Symantec Claims They Knew About Slammer In Advance

truthsearch writes "Wired is reporting 'Symantec claims to have identified the Slammer worm that ravaged the Internet during the last weekend of January hours before anyone else did. Symantec then shared the information only with select customers, leaving the rest of the global community to get slapped around by Slammer.' I'm not bothered I didn't know Slammer was coming, but Symantec has a moral responsibility to inform the public if it thinks millions will be affected." It isn't clear to me how Symantec could know, hours in advance, about a worm which took ten minutes to spread throughout the entire Internet, unless they had something to do with its release. Update: 02/14 16:54 GMT by M : Wired has their math wrong; Symantec apparently had at most 20-30 minutes of early warning. Symantec claims in this press release that they discovered the worm "hours before it began rapidly propagating".

Comments

Moral obligation?

[nakhla]

Since when does Symmantec have a moral obligation to do anything? They're a corporation. Their service is to detect and prevent network attacks. If you are willing to PAY for the service, then you get the benefits of it. If not, then it sucks to be you. Ford's service is making cars. Are you saying that Ford has a moral obligation to give me one, even though I haven't paid for it?

Re:Moral obligation?

[phil reed]

The Internet is a cooperative enterprise. It behooves all the users to play nice with each other. Symantec evidently decided that their customer base was a higher priority than playing nice with everybody else. That's fine, and they are welcome to make that choice. They then get to live with the consequences, including the one where everybody else decides not to play with Symantec because of their attitude.

Re:Moral obligation?

[Quixote]

OK, then why do companies like Microsoft bitch and moan about individuals releasing exploits before they have had time to "study" the bug (read: sit around and do nothing) ?

"Moral responsibility" is a two-way street: if you (the company) expect me to have some, then show some towards me too.

Re:Moral obligation?

[dpilot]

Do we really hold corporations to such low standards?

Do you hold your friends or family to such low standards?
Do you hold other members of your community to such low standards?
Do you hold your elected officials and their appointees to such low standards?

This came up during the hearings for Edwin Meese for Attorney General. The Attorney General is the highest Officer of the Law in the land. For him to merely say, "I have been convicted of no crimes." is not ANY sort of endorsement for the office. It's barely a qualification.

When we rant against the poor and welfare, we argue that putting a safety net under these people will encourage them to fall into it, and not try to better themselves.

Isn't the law really an ethical and moral safety net? So is it any wonder that *some* sink to the net, just like some poor do with welfare? But the real problem comes when we EXPECT people and corporations to sink to the net, take for granted that they will, and dont' see a problem with that situation.

Businesses are a member of the community, too. I'd expect them to behave as ethically and civilly as any person. With a business, I only have my words and money as tools to 'encourage better behavior.'

Timezones?

[remmy1978]

From the article:

"According to Symantec spokesman Yunsun Wee, Symantec issued an alert about Slammer to DeepSight Threat Management System subscribers "at approximately 9 p.m. PST on Friday, Jan. 24."

Most of the rest of the Internet didn't spot Slammer until shortly after midnight EST on Saturday, Jan. 25th."

Accounting for timezone differences between EST and PST, would this not make the two times much closer to each other?

Re:Timezones?

[fname]

Yup. So, Symantec forgets abouts time zones and starts congratulating themselves for their good work. Wired forgets about time zones and reports on Symantec's irresponsible acts. A Slashdot reader breezes through the article and submits it, whilst forgetting about time zones. Slashdot editor, rushing to post the article, forgets about time zones and posts the news item.

Shame on Symantec. Shames on Wired. Good thing we have the good folks at Slashdot to keep the news in perspective.

So?

[fobbman]

Heck, Microsoft released a patch to fix this problem in June of 2002. Windows sysadmins had 6 months notice that it was a problem.

I don't mean to sound like a troll or the least bit insensitive, but if the Windows sysadmins aren't keeping their servers patched then that's the sysadmin's fault. The finger of blame should be pointed right at the mirror. Keeping their servers updated and safe is their JOB, unless they have a security specialist, in which case it's their job.

Gotta agree with the poster...

[TopShelf]

This sounds like Wired trying to stir up a controversy from scratch. Besides, what would have been the impact of them posting a warning a few hours earlier? If an admin saw the notice before the widespread nature of Slammer was known, would they instantly apply patches that they hadn't already installed for one reason or another? I doubt it...

Hmm..

[zulux]

..... unless they had something to do with its release.

I have wondered why a lot of these Microsoft-worms never seem to have a destructive payload. If you imagine a script-kiddie working hard in his mom's basement, you'd think he'd add a payload of some sort.

(hell, if I had the inclenation and the time to create a virus, I'd atleast change the Windows statup .JPG to the 'gentleman who is affiliated with goats.')

It's almost like these Microsoft-worms were desingned to create panic and purchasing action, but no legalally actionable damage.

Just a rambeling thought.

9PM PST == 12AM EST

[kaosmunkee]

From the article...

According to Symantec spokesman Yunsun Wee, Symantec issued an alert about Slammer to DeepSight Threat Management System subscribers "at approximately 9 p.m. PST on Friday, Jan. 24."

Most of the rest of the Internet didn't spot Slammer until shortly after midnight EST on Saturday, Jan. 25th.

So explain to me again how they knew about it before anyone else? -kaos

Agreed

[Adam9]

I don't see why people expect companies to donate information that costs them to find. They could've used this info in two ways, the way I see it. First, is to share it to their corporate customers who pay to have this kind of early warning. Second, release it to the media, CERT, and other organizations and make sure they "advertise" that Symantec found it first.

So they chose the first. Big deal. Do you really think even a majority of these sysadmins would have firewalled their MS SQL server hours before it would be infected? Doubtful. If they didn't apply the patch from July of '02, then they're not going to immediately respond in a few hours to patch an impending threat.

Troll?

[fobbman]

"According to Symantec spokesman Yunsun Wee, Symantec issued an alert about Slammer to DeepSight Threat Management System subscribers "at approximately 9 p.m. PST on Friday, Jan. 24."

Most of the rest of the Internet didn't spot Slammer until shortly after midnight EST on Saturday, Jan. 25th."

Uhh...that's about the same time isn't it Sparky?

Would it have changed anything?

[Junta]

Probably not. Those forewarned took it seriously because they pay for the service. If Symantec had said that a huge attack was imminent and to block the port and patch your SQL servers, how many people do you think would have listened? Of those who listened, how many of those have processes in place so that the requisite network or software changes would have required approval that would have come too late to do any good?

The people who paid for the warning are going to take it very seriously, but aside from that, I would wager that there would be enough doubt about the validity that measures wouldn't have been taken anyway. Patching the server has the obvious implication for many mission critical databases of a potential restart and potential for undesired change in functionality, so patching in many cases would require a testbed server and evaluation, which this warning provided insufficient time for. Blocking the port, or disabling that part of SQL server, for those with it enabled without needing it, means they need to understand what it does or does not do for them. If they already knew, they would have disabled it sooner, so you can't say they would immediately realize and shut it down.

Re:Hmm..

[Bastian]

I see two possibilities:

1) It was done for hack value, not vandalism.

2) With how many Windows computers there are out there, a simple worm has the ability to cause more than enough trouble.

As for Slammer not having a payload, that's because it was designed to fit in a single 505-byte UDP packet. There wasn't room for a payload.

Re:Moral obligation? I'd say so.

[tjwhaynes]

Ford's service is making cars. Are you saying that Ford has a moral obligation to give me one, even though I haven't paid for it?

No - get the analogies right. If I, as a car servicing firm, knew of a part in a Ford car that could fail and cause the car to go off the road at random and I only let my best customers know, I would be sued for screwing around with peoples lives.

Not that I have any sympathy for either MS or Sympantec - Symantec gets to make money off the loopholes in MS's operating system in a strange almost parasitic relationship. The only thing that isn't clear to me is which company is the host...

Cheers,

Toby Haynes

Re:It's not that easy.

[cheezedawg]

So Borland Delphi and 6 other applications wont run without admin rights, and somehow that is Microsoft's fault? Why not blame Borland?

They knew nothing

[doc_traig]

It's a marketing gimmick to get less savvy IT managers to think that going with Symantec will get them ahead of the game. They're burning themselves twice: they'll alienate the infosec community that rightfully believes that knowledge of a potential devastating exploit gained in advance of its use should be shared, and they'll make very poor relationships with customers who fall for this kind of marketing and never have their expectations met down the road.

They didn't quite say that

[jpmorgan]

They said 'We knew all about it, but only told our paying customers. You should become one of our paying customers.'

It's a fairly fundamental difference.

Re:Symantec... should be more careful!

[Sun Tzu]

Anti-virus companies have a huge conflict of interest in that they sell 'protection' against anonymously produced virus threats. These, and firewall producers, are precisely the same companies that benefit the most from malware and network-borne threats of all kinds.

I would think that they would be more careful about raising people's suspicions about their prior knowlege of absurdly fast propagating worms.

Maybe they are believers that 'any publicity is good publicity' -- even in their business.

Send us your Linux Sysadmin articles!

Re:Doubtful.

[ipxodi]

If all copies of MS products were magically replaced with *nix versions tomorrow, we'd see *nix oriented viruses the day after tomorrow. It isn't the label on the box, it's the popularity of the software.
Virus writers are like vandals -- nobody is going to make graffiti where it doesn't get lots of public exposure.

Symantec....

[wowbagger]

Symantec.

The same Symantec who's Norton Anti-virus product is prominently featured in a rash of spams in my inbox?

The same Symantec who claims to follow up on reports of this to spamwatch@symantec.com? That never seems to lead to any sort of actions?

The same Symantec who just changed their auto-renewal to cost people more money IN THE MIDDLE OF THE RENEWAL CYCLE?

Huh, who'd'a thunk it?

Glad I use somebody else's anit-virus software.

Re:Doubtful.

[manyoso]

Unix/Linux dominate the market for servers and databases. Oracle is the most widely used database the last time I checked and SQL Server was third. Unix/Linux *is* ubiquitous for servers. Microsoft is the niche player and it is Microsoft that is producing softare so buggy that it is hobbling the internet.