Immunet Blog

This morning while reading my mail I came across an email purportedly from Google notifying me that my AdSense account had been disabled. On closer inspection the email was a clear a phishing attack designed to steal my AdSense username and password. The mail looked like this:

You can see from the URL which I have outlined in red that clearly this is not going to take you to a real Google website but rather a (likely) hacked page at orientcasinos.com. If I go to the site it looks like a fair passing imitation of the actual AdSense page:

The URL though is still quite obviously not AdSense so thankfully this particular scam is not likely to go far. These sorts of scams are not new per se but it's important to understand that not only are your direct financial assets (bank account, credit card etc.) a target but so are your indirect financial assets like your AdSense account which controls potential revenues for your business. Like we posted earlier about Facebook accounts being targeted  your online presence is something you need to consciously guard as well as your PC. You can start by being sceptical about any email asking you to log in and change your credentials for an online service you use. If you do feel you need to follow up on an email which requests something like this, always open your browser separately and navigate to the site on your own, do not copy and paste from the email and do not click on the link in the email.

I often get asked what makes Immunet’s approach to detecting threats different than the mainstream Anti-Virus companies.  In a nutshell, our goal is to find threats which are in small parts of our community, analyze them and then protect the whole community from them as fast as possible, often in near real time.

We do not focus on obscure threats, or threats which circulate outside of our community. We are not big fans of the 'boil the ocean' approach to doing Anti-Virus. It works well for reviewers (who test with everything under the sun) but it rarely really helps your community. There is a reason people are still getting viruses and it's time we rethink our (the industry) approach to tackling this problem.

As to 'how' we convict files. All of our current approaches entail communication back and forth with the cloud so that rarely is a decision made in 'decision support isolation’. This allows you to work with the most current, up to the minute, information that we have. Here are some of the approaches we use:

1. Generic detection of threats through broad hashing. We look for things that look 'like' threats we know of and try to further analyze them for conviction so we can protect the community. This can also be called a 'heuristic' engine if you like.  Our generic engine is ETHOS; we have another planned for May, which is called SPERO.
2. Context conviction, this is where we make decisions based off the data we receive about a file in field. From community collected data we can make assumptions about whether a file is a virus or not. For example, did our AV stop working after it was installed? Did the system start to see other viruses after it was installed? Questions like this will often lead to answers, which make us highly suspicious of a file.  
3. One-to-One conviction, this is where there is a known threat we've collected from the community, through collection trading or gathered from web crawling. For each of these collected (and verified malicious files) we generate a signature. When users do file look-ups this signature is sent to us, if it matches a known threat we convict the file as a virus.

There are a few other ways as well and each of those approaches above could be a daylong chat on their own but that's the mile high view today (March 7, 2010).

Earlier in this month the Immunet team shipped and enabled a new engine to our Immunet Protect Beta. This Anti-Virus engine, titled ETHOS, is focused on helping us leverage our community to help protect our community. Essentially the engine looks for threats (heuristically) on the desktops of our community. If it finds a suspected threat it remediates it and then communicates about it (and sometimes the file itself) to our Cloud so the rest of the Immunet Community is protected from it instantly.

It's long been our opinion that the most dangerous malware our community faces is malware which is making the rounds in the 'here and now' . This 'active malware' is what we all need to be worried about. This is the stuff that you and those around you are most likely to encounter. Sounds like common sense right? It is, but the vast  amount of Anti-Virus signatures (well over 97%) created for most Anti-Virus products are created from traded malware collections (which are tired and old) or collected/crawled from malware web sites which are often fallow and no longer active. This results in most Anti-Virus products downloading millions of largely useless definitions a year. We believe it's the small minority of threats which are live and on the move which need your attention.

So with the small minority in mind we built ETHOS. I am going to present some data here for you put context around our findings.

General Threat Data (Based off the last 7 days)

• Every 24 hours we block 1910 (on average, outliers removed) threats
• We process (create cloud definitions) for 17,500 files a day. This malware comes from crawling and malware collections which we trade. We will refer to this as 'Cloud Processed' malware.
• We separately collect and process 50 threats a day (on average) from our ETHOS engine. This engine is only active on 7,120 users in our community this is about 10% of the whole user base.

So with these numbers in mind here is the story so far, of the 1910 threats we stop each day, 382 or 20% come from ETHOS.  So to put this into perspective graphically our overall processing looks like this:

Now, if we look at what our actual user base is seeing for 'in-field' protections it looks like this:

What you should take away from this is that ETHOS is contributing a wildly disproportionate amount of protection to our Community when compared to our other protection generation. This is with only 10% of the Immunet Community running ETHOS right now. As we grow ETHOS will see wider deployment and these numbers should become even more compelling.  

Clif Sipe over at Techie Buzz just gave Immunet Protect 1.0.25 a very thorough review that is worth a read. You can find the review here. The upshot is that we recieved a 4/5 rating from Clif who has been watching the product for a few months now.

Immunet Protect Beta 1.0.24 was recently put through its paces by the folks over at Malware Research Group (MRG). MRG is doing a well thought out monthly review of 30 anti-malware products to see how well they detect fresh, real world, active Rogue Anti-Virus programs.  The report titled “Rogue Software Infection Prevention Test, January” showed Immunet Protect Beta performed quite handily. In fact, we beat out both Microsoft Security Essentials and Avira  at detecting these in-field threats. It’s great vindication for our community (and the development team of course..), particularly given we are in beta with some ways to go before all of our detection engines are deployed!

All,

The updater files for migration to 1.0.25 are now posted. The updaters will install the new product, uninstall old product if you have it and then load your new drivers. Migration can be done from any Immunet build from 1.0.14 up to current (1.0.24). You will be prompted for a reboot as we are replacing drivers with this install. Windows XP SP2 is not supported, only XP SP3 and up. Vista SP1 + and Windows 7 are also supported.

The primary changes in 1.0.25 are:

• Fixed an installer issue where some driver failures were occurring on non-native English OS installs.
• Fixed an 'Offline Mode' issue related to DNS under certain platforms.
• Increased efficacy of the ETHOS engine and reduced it's memory footprint.
• Fixed an issue with the local system cache which causes some look-ups to fail.

The Immunet Protect Beta 1.0.25 32 bit Updater is:Here
The Immunet Protect Beta 1.0.25 64 bit Updater is:Here

Our intention is for this to be our last update for the product until our April release.

All,

The updater files for migration to 1.0.24 are now posted. The updaters will install the new product, uninstall old product if you have it and then load your new drivers. Migration can be done from any Immunet build from 1.0.14 up to current (1.0.24). You will be prompted for a reboot as we are replacing drivers with this install. Windows XP SP2 is not supported, only XP SP3 and up. Vista SP1 + and Windows 7 are also supported.

The Immunet Protect Beta 1.0.24 32 bit Updater is: Here
The Immunet Protect Beta 1.0.24 64 bit Updater is: Here

Next week or the week after we will be shipping 1.0.25 which is purely a bug fix release. We will also ship updaters for this coming build.