Slashdot Mirror
Symantec to Acquire SecurityFocus
cbv writes "Symantec Corp. today announced the acquisition of SecurityFocus for approximately US$75 million in cash. The press release reads, 'With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats.' The transaction is expected to close by early to mid-August 2002."
Will we be seeing more minor security issues inflated to cataclysmic proportions just so Symantec can sell a few more virus scanners?
From: aleph1@securityfocus.com [mailto:aleph1@securityfocus.com]
Sent: Wednesday, July 17, 2002 5:28 PM
To: bugtraq@securityfocus.com
Subject: Administrivia: Symantec acquiring SecurityFocus
Good day,
Today, SecurityFocus and Symantec announced that Symantec is acquiring
SecurityFocus. Symantec sees real value in the services SecurityFocus
provides to its customers and believes they are an excellent fit with
their current offerings. We at SecurityFocus see this as an opportunity to
provide even better services for the security community.
Symantec recognizes the value and uniqueness of the public services
SecurityFocus provides to the community, such as the numerous mailing
lists we host and the content we provide via the SecurityFocus Online web
site.
In particular, Symantec and SecurityFocus want to ease any fears as to
whether the character of this mailing list will change.
Frequently Asked Questions:
Q. What is the Symantec strategy for keeping data sources?
A. We believe it is critical to maintain the integrity of the existing
security community currently part of the SecurityFocus portal and
Bugtraq mailing list.
Q. What is Symantec's disclosure policy?
A. Symantec believes in responsible vulnerability disclosure and is active
in initiatives to set best practices in this area. Our first priority
is to help our customers protect their computing assets by providing
tools and information to safeguard their systems.
We will work with vendors, if we discover vulnerabilities in other
products, to report and investigate the issue in a thorough and timely
fashion, in the same way that Symantec will work with other security
researchers if they find an issue with any Symantec technology.
We observe a 30-day grace period after the notification of a security
advisory to give users an opportunity to apply the patch. During this
grace period, we provide our customers significant information about
the vulnerability and the fix, but not step-by-step instructions for
exploiting the vulnerability. We do not provide detailed exploit code
or provide samples of malicious code except to other trusted security
researchers and in a secured manner.
Q. Will Symantec change SecurityFocus' vulnerability reporting policy?
A. We believe that in order for the SecurityFocus/Bugtraq community to be
effective, it must be an independent entity. We believe that its
current disclosure policy is appropriate for the venue. Symantec will
continue to operate with its separate disclosure policy.
Sincerly,
Elias Levy, David Ahmad,
and the rest of the SecurityFocus staff
Prediction: Symantecs products are going to suddenly become very secure.
I am not a number! I am a man! And don't you
This buyout (sellout?) makes the site a lot less credible in my opinion. They are simply going to use the site to sell more virus protection software.
Countdown until Rob Rosenberger has a nervous breakdown begun... 10 ... 9 ... 8 ... 7 ...
Never confuse volume with power.
their products will never be secure as long as they do not detect the fbi's spy software.
GoatPigSheep, the 3 most important food groups
The contest is on...
Which will be worse, the slashdot effect or the mass unsubscribes pounding the mailing lists??
I hate going to any symantec website. Their web pages reek of ads for different products. I'm glad I use Junkbuster to block all of them.
And I'm doubly-glad I use mozilla to stop those damn pop-ups.
And SecurityFocus.com was a great site... I can only hope Symantec doesn't run it into the advertising ground.
There was a new list started about 2 weeks ago, directly because of this potential issue:
Here was the announcement:
Subject: Announcing new security mailing list
We are pleased to announce the creation of a new security mailing list
dedicated to FULL DISCLOSURE. When Scott Chasin handed over the bugtraq
mailing list, it was clearly dedicated to the immediate and full
dissemination of security issues. The current bugtraq mailing list has
changed over the years, and some of us feel it has changed for the worse.
If you believe in full disclosure, and wish to participate in unfettered,
and unmoderated discussions, please feel free to subscribe to the new
mailing list by accessing http://lists.netsys.com
I don't really know what to say. It'd be like Ford buying Volvo or something. Oh, wait . . .
Do not touch -Willie
REALLY BAD SECURITY VULNERABILITY EXPOSED
DATE: July 17, 2002
AFFECTED SYSTEMS:
All systems for which Symantec sells products.
DESCRIPTION:
Holy Fucking Shit!! The computer just, like, explodes! It's the end of the world!
WORKAROUND:
Install Norton Anti-Virus. If you already have Norton Antivirus installed, buy another copy and install it. That'll fix it, we promise.
Ahh, Symantec pledges to acquiese to FBI backdoor demands
This is a real problem and needs to be addressed.
Has Symantec policy changed with respect to things
like magic lantern and so forth?
bugtraq. Poof.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
- Would we believe the seriousness of virus threat anouncements? (BTW, please see the interesting musings of Bruce Schneier in the last issue of CRYPTO-GRAM.
- Would we believe in the security of Symantec's products?
- Would Symantec take advantage of first hand information before releasing it to public knowledge?
Even if bugtraq keeps its objectivity (and what a big "if" is that!), doubt will ever remain. A critical resource for the security community has been lost, at least because of the lack of credibility in the new owners.Serve as a FW/VPN
Act as a network IDS
Serve as a management console for Host IDS
Act as the A/V Manager
Because they have agents installed on every machine when you run Intruder Alert, NAV, or other tools, it would allow them to sync up the status of a host, network, etc. with the mothership at Symantec-Focus, and determine in real-time what devices are vulnerable. This is kind of cool in concept but not easy in execution.
My concern is that they already have bought other products, which are completely jacked up and are still not fixed. I spent my Thanksgiving morning last year doing a disaster recovery on a Symantec Intruder Alert System...what a mess that product is...where is the high availability, the fault tolerance, etc.? Again...cool concept, crappy execution.
This merger puts Symantec in direct competion with folks like eSecurityOnline, and I can tell you that for people already in bed with Symantec who have legal obligations to stay on top of vulnerabilities (e.g. Banks) this makes it a one stop shop for them. I see it as a conflict of interest. They should buy a couple of pen-test companies while they're at it and they can even validate their product implementations are secure ;)
Now Symantec can screw up SecurityFocus like they've screwed up everything else that was useful until they bought it!
Sorry for the flamebait, but I've bought too many Symantec products over the years, and they seem to get worse with every revision. I remember when Norton Utilities was something beneficial, now I refer to that package as Norton Anti-System.
Other fun past experiences with Symantec products have included Act, which was a big pile of poo, and WinFax, which was pretty good last time I used it, as long as you limited your use to a specific subset of it's advertised functionality.
Under capitalism man exploits man. Under communism it's the other way around.
At the company-wide meeting about the acquisition, Symantec president John Schwarz said repeatedly that Symantec is committed on the highest levels to keeping the SecurityFocus Web site alive, and editorially independant. A written policy will set this out explicitly in the weeks to come.
Does your 'absolute requirement' run on my Unix internet pc? And how much of the exact 0 viruses that ever infected it would require it?
Yeah this really is depressing. However, another site I like in case any of you are unaware is Packetstorm. I like it a lot and so far it hasn't sold out. :-(
They also acquired Recourse Technologies and Riptech. Symantec corporate
While it appears that Symantec will generally leave Bugtraq alone (not that it's been very useful for some time, imho), I don't really trust them.
Let me provide my basis (petty as it may seem): I'm the system administrator at an ISP small enough that I do some of the tech support. I've seen NAV's mail scanner totally screw up peoples' mail settings enough times that I don't think quality is something they emphisize. To make matters worse, this problem tends not to be fixed by a reboot, and NAV will lock the mail server fields in OE (I don't think it can do that in Netscape/Mozilla, but I'm not sure) making it impossible to use the affected mail account without completely deleting it and readding it. Sometimes, disabling and re-enabling mail scanning will fix the problem, but that's not always the case.
I used to prefer NAV over most other virus scanners (and some other Symantec products back in the days of MS-DOS), but I really think they've gone downhill in the past several years. I hope that the same fate doesn't come to Bugtraq--the list has already become bad enough.
Now I'm terrified.
The company who's tech support told me "Sir, you shouldn't use that program, it's dangerous" when I called, as their customer, to ask how I could remove a so-called 'virus' from the scanning list.
If they believe they just need to shell out 75 million dollars for a stinking mailing list in order to contral an important part of the world's infrastructure, they are idiots.
Getting something to work like bugtraq technically is absolutely no problem. A mailing list with 30000 subscribers, ok let it be 300000, isn't voodoo.
The "selling point" of bugtraq is/was the trust many people have in them, the people which post there, their policy. If anything would cause people to mistrust them, it needs just one trusted guy from the security community to start a new list, and bugtraq is dead. I've even read a post that one alternative has already started.
If someone like Dan Farmer, Wietse Venema or, for the hell of it, Bruce Schneier decided to start a bugtraq clone, the original would not stand a chance if its reputation had already been damaged.
No, the enemy is the script kiddies and worms that prey on low-hanging fruit. To defend against them, you need to know when an exploit is in the wild. Knowing when a vendor and/or Symantec made the problem the exploit exploits public is useless if it's too late. You want the most current information you can get... at least that way, you can just disable a service or do a work-around until a patch comes out. Do I trust a large corporation not to brush things under the rug in exchange for keeping other large corporations from being embarassed? No. Should you? Personal choice, I guess. I'll stick to IRC and the more arcane sites for info until I'm proved wrong. Word spreads fast these days, what with the internet and all...
SecurityFocus is an excellent asset to the security community and I do hope it manages to retain its journalistic independence through this whole process. I've been running my own small security portal/company the past few years - helps pay the college tuition and all. We do have very thorough daily coverage of news and significant vulnerabilities and the site has a Slashdot-esque feel...URL is in my sig if anyone wants to check it out.
Not really scary to me, seeing how their entire product line is useless on any of my Linux machines anyways.
Well, hogwash or no, Norton has never made any Windozer I've installed it on unbootable. Can't say that about McAfee. However, I am seriously looking at AVG because...well...you can't beat the price. NAV is a decent proggie for a less than extortionate price. If AVG can find the same number of viruses that NAV can, however, it's history here at Catseye Labs.
Knowledge is power. Knowledge shared is power multiplied.
This brings up the interesting point of what Symantec will do about employing people with felony convictions. Anyone know what Poulsen is going to do?
We believe that in order for the SecurityFocus/Bugtraq community to be effective, it must be an independent entity. We believe that its current disclosure policy is appropriate for the venue. Symantec will continue to operate with its separate disclosure policy.
Pretty words, Mr. Levy and Mr. Ahmad. Now where is the proof?
Those of us who are working journalists remember the transition of ABC News under Roone Arlege from Cronkite-esque "news" to "entertainment" -- and know that "independence" is a very fragile concept, one that can be crushed very quickly and with little fanfare at any level including the board room. All it takes is one vote of no-confidence on the part of the management to completely change the editorial head, and thus the independence of SecurityFocus. You most likely mean well -- can the same be said of your bosses? Can you point to one Symantec acquition that proved that editorial independence has been achieved in the long run?
I was an expert witness at a multi-million dollar trial because a well-respected computer magazine's editorial staff prostituted themselves to shore up a bad space-sales management decision. It only takes one episode to sully the good name of a publication. (The name of the publication is withheld from public statement to protect the guilty and to keep me out of civil court for defamation.)
I'm happy you were able to get a pile of money, but don't think that SecurityFocus will be viewed the same way. Now, if you had made the sale to an outfit like O'Reilly, the SecurityFocus name would have retained its luster and elan in the industry.
All good things must come to an end. Thanks for all the fish.
NAV is the standard at the place I work, for client stations. We use trend for servers and some other thing for exchange stores...Whole lotta scanning going on here
errr....umm...*whooosh* *whoosh* Is this thing on ?
keep us posted, I can't see any reason for the panic here beyond the inate herding instinct.
If things change then it is time to move...
errr....umm...*whooosh* *whoosh* Is this thing on ?
MSFT today announced the acquisition of Integrity for $358 billion(USD).
This follows on the footsteps of several recent corporate buyouts, including the impending $5.8x10^300 (USD) Church of Scientology buyout of Truth and Morality.
Man, I am so glad I'm a fucking trans-national megacorporation. Suckas!
(2,3-Benzopyrrole)
The "announcement" of the Netsys list's creation was spammed to everyone who's posted to BugTraq lately. Let's see: unsolicited, bulk, advertising something, and sent to email addresses scraped from a webpage or mailing list. In my world, that's spam. What's worse, the list's owner - Len Rose from Netsys - said that people who were unhappy about the spam were "lunatic diehards". He then proceeded to tell one of them in particular to, quote, "FOAD."
I don't trust a spamming pompous ass to run a security list any more than I trust Symantec to do it. I'm sorry, but Netsys really dropped the ball on this one; I'm not about to hand my email address over to them.
Shaun
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
I guess some people have faulty irony detector.
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
Editorial independence does not necessarily end if one company buys another. It is premature to assume that the quality of SecurityFocus (however you assess that) will materially change for the worse. Don't jump to conclusions until there is a reason to warrant the charges that are being thrown around.
That said, if Symantec simply wanted to support the growth and dissemination of security-related information it could have paid for ads and provided technical resources to SecurityFocus, (however much that may have spurred charges of bias or interference) instead of buying it outright.
The acquisition legitimately raises questions of conflict of interest.
Will we see Symantec advertorial content written by product marketing managers? Will we see Symantec's products being touted as the solutions to problems and vulnerabilities?
The most valuable commodity that SecurityFocus had was its independence (of ownership) from any of the product vendors. Without that independence there will always be doubt and doubters.
Proxomitron sees all, filters all. Regexp your Internet connections.
I agree. It is amazing how badly managed Symantec is.
There are many stories to tell, so I'll tell only one. Once I was having a problem with a Symantec product and I called Symantec technical support and told them how much time I had lost over it. This time they actually had an answer: The problem was caused by another Symantec product.
Microsoft wannabes.
Symantec is not as badly managed as Microsoft, but they are putting in an impressive effort.
I think that's an absolutely valid concern, particularly given the propensity for the virus-killer companies (as they see themselves, anyway) to overblow virus threats.
But, I would say two things in their defense:
1) They tend to hype more than hide. The worst thing is that they will try to get securityfocus.com on the map with IT execs by hyping the security flaws disclosed in bugtraq. Now, it's a double-edge sword, but I don't think it will be awful if certain M$-based operating systems were a bit more publicly scrutinized.
2) Slashdot didn't change after the aquisition, at least not outwardly. I don't work here, so I can't talk about the behind-the-scenes, but the postings are as hard-hitting as ever. Granted, Andover isn't a corporation the size or with the intrests of Symantec. But it's a valid point.
Amateurs discuss tactics. Professionals discuss logistics.
It's done it to me. Not just once, but twice (different versions). I must be a slow learner.
/usr partition). I could probably have fixed it with something a bit less enthusiastic, but there wasn't anything there that I wanted to keep, so I took the easy way. (I keep /usr/local in a separate partition partially for this reason.)
NAV has hurt me worse than any virus I ever caught. LiveUpdate both times.
Mind you, Ximian's Red Carpet has done something a bit similar more recently, only not as bad. It was fixable with a system reinstall (wiping the
I think we've pushed this "anyone can grow up to be president" thing too far.
More than 90% of the desktop computers in the world run Windows. And... Windows ESPECIALLY needs filtering. Now Internet Explorer has a kind of serial number that it transmits to every site you visit.
With Proxomitron, your browser can identify itself as "Space Bison", one of the built-in options, or anything you choose. I choose to take out the serial number.
It gets old, Slashdot people saying they don't run Windows. I posted a link to an article on my web site, and lots of Slashdot people visited. Most were running IE and Windows. Other people have mentioned this also.
There will be a day when almost everyone runs Linux, but that day is not here yet. I can't yet sell Linux to my customers because it is a little too technical yet.
In spite of what the OSDN Terms of Service says at section "4. CONTENT", paragraph 6, I own this comment, exclusively.
They're running Mailmain 2.0.9. Many XSS vulnerabilities exist in that version.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
I had to rebuild my WinNT4 system from scratch twice because NAV combined with WinFAX (from the same company) caused a blue-screen upon boot. I did not quite figure out went wrong the first time, and put over 40 hours trying to recover with out the total reinstall (trying registry edits, etc.).
Once I rebuilt the system, I only reinstalled NAV (required to connect with my office). A few weeks later I reinstalled WinFAX, and boom it happened again. I used McAfee after that with no problems.
Has all the useful security news for *nix sites have been going down the drain lately?
I mean, I am sure symantec is a great windoze security company, but what do they care about securityfocus?
Now that website is probably going to be filled with even more useless HTML and crap
bleh!