Comcast pop-ups alert customers to PC infections
Comcast is launching a trial on Thursday of a new automated service that will warn broadband customers of possible virus infections, if the computers are behaving as if they have been compromised by malware.
For instance, a significant overnight spike in traffic being sent from a particular Internet Protocol address could signal that a computer is infected with a virus taking control of the system and using it to send spam as part of a botnet.
Comcast is launching a trial of a service that will warn customers via a browser pop-up that their computers may have been compromised by malware.
(Credit: Comcast)The alerts are triggered "when we see computers on our network that are doing things that are known bot activities--say, a computer is spewing out thousands of spam e-mails," said Jay Opperman, senior director of security and privacy at Comcast.
The Philadelphia-based cable giant, which is the largest residential Internet service provider in the United States, with 15.3 million consumer customers, also is alerted to compromised customer computers when an IP address of one of its customers is identified as the source of spam on an industry spam list, Opperman said.
Customers in Denver are set to begin receiving notifications that their system may be infected with a virus or other malware via a pop-up message in the browser, as part of the new free service, called Comcast Constant Guard. The "Service Notice" will include a link to a Comcast security Web site where customers can follow a set of instructions to remove the malware from their computer.
If customers don't have antivirus software, they can download McAfee Internet Security Suite for free. Comcast also offers a Comcast Toolbar that includes spyware detection and removal, a pop-up ad blocker, antiphishing software, and antispam protection for e-mail.
The company first started notifying customers about the security issues about a year ago, with support representatives calling customers on the phone, Opperman said.
"We learned that customers love it," he said. "We wanted to reach more people and to automate the process."
This appears to be the first service through which a major ISP proactively notifies customers about security issues on their computers. For years, security experts have complained that ISPs are uniquely positioned, and should do more, to help customers combat security problems. But ISPs have been reluctant to assume additional responsibilities that are not central to their core service offering and for which they would then have to maintain a standard, going forward.
"I would hope that the government would do things to encourage this, if you alleviate some of the potential concerns that others may have about giving that kind of notification," said Jerry Upton, executive director of the Messaging Anti-Abuse Working Group. "I think it's the beginning of many ISPs and network providers realizing that customers need a little better knowledge of what the problems are out there."
Alissa Cooper, chief computer scientist for the Center for Democracy and Technology, said the organization welcomes Comcast's initiative.
"ISPs have a helpful role to play in helping subscribers mitigate these kinds of security threats," she said. "The challenge is...when users get these notices, do they understand them? Do they trust that they are real? Do they follow through to the point where they clean up their computers?"
The new service will eventually be rolled out in the rest of the country, replacing the phone calls Comcast has been using to notify customers to security problems, Opperman said.
Asked how many alerts have been sent to customers with Macintosh computers, Opperman said he could not provide a specific number but that there had been some.
Update 12:50 p.m. PDT October 9: Comcast is not the first to proactively monitor and help customers whose computers have been compromised. Qwest has been doing so for two years. Qwest's Customer Internet Protection Program displays a Web page with a warning to customers and offers a way to remove the infection for free before the customer can continue surfing the Web, a Qwest spokeswoman said.
And SBC (before it was part of AT&T) even quarantined customer accounts, George Ou reports on his Digital Society blog. While preventing infected computers from accessing the Internet until they are cleaned is going too far, he said, displaying warnings that could be faked by scammers might not be the answer either. Ou suggests a standardized "out-of-band notification mechanism that doesn't rely on the Web browser and can only be triggered by authorized entities," combined with remote management tools for automatic cleanup.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
My ISP already bocks ports and emails that i used. My loyalty doesn't exist for them anymore. DSL has one small step to cach up in speed...I'm hoping they take that last step.
I don't use any security suite on my Vista and 7 machines because I know how to keep my computer safe. And trust me, I've never had any malware infections till now. Used to use NIS when running XP long time back.
This means you are no safer than anyone else when you browse the web. If you goto a website that contains malicious code for mac, then your mac could become infected - just like it was in the pwn2own contest. Don't be dumb and not run antivirus software like shellcodes coder. Anyone who tells you that antivirus software isn't needed (regardless of the OS) will one day reap a dissaster and probabaly never know it.
http://tools.ietf.org/html/draft-oreirdan-mody-bot-remediation
and
http://tools.ietf.org/html/draft-livingood-web-notification
What you are doing now is the equivalent of sticking your head in the sand, hoping never to have a problem and refusing to believe it when you do. That's *EXACTLY* the sort of gullibility that criminals want you to have.
You are the prime target for such attention, not because you are ignorant, but because you are intentionally ignorant.
Of course, we all know the reason there is very little malware for Macs is because they are so superior, not because hardly anyone uses them so it's not worth writing malware for them yet.
I'm sorry, I was going by your previous comments where you went on at length how as a Mac user, you didn't have to take any steps at all to secure your system, it was perfect out of the box, etc. If you use other methods than what you have publically stated in the past (Mac users don't have to worry about internet security, as you've said before), then I must apologize in not knowing where you have posted this. Perhaps it was someplace other than CNET.
You might want to plead the fifth here. It may be your best option in this situation.
When I see BS, I can and will call you on it.
Shhhhh, there are folks in Russia's criminal syndicate relying on people like The_Happy_Switcher to be their unwitting pawns. Don't do anything to ruin their plans like educating the ignorant. It's far better to just let them move through life without knowing their passwords are being stolen, their machines turned into bots for hire, and personal data being shared out to whomever pays the most for it.
They don't need security. They have themselves.
Wow -- so Comcast customers actually like having their network traffic snooped on? Fascinating.
Jason
Comments like this are the same kind of comments that make people think Google read their e-mails in Gmail because the ads are related...
I'm not at all positive this is about good will and concern for your computer's security.
From our FAQs:
How did Comcast determine that I may have a virus-bot on a computer in my home? (CG, AV)
We identify infected computers in several ways. First, we get data from reputable Internet research groups that specialize in bot identification. The data we get includes a list of Internet Protocol (IP) addresses that are infected and those that belong to bot command and control channels. Second, we look for malicious behavior exhibited by bots such as spam, distributed denial of service attacks and repeated connections requests to known command and control channels. We then aggregate this data to confirm whether one or more of your computers has been infected.
Is there an option to opt out of this program? I prefer to not have Comcast snooping at my packet traffic, thanks. Even for good intentions, there are just so many ways this can be misused and turned into yet another way ISP's can use to charge more money for the service I do not get now.
I do wish there was a meter setup for actual usage though. Treat cable and internet usage like you do with electrical power. Let us pay for only what we are using. When Comcast's signal goes down for hours/days at a time, I'm still paying a monthly bill regardless if I get any actual use of it or not. Granted, they are pretty good about getting someone out to fix it in 48-72 hours, but you don't get any service credit either.
It would be nice if there was a Service Level Agreement. If Comcast doesn't meet up with the requirement to provide a usable signal for internet/television usage, then there is no bill until it is corrected.
But that's just a pipe dream.
"Comcast also offers a Comcast Toolbar that includes spyware detection and removal, a pop-up ad blocker, antiphishing software, and antispam protection for e-mail."
Ah, now I get it. Install our software and trust us in telling you what it does! I'm becoming firmly of the belief that ISP's should NOT be allowed to serve content.
"You can't opt-out of us telling you "
That's all you have to say right there. That sums up the entire story right there alone.
Okay, that's fine, you can snoop on my packets. Go right ahead. They are rather boring since the most exciting thing I do is visit CNET here.
I do prefer to do my own security and do not care to have someone else watching what I am doing all the time like that. Yes, looking for abnormal activity makes a lot of sense, however to do so means you need to be monitoring my connection for it. THAT is something I don't like.
It's sort of like having the Federal Government being permitted to bug every single phone in the US... you know, just in case you might have a terrorist using it without your knowledge. Or child porn. Or your uncle Joe talking about his Barbie collection he's taking to BarbieCon 2010 this winter and then being arrested for being a sexual offender.
Are you Comcast's official representative here on CNET? Does Comcast know you are posting in their representation? Some of your comments here raise more eyebrows than they need to and makes me wonder if this is actually authorized. A lot of your replies so far are such that most company's PR contacts would say 'no comment'.
I guess this means you better make sure you only go to clean healthy websites that Comcast approves of. ;)
My PC got infected again after right a major AV upgrade which reset all the settings.
Also, it is not obvious how to change the settings and the dialog box is off the bottom of the screen. You need to know it is there.
I can only imagine they do this to make people think they need to buy the retail McAfee version.
http://tools.ietf.org/html/draft-livingood-web-notification-00
Great post! That IETF draft was very useful. So it's done with on-the-fly Javascript insertion which will alter an HTTP response from any desired website. Not sure how I feel about that, or how it plays with regard to copyrighted website content, but I understand Comcast's intent.
Does anyone know when Comcast plans to offer McAfee for 7?
Surely Comcast cannot accuse users of these OS of spreading infections that cannot enter their computers.
A statement to such case should have been made by the company.
W. Anderson
wanderson@kimalcorp.org
- by ertem0 October 9, 2009 9:12 AM PDT
- An ISP's job is to get bits from here to there. Nothing else. How those bits behave, what those bits do, their timing is none of the ISP's business. They are a carrier, period.
- Like this Reply to this comment
-
(47 Comments)If a voice carrier, say Verizon, started to listen in to your phone conversations and notified you that you were yelling too much, or using profanity, or that you had an accent, what would your reaction be? So why allow Comcast to monitor the bits you're sending to another place?
Does UPS look inside your packages? They only deliver them. An ISP's job is to get bits delivered. They are not in the content business, they are in the delivery business.