Don't Get Infected by Twilight Malware - Make Sure You're Protected

It’s no surprise that hackers have piggybacked on the pop culture hoopla surrounding yesterday’s release of the new Twilight installment, “Eclipse.” Fans are eagerly scouring the web for information on the movie, but more than half of the links they’re getting are tainted with malware, according to news reports.

Consider what this means for malware infiltration. If hackers can contaminate more than 50% of links on a particularly hot topic, our vulnerability to viruses is higher than we think. We take for granted that our Internet searches are safe -- after all this is information we’re seeking. It’s not as though we’re clicking on fishy links sent to us via spam. Well, that’s the old way of thinking. In the new world of malware, gaming search engines is a clever way to get savvy web surfers to stumble upon malware. And even if you’re not searching the web for Twilight content, there’s probably someone in your life who is. Are you protected?



Do Consumers think about AntiVirus?

Why is it that 50% of all Internet users either don’t have AntiVirus protection or have protection that’s expired or out of date? Between 30-40,000 (thousand!) new viruses are created each DAY, and yet a large percentage of the consumer population remains vulnerable to these threats. So what’s going on here? Perhaps people are too trusting that website security professionals such as Twitter’s Trust and Safety team, or those involved in the Facebook Security Wall will just take care of malware for them.

Consumer Reports has a good phishing test for consumers (and Donna even wrote a post about the dangers to social media, a topic near and dear to all of us at Immunet). eHow has a few good steps to follow. MSNBC offers some good advice from the AP. CNET even tried to help people avoid malware from trusted site the Drudge Report.

We think more people don’t have AntiVirus due to combination of price, effectiveness (or lack thereof), resource and system drain and software conflicts that afflict traditional AntiVirus software. To be fair, without the collective benefit of a cloud-based community that can help to detect, update and defend each other against thousands of new threats daily, it takes copious resources in terms of human and technology costs (which are passed along to the consumer) for a traditional AntiVirus provider to do all the work themselves.

With Immunet Protect’s Collective Immunity, we’ve solved this problem and torn down the barriers standing in the way of increasing consumer AntiVirus penetration from 50% to closer to 100%.  The closer we are as an industry to 100% antivirus penetration, the safer the Internet becomes for everyone online.

What to do When Advice Falls Short?

We put a focus on educating people on how to avoid getting a virus, from the basics to black SEO to social media aggregators to Facebook-specific worms to how to’s.

It seems attackers have the means to overcome today’s ‘AntiVirus common sense’ we’ve all grown to embrace, namely, only click on links from trusted sources. Now these sources can no longer be trusted.

Case in point is the new spear phishing threat targeted at social networking. Core Security Labs demonstrated this at the RSA Conference last week and lots of people have followed up on the problem. What to do?

While common sense is still very important, getting a real-time AntiVirus that recognizes a threat instantly is just as vital. Viruses take time to spread and the longer one goes undetected, the more dangerous it gets. Immunet Protect’s Collective Immunity solves this problem by detecting a virus from the community and instantly protecting all users against that virus.  



Are Social Media Portals Creating a False Sense of Security?

The core theme for viruses is trickery. Fool a person into clicking on a link they think is accessing something they want and the infection spreads (Twitter viruses, Facebook viruses, etc). Viruses spread really fast with this approach – look at the recent Gmail worm the New York Times wrote about. Social media has proved to be a hotbed for this deception and people are getting wise to it. That’s good.

What’s bad? Aggregating all your social media ‘stuff’ in one location, like the recent Microsoft Outlook 2010 Social Connector, Meebo and Snaptu (for phones). As a consumer, surfing Twitter, Facebook and the rest comes with a known risk – watch out for links. Do such ‘street-smarts’ erode if all your activity is accessible from a trusted application, such as Outlook or another? The links are still suspect but our keen eye might dim a bit.

Real-time antivirus protection becomes even more important with the adoption of these social media portals. Yet another reason that Immunet Protect’s “Collective Immunity” against viruses deserves a look as a means to protect you and your community. Once a virus is detected, all users are instantly protected against that virus, rather than having to wait days to update software.

Think about that for a minute. If you have 200 Facebook friends, 1,000 Twitter followers and share files with 50 people and any one of them gets a virus, Immunet Protect kicks in and everyone is instantly protected – you’re all safe! Now, look at this example with traditional, clunky antivirus applications, where there may be 15 different programs running across your 1,250 connections. It might take days to update each program’s database. How many times will you interact, click on and forward links and files among the group in a few days, potentially infecting thousands of your friends and followers!? Scary, right!

RE: US Branded Dirtiest Web Hosting Nation (SC Magazine)

Today, the fine reporters of SC Magazine ran a bit of research from Sophos about the US being branded “the dirty man of the web world”. Infected websites, malware and malicious software abound.

We already know Twitter viruses, Facebook viruses and the host of other social networking attacks are an issue. Now, the trustworthiness of legit websites is an increasing concern and time is an issue - time, in the sense that antivirus protection follows the identification of a threat. This could take days for traditional software. There are plenty of examples around the forums. 

This is precisely the reason overlaying existing antivirus software with Immunet Protect is beneficial. Immunet’s community focus plus the Collective Immunity protection feature means if anyone using Immunet Protect registers a virus, all users are instantly protected against that virus. To better illustrate this point, have a look over the actual numbers:

	Traditional	Immunet
Sample Collection	1 Day – 1 Month	Real-time
Sample Processing	1 Day – 2 Weeks	Real-time
Publishing	1 Hour – 1 Day	Real-time
Footprint	28 – 352 MB	10MB
Detection Technology	File Based, Signature Focused	Data Mining, Network Centric

Don’t Want Some Other PC’s Koobface?

Twitter viruses, Facebook viruses and the host of other social networking attacks have reintroduced the world to why malicious code have been dubbed ‘viruses’. An infection starts with one person and spreads through online contact. Social media is thus akin to locking your PC in a room with 10,000’s of other PCs – one sneeze and you’re toast.

Don’t want some other PC’s Koobface, nor do you want self-imposed Facebook isolation for PC health reasons?

This week, Facebook and McAfee joined forces to offer social network virus protection. We think this is a good first step and overlaying Immunet Protect is an even better one. Immunet’s community focus plus the Collective Immunet protection feature is ideal for users on Facebook, and our side-by-side install support with McAfee means no hassle, no fuss. In particular, our footprint (less than 5 megabytes), speedy performance (instant, real-time threat evaluation) and community strength (50,000+ users collectively protecting each other) make a very effective antivirus booster-shot if you’re using McAfee already.

Of course, if you’re concerned about social network hygiene and aren’t interested in investing in yearly license renewals (McAfee on Facebook is only free for six months), well, get Immunet Protect today - it’s free and always will be. 

Don't worry about news-making viruses. Make us worry about them.

Arguably the biggest desktop security story of the last few years was the mass propagation of the Conficker worm.  The worm had all the hallmarks of a great news story as well as a security event.  It was found on millions of computers almost overnight, it touched government and military networks, and it had a mysterious date hard coded where it would "do something different", but no one knew what.  The concern was so great that numerous security researchers formed a task group to actively counter the worm, and people like my parents called knowledgeable friends and family to see if they should keep their PC disconnected on the turn-on date.

The story should have been completely ignored by end users beyond the standard mantras of computer hygiene: keep your backups and AV software fresh.

I am not saying that the thousands of man-hours put in by the security community to stop the virus was for naught.  Their work went a long way towards containing the expansion of the network and keeping the bot authors focused on defense rather than leveraging their network.  I am saying that the average user shouldn't care.

A computer is not like your body.  Your body has an immune system that has evolved to take care of the vast majority of external threats, with modern technology providing augmentation whenever our individual immune systems can't deal with an infection, say smallpox, polio, or hepatitis.  Viruses evolve based upon their environment without a intelligent being behind them trying to figure out how to evade a human's immune system.  A computer has no immune system whatsoever beyond what you install and what your security vendor provides.  Viruses are built by other human beings, and any successes they experience are in turn the failures of your software vendor.

You should be less concerned about the specific strain of virus and far more concerned about why your single vendor can't stop the threat, and what additional software you need to install to have them stop the threat.

I would like to thank an anonymous audience member for a question he submitted that started me on this thread.  We do read all of your e-mails and blog comments, so even if we don't have the time to reply immediately, we do appreciate them and they do help shape our priorities.  For this, I and everyone else at Immunet thanks you.