Security and Anti-Virus
- last edited on by
jlivingood
We have continued to work on innovative solutions to the bot/malware problem. Since then we have updated our earlier IETF draft, a new version of which is available at http://tools.ietf.org/html/draft-oreirdan-mody-bot
Today, we announced the Constant Guard(tm) security program. This program is a comprehensive approach to protecting customers from increasingly sophisticated online security threats. A feature of the Constant Guard security program, called “Service Notice” goes into trial today in the Denver area. The purpose of Service Notice is to let customers know whether their computer is infected with a bot (virus). Bots are the leading cause of spam, are responsible for identity theft, information theft, and distributed denial of service (DDOS) attacks.
We believe the Service Notice benefits both Comcast customers as well as the Internet community. The Service Notice helps inform customers that there is a high probability that something may be wrong with their computer and that they could be susceptible to any of the malicious activity listed above. Once customers receive the Service Notice, they will have an option to take steps to fix the problem or close the Service Notice without further action. By taking the steps to fix the problem, customers can clean their computers which in turn may help reduce the risk of information and/or identify theft. Fixing the problem also helps the Internet community because it means less spam and fewer DDOS related service outages.
How will the Service Notice work?
Customers may receive a Service Notice informing them that one or more computers in their house may be infected with a bot. The Service Notice appears as a message layered in front of the page content as shown here:
The customer will be presented with two click-through options: (1) visit the Anti-Virus Center or (2) close the Service Notice. The Anti-Virus Center instructs the customer to perform Operating System updates, download Anti-Virus updates and/or to download the McAfee anti-virus software (provided at no additional cost to Comcast customers). If the customer needs expert technical assistance, the customer will find a link to the McAfee Virus Removal Service. This service is provided by McAfee for an additional fee.
The customer can close the Service Notice without any further action. Comcast may notify the customer again in the future if their security is at risk.
How did Comcast determine that I may have a virus-bot on a computer in my home?
We identify infected computers in several ways. First, we get data from reputable Internet research groups that specialize in bot identification. The data we get includes a list of Internet Protocol (IP) addresses that are infected and those that belong to bot command and control channels. Second, we look for malicious behavior exhibited by bots such as spam, distributed denial of service attacks and repeated connections requests to known command and control channels. We then aggregate this data to confirm whether one or more of your computers has been infected.
Is Deep Packet Inspection Involved?
No. Deep Packet Inspection is not involved in any way.
Does this technique of detecting bots allow Comcast to see my online activities?
No, this technique does not detect bots based on the online activities, protocols or applications a customer uses. Comcast provides its customers with full access to all the content, services, and applications that the Internet has to offer.
What will the “Service Notice” be used for?
Service Notice may be used for messaging time sensitive critical information to you about your Comcast High-Speed Internet service such as computer security.
How does the “Service Notice” work?
Following is a technical description of how the Service Notice works. The notification platform utilizes a standards based approach developed by the Internet Community known as Internet Content Adaption Protocol (RFC3507). When a bot is detected and a customer needs be notified, HTTP traffic (Port TCP 80 only) from the customer’s computer is routed via a Web proxy. The traffic is routed from the customer’s computer to the final destination, a "Web server", without modifying the request. When the traffic from the Web server arrives at the proxy the Service Notice is added to HTML content without modifying the original page and then the combined content is routed back to the customer’s computer. The Service Notice will appear as a message layered in front of the page when viewed in the Web browser. We have published an IETF draft describing how the system works, it is available at: http://www.ietf.org/id/draft-livingood-web-notific
Does the proxy cache any information?
The web proxy does not enable caching of the web content and Comcast neither look at nor store web traffic information.
Where to find technical updates related to the “Service Notice”?
All technical updates regarding Service Notice will be available on Comcast’s Network Management page:
http://networkmanagement.comcast.net
Sincerely,
Nirmal
Comcast Cable Communications
National Engineering and Technical Operations
NSM998 wrote:The Service Notice appears as a message layered in front of the page content as shown here:
NSM998, looking at the above snipped image from your initial post, it appears that the notice is covering the comcast home page..
I, along with other internet users DONOT use that portal..
Will this notice be geared to show up on ALL entrances to comcast services? i.e. Help Forums, Smartzone, community...
ciao, bj
BlueJay wrote:
NSM998 wrote:The Service Notice appears as a message layered in front of the page content as shown here:
NSM998, looking at the above snipped image from your initial post, it appears that the notice is covering the comcast home page..
I, along with other internet users DONOT use that portal..
Will this notice be geared to show up on ALL entrances to comcast services? i.e. Help Forums, Smartzone, community...
ciao, bj
A customer that is notified will see the Service Notice on any web site.
slouke wrote:
Queen-Evie wrote:I get the part about bots.
But what kind of information does "critical information to you about your Comcast High-Speed Internet service" include?
"You haven't paid your bill yet this month, please do so immediately so we can turn off this notification."
I suspect that the temptation to use this mechanism to deliver ads will soon prove irresistable.
MelvinTheGrate wrote:
I suspect that the temptation to use this mechanism to deliver ads will soon prove irresistable.
Then you must have missed Section 4.1, requirement 11, at http://tools.ietf.org/html/draft-livingood-web-not
REQ11: No Advertising Replacement or Insertion: The system must not
be used to replace any advertising provided by a website, or
insert advertising into websites where none was intended by
the owner of a given website.
jlivingood wrote:
MelvinTheGrate wrote:I suspect that the temptation to use this mechanism to deliver ads will soon prove irresistable.
Then you must have missed Section 4.1, requirement 11, at http://tools.ietf.org/html/draft-livingood-web-not
ification-00
REQ11: No Advertising Replacement or Insertion: The system must not
be used to replace any advertising provided by a website, or
insert advertising into websites where none was intended by
the owner of a given website.
No I didn't miss that at all. Since a violation of that restriction would carry no penalty other than people shaking their fingers and calling you "naughty," I still feel it's just a matter of time. Recommendations for anti-malware products will probably come first. Besides, the way that requirement is worded premits unrestricted insertion of ads into any web page that already contains at least one ad.
Barmar wrote:
I think the intent of the wording was to allow for cases where they have an agreement with the web site that allows them to insert ads.
And thus would begin the fulfillment of my prediction that this mechanism will one day be used to deliver ads. Furthermore, since the user is forced to click on something in the pop-up in order to get to the original web page, this will train users to click on any pop-up that appears. This will greatly increase the incidence of infected machines, further justifying use of the mechanism. Lovely vicious circle. Advertisers and vendors of anti-malware products will no doubt benefit greatly.
"The methodology used is described in the first post of this thread."
Not really. That doesn't say anything, unless it's in the screenshot that you're talking about, but that's extremely low resolution (as well as over-compressed) and so small on my 24" monitor at 1920x1200 that I can't even read what it says.
It does say in the text, however:
"How did Comcast determine that I may have a virus-bot on a computer in my home?
We
identify infected computers in several ways. First, we get data from
reputable Internet research groups that specialize in bot
identification. The data we get includes a list of Internet Protocol
(IP) addresses that are infected and those that belong to bot command
and control channels. Second, we look for malicious behavior exhibited
by bots such as spam, distributed denial of service attacks and
repeated connections requests to known command and control channels. We
then aggregate this data to confirm whether one or more of your
computers has been infected."
Okay, if that's it, I can see a whole lot of false positives on the horizon, many people worrying for no good reason, much of the time. Just like the way the anti-virus programs figure that OVER protection and undue paranoia are better ideas than playing it realistically. There will be many reports of "infected" IP addresses and such, simply due to their realm or genre, for lack of a better way to say it.
Oh welll, forgive me for being skeptical. I mean, Comcast can't even get the "Message has been deleted" thing fixed for the forums, where you're told the message you are trying to access has been deleted, if you're not logged in when you click the email link (And I've been bringing that one up for almost two years and have even been told it's being worked on).... so I'm not real confident. 
But it's all good. It might be useful for some people, although I personally feel that all this nannyware creates a false sense of security, as well as countless technical user issues, and the best thing is for people to just be careful where they're going and wshat they're installing and clicking.
Well, alrighty then! :/ Thanks CCC.
