - it’s free and always will be. 

Thursday
Jan142010

Watch out for Haitian Disaster Malware Attacks

The US-CERT warned yesterday of potential PC threats via fraudulent search engine results returning malicious links to phishing and malware websites. It’s hard not to follow this unfortunate event as the drama continues to unfold, so make sure your antivirus is up to date as you follow news links and browse content through social network sites.

If you and your community are using ours (Immunet Protect), you’re covered, since we’re cloud-based there isn’t a delay in pushing updated definitions to your PC (it’s always up-to-date).

Beyond a good antivirus program, US-CERT is encouraging people to take the following steps to protect themselves:

SANS, Security Bloggers Network and the other usual suspects are doing a good job of spreading the word, so hopefully this doesn’t turn into a large outbreak.

Friday
Jan082010

When should I update my Immunet Protect Beta?

Well, that’s a good question and not one that we have been clear enough about. This post will hopefully remedy that! Currently the Immunet Protect Beta has the ability to auto-update itself when it’s flagged from our cloud. We have not flagged an auto-update for the last 4 releases. If you are running Immunet Protect 1.0.18 or up there is no reason to manually upgrade at this point unless your trying to fix an issue and our Support group has asked you to upgrade. Our next release is 1.0.23, we’ll post and let you know our thoughts on that one as we get closer to it (it’s going into QA today). 

It’s important to remember that much of the functionality we build in (like our recent rollout of white listing) is driven from our cloud, not our desktop product. So often when we build new functionality you do not need to upgrade to take advantage of it. The same is true of many (but not all) of our virus detection technologies as well.

The reason we are not forcing people to upgrade (through our auto-update) feature is that we are trying to keep people in their builds as long as possible as long as they have no stability issues. This allows us to ‘persistence test’ over the beta period to watch how our software behaves in-field.

When we hit a point with our release schedule where we feel there is really protective (or stability related) benefit to people upgrading, we will perform an auto-update. This will certainly happen by April, quite possibly before. Once we pass out of beta (Immunet Protect 2.0) we will have fully scheduled update features, automated update etc. exposed in the product.

Cheers,

Al