Slashdot Mirror
Symantec AntiVirus Hole Found
Hotwater Mountain writes "eWeek has a story about a gaping security flaw in the latest versions of Symantec's anti-virus software suite that could put millions of users at risk of a debilitating worm attack. According to eEye Digital Security, the company that discovered the flaw, the vulnerability could be exploited by remote hackers to take complete control of the target machine 'without any user action.'"
(ouch, that was a little harsh)
Is it server-side or client-side? Is it push or pull?
If it affects the install on the clients, but needs to get access to them, I wave my paw and say "bah."
If, on the other hand, it can attack the server...
Well, then again, everything should be behind a firewall anyway, with only needed ports forwarded.
I mean that's just common sense...
if the answer isn't violence, neither is your silence / freedom of expression doesn't make it alright
How a company could fsk itself more or harder. First the totally bogas licensing restriction of Ghost, the last good product they made, and now this. Sad.
"Eve of Destruction", it's not just for old hippies anymore...
Protect your computer! Remove your virus scanner! .. hang on.. :) Very sloppy.. It's like the firebrigade trying to save your house with flamethrowers.
Why does anyone even use thier products at all anymore? Three little letters: A V G. after removing symantec's bloatcrap and installing AVG free its practically equivalent to gaining ~.5 GHz.
- "Hear that?! The percolations are imminent! Cease your ingress!"
They are just calling it an exploit just so they dont get into trouble ;)
With friends like us, who needs enemies?
All your SAV are belong to us?
That the Antivirus people are the ones putting the virus's out there to keep their businesses running
*grabs tinfoil hat*
Can't we all just get along
OK that leaves about every question unanswered.
At least give us a little bit on how this vulnerability could be exploited other than: This flaw does not require any end user interactionThrow me a friggin bone here! I'm the user... Need the info...
I suppose the important part is they got the scoop!
I'm not a Symantec fanboy but Symantec Antivirus (SAV) - the enterprise version - is pretty lean. As for Norton Antivirus or whatever they call it now...I couldn't agree more with your estimation of its bloatedness.
Question 1: Are norton Consumer level products (Norton/symantec Antivirus 2006 for example) in this list.
Question 2: Where does this security vulnerability lie? In the scanning engine or in the GUI appliation wrapper or helper dll. This could let us know if the Symantec Antivirus 9 -> 1 are bad.
Im holding Slashdot to a Slashback on this as this unfolds.
BTW, any takers on the ammount of time till patch. Clock starts now.
Procrastinating life a way at a rapid rate of speed.
Coverage on http://www.cnn.com/2006/TECH/internet/05/25/antivi rus.flaw.ap/index.html CNN notes that it appears only the corporate version is affected.
"eEye said it appeared consumer versions of Symantec's Norton Antivirus software -- sold at retail outlets around the country -- were not vulnerable to the flaw, though consumers who are provided Symantec's corporate edition antivirus software by their employers for use at home may be affected."
Symantec seems to be pulling a lot of crap these days, that is charecteristic of a company struggling to stay relevant and by making up for the degradation of quality in its products by othe means (like the other big one) - writing threat exaggeration articles trying scare customers, bloated inefficient personal antivirus solutions, and now vulnerabilities!
I expect to see exploits, if possible, in short order. Sounds like a nice little thing to add to one's bot nets... You must think like the spammers to defeat them, only with rapid patching will we be safe from their scum, or maybe not. Alot of things really depend on user ignorance, and that is always availible.
startkeylogger
I've never seen a program cause as many problems as some of these name brand anti-virus programs.. they're worse than having the viruses!!! and they add extra complexity that gives attackers more possibilities for exploitation.
... I'm saying stuff that everybody already knew... but nobody cared enough to nuke that company for the good of the world.
Keep your patches up to date, or don't connect to the internet...
Don't open ANY freaking attachments, unless you expect it, and you know where it came from... or don't connect to the network.
My mom's computer has their security suite? set up on it... it basically just nags her when programs try to do anything... it's nice that it warns about Real Player's nasties... but we all know to unistall that basterd and just use the codec...
Please use [ informative / summarizing ] SUBJECT LINES
Flame me here
Great, so lets just advertise that it's vulnerable instead of fixing it! How many h4x0rz are going to try to 'sploit this now as opposed to before for a quick ego trip?
This was bound to happen.
If you keep throwing chairs, one day you'll break windows....
This is a job for a 0 day attack. Attack!!
. . . it sucks to be a Windows user.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
I had a bit of a problem a few years ago with SpyWare, first I Installed a IE plugin and then moved to FireFox.
These 'Security' behemoths are insane. They hog 20%+ of computer resources with their 'real time scanning'. The only time anything needs to be scanned is when it's first comming to your computer. Downloads need to be scanned, that's it! If I download something questionable, I'll run it through Trend Micro online scan before running.
Daily backups are the key. And not Whole Fucking Hard Drive Backups like most insane backup programs want to do. Backup your damn documents and data.
Firefox and a little common sense and this whole virus/spyware thing is just not an issue for me. I haven't run SpyBot/AdAware since last year. I occasionally scan my download folder with TM Online.
Recent history:
Does anyone else feel that this time line suggests that the last item or two might be part of a hidden agenda? Are we witnessing the start of a FUD throwing contest between two of the industry's major players?
I am so confused. What web news publishers should I now put my faith in?
My company has invested in Symantec Antivirus Corporate Edition, and while I do like the centralized management features and the Symantec Antivirus Client's unobtrusive nature, these exploits (and there have been several for version 10 alone) are getting ridiculous. With antivirus on the gateway catching 99.9% of the incoming viruses, and account restrictions for users preventing them from doing any real damage if they do get infected, it seems like Symantec Antivirus serves more as a vector of virus and worm attacks than a layer of protection against them. The fact that we pay thousands of dollars a year for the privilege makes it that much worse.
Has anyone deployed something other than Symantec Antivirus in a 250 PC company? If so, I'd like to hear your experiences.
But what do fire elementals feed on? If you use Fist of Ixiblat to burn up their food source, that would be using fire to fight fire as suggested.
Why is it that whenever a horiffic security lapse is discovered, the technology media feels the need to broadcast it so that every net-malcontent can take advantage of it before the company can patch it?
I'll bet the wanna-be hackers and script kiddies are already cooking up something rude.
I'm getting tired, keep up with all these holes that need to get fixed to save my employment of a basic pay cheque.
We need to fix root cause of the problem. Not restore service, but fix it.
It's time to tackle this problem at the compiler level. Get rid of the various IDE wizards, where the latest summer student can spend 5 minutes building a so called enterprise class application.
Instead of the next dual core processor, maybe the industry could spend some time on software and get it right.
smash.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
probably found their own exploit. :P
My NAV is using a total of 9Mb RAM on my system as I type. It's always been more reliable in catching viruses than AVG, too.
What's this? Another weblog? On transit?
http://www.symantec.com/avcenter/security/Content/ 2006.05.25.html
Teachers look no further...
this has to be one of the best examples of irony, ever.
living the dream
So it's probably genuine.
"Maiffret said eEye's testing showed the problem affects Norton Antivirus Version 10, including its corporate editions."
"He said Symantec's current security suite - which includes both antivirus and firewall features - did not appear to be vulnerable."
But it doesn't affect the Symantec most used by consumers.
Nothing to see here. Move along.
"We reject kings, presidents and voting. We believe in rough consensus and running code." Dave Clark, IETF
I've almost always convinced people I've helped with spyware and virus problems to just uninstall Symantec AV, as well as McAfee. They are resource hogs and not really very helpful in my experience. It's an easy sell given these people were running the "anti-virus" software before, during, and after they got infected.
They're better off with two or more good anti-spyware apps, a good firewall, Firefox as the primary browser (I've converted at least a dozen or more people to it), and updated Windows.
Symantec has noly been good for the odd virus removal tool executable (same for McAfee stinger), even their online scan is pretty limited.
the site where quite a few people of intellegence read their news daily. Both good and bad, of course.
I've been using ClamWinAV for a couple months now. It seems to do as good a job as the commercial products that shipped with my laptops. And it's free... It does not do live scanning (or, I don't think it does), but works perfectly for scanning the computers at night when it will run unnoticed. It may not be perfect for everyone but is great for me.
symantec is buying out anyone who begins to compete with them, limiting user choice to a single application suite that is both badly engineered and insecure. sounds like a perfect match for Windows.
I don't know why you think eEye has such close ties to MS. They have been embarrassing and exploiting the hell out of MS for years. They drive MS crazy by releasing powerful exploit code and giving conference presentations such as "Remote Windows Kernel Exploitation" (BlackHat 2005). I like these guys a lot :).
-Fyodor (Insecure.Org)
Avast!
AVG Anti-Virus
I.e., their corporate version. At least that's what they say:
How the exploit functions (a loose theory) 1. It is widely accepted that the Corporate versions of the software are those that are affected. The major difference between the Symantec corporate and home use anti-virus clients is their ability to be managed by a centralized server. From the server environment one can initiate any number of tasks - including a remote installation of the client, remote scans, etc. IIRC this functionality is accomplished through connection to a listening port on the client machine. This would fit the theory of what it is that is so different and that a user needs to do absolutely nothing but have the machine on a network with the Symantec service running. 2. The current CNN coverage located here (http://www.cnn.com/2006/TECH/internet/05/25/antiv irus.flaw.ap/index.html) indicates that home use editions of the software are not affected, "though consumers who are provided Symantec's corporate edition antivirus software by their employers for use at home may be affected." Many of these same users are also granted secure access to remote servers behind their companies' firewalls...
3. This is a major concern because it means that we're not looking at a situation of massive numbers of zombie bots that are all deployed to do some low level inane task like e-mailing tons of spam to people. It means that the firewalls of the various institutions of power, privilege and profit around the globe who have purchased Symantec's products become functionally useless as employees head home to plug into their non-firewalled-my-cousin-set-it-up-for-me cable or DSL connection at home. It also means that any confidential data stored on those remote machines is more likely to theft. Consider the recent stories in the U.S. media of the theft of a laptop containing thousands of citizens social security numbers. Now magnify that situation by imagining that everyone with access to confidential data on a laptop running Symantec place the laptop on the front porch of their home each night.
It will be interesting to see how Symantec handles this. I am hopeful that a LiveUpdate can correct the situation and will be looking into turning off the remote management features on the client machines I manage as a precaution. I don't know that there's a link, but it seems like a fairly plausible source of exploit that is clearly delineated from the home version...
2.
reason not to do business with them: When I found out that the consumer versions couldn't even uninstall *themselves* cleanly, I reasoned there was no way they'd be able to remove anything else...
So, how *do* they manage to stay in business with such a large share of the security market?
(bustling off to buy put options...)
Take the 90-Day Challenge! http://rwmurker.bodybyvi.com/
If you're a Symantec employee (and you agree) post anonymously under this thread. Just so you know I really am a Symantec employee, let me ask you this: how many "strongly disgrees" did YOU put on the SymPulse survey? Wouldn't it be great if our company actually payed any attention at all to that survey and decided to put the technology first? Guess we'd have to change our name to Sun then.
Because if it was, here we have one more piece of proof that C/C++ is a "not that good" programming language. For how long will the industry have to put up with this situation?
Now I'm happy that my Windows is safe inside vmware and running only twice a month using Linux as host and firewall :)
Pixel image editor - http://www.kanzelsberger.com
Flamethowers do work in a pinch if you have time to back burn in frount of fire.
Flamethrowers/Firestarters will stop a fire if used correctly. Even fires that could not be simplely stoped with water bombers.
Ie Bush Fire fighters do not have anything against using fire against fire. The fire created a wind blowing to it. So starting a fire in a sepreate line away from it will go to it unless some other weather effect is happening. If all fuel in frount of fire is burn out it will stop. The back burning effect.
Bit like using Explosives. They are also used to stop some fires. Lets blow up a few building so the rest don't burn down. Ie save a house by flating a factory. or Flaten a few houses to protect a important factory.
Raise your hands if you really didn't see this coming.
For one thing, the closed-source nature of the whole anti-malware market is a fertile breeding ground for exactly this sort of problem.
Fort another thing, if your whole business depends on the very existence and high market penetration of malware, you stand to lose out massively if you actually manage somehow to eliminate it altogether. Symantec et al need the virus writers, the script kiddies, the crackers and the spyware merchants. If it wasn't for them, and the fact that they have such an easy time thanks to closed-source software, then there would be no need for anti-malware services.
Symantec et al are basically providing the electronic equivalent of a huge steel lock fastened onto a cheap balsa wood door with blu-tack. A computer doesn't have, and cannot ever have, any way to distinguish a "good" program from a "bad" one: that has to be determined by a human being somewhere along the line. Nothing anyone can invent will overcome this: it is not a limitation of existing technology, but a limitation of the universe.
It is only because of the existence of closed-source software that hardware has to be binary-compatible, in order to allow execution of foreign binaries. And binary compatibility is the whole reason why viruses and worms work at all. If you are compiling everything locally, nobody else needs to know the instruction set and addressing schema of your hardware; and if all computers were different, code compiled on one machine would not be able to run on any other machine. The only ways around this would be to write malware in interpreted languages {and so allow white hats access to the source code, thereby mitigating the threat greatly} or somehow to persuade users to compile it and run it {and again allow white hats access to the source code}.
The malware problem won't begin to go away till we ditch the 80x86 architecture and all closed-source software altogether. Build every machine to be fundamentally electronically incompatible; and probably with an actual physical switch, hardwired to the motherboard, that needs to be operated to allow the computer to compile anything. That will solve as much of the problem as can be solved in the machine domain. Whatever remains as a problem exists in the human domain and needs to be solved there.
Je fume. Tu fumes. Nous fûmes!
In Soviet Russia Symantec viruses you!
All they have to do is rebrand their anti-virus product "PC Anywhere SE".
Rich And Stupid is not so bad as Working For Rich And Stupid.
Isn't it about time to admit that when security vendors can't get security done right no matter what, the holes are more about industrial espionage than security and are left there by design. - Like, we've been here a million times.
"Haw haw!" - Nelson Munz
I find it hard to believe the parent was modded insightful.
Security isn't easy at best, and the more computers, applications and disparate networks you have to manage the worse it gets. Name for me a software firewall that doesn't require "teaching"? Eventually, you'll install something that will not work until you open the port it needs. The newer swfws will at least popup a quick box asking you if you'd like to permanently allow the connection. I've used zone alarm, tpf, netpeeker, scs and, yes, XPs -- to name a few. Of them, XPSP2's swfw seems to be the most "user-friendly" -- i.e., less nagging. But, then again, it only blocks incoming. Most other, "better" swfws will also block outgoing -- which is what you really want to do on a network you're managing.
The other thing that gets me about 99% of the posters here is they seem to only have experience on their home computer. From that POV they are correct and Symantec and other "enterprise" products have areas to improve on, but I help manage a network with 1000s of systems. Correcting applications that refuse to work with XPSP2, or getting most administrative AV packages to work well across a huge and disparate network is difficult. In some cases, you cannot patch and an AV product is all you got. The vast majority of the time, once you push SAV to a remote machine (that could be 3000 miles away) it will install, get good virus defs, and keep humming right along no problem. In the years we've used NAVCE and now SAVCE, only one time did we get a virus that the current virus defs not detect. In that case, we worked with Symantec and they quickly updated their virus defs for us and the problem was solved.
Experience also exists outside the home and on just one computer....
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
This gaping hole is intentional, but it wasn't suppose to be released yet. That was a mistake. It's a new Symantec Anti-Virus feature called "Wide Open Front Door". WOFD opens up many large security holes in your system, with the intention of confusing attackers - when a potential attacker finds a system with so many massive, gaping security flaws, they figure their must not be anything interesting inside because if there were the system would certainly be locked down tight. The potential attacker will figure it's not worth the trouble and attack some other system instead.
--- What?
TinFoil hat's aren;t the best protection, according to some research.
Symantec has putting out terrible products for years now. In addition to totally devastating the products it buys, it also makes them nearly impossible to remove. I have had to forcefully remove Norton products from many of my clients' systems by using the "forced removal" tools that Symantec provides. Now, I don't know if it's just me, but isn't that a bad sign when a company provides tools (even though the tools are buried in their corporate site) to remove their own products because the product's own uninstall routines fail miserably so often?
I normally recommend something along the lines of AVG or Avast! to customers after that little experience. People normally learn after their wallet gets hit a few good times for computer repair.
Your email has been returned due to insufficent voltage.
Keep your patches up to date, or don't connect to the internet...
Rrright! There has never been a case when the worm came before MS issued a patch, has it?
I'm much more funny, interesting and insightful than the moderators think
... Antivirus hacks YOU!
er...
And this morning on boot up, my SAV crashed. Just for fun, I let it report the error.
That is so ironic it's almost surreal.
That's like making an operating system that causes a computer not to operate.
Oh, wait...
Apparently, you don't realize just how widespread NA is used throughout corporate, education, and government networks. It's a big fucking deal so stop trying to minimize the security risk.
Sometimes you have to wonder. If one reads enough of these vulnerabilities in Windows and antivirus and browser systems, one would get the idea that it's all quite convenient in some ways. I am not a conspiracy theorist ... well after this post I may be. My theory would be that a company could easily be approached by the government and paid to add back doors to their software. It's a lot safer than trying to get records from the phone companies and there's a lot more information to be had.
If the company is large enough, it would never get noticed by regular programmers. All it would take is a compromized module, object, dll, whatever to make this happen. Even a compromized compiler would do it.
So now we all know that Scott Adams posts to Slashdot as SomeGuyFromCA (197979). :^)
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
So Symantec is actually secretly Microsoft. I tell you I've suspected it all along.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
The difference between the home and enterprise version of Norton are absolutely huge. One sucks, one seems to work fairly well. The home version is awful. I mean really, I don't think I could possibly design a worse product. What genius decided that massive dependencies on Internet Explorer is a good idea for an antivirus program. Internet Explorer and related components are usually the ones raped in virus and malware attacks. IE breaks, and the interface to NIS breaks. Brilliant!
Can't uninstall in safe mode. Uninstall works so poorly they even release a standalone uninstaller, which in my experience is necessary almost 50% of the time for broken Norton installs.
The silent breakage. NIS is absolutely famous for this. I get clients call with the broken net access, sluggish response, programs not running correctly, scripting engines not working under IE despite being enabled, etc. Malware, virus, spyware? Nope. It's NIS. I can't count the number of quirky problems fixed simply by uninstalling NIS. It's generally a first step for me anymore.
Learning firewalls are totally pointless for home users. The typical home user can barely check email, and clicks OK to every web-popup. Do you really think they are up to allowing/denying outoing port traffic? Even in the corporate environment, you should never trust a user to make decisions like that. It's not their job. If you're an admin, they pay YOU to do that.
And no NAV, I don't give rats ass unless you actually find an infection. Take your little balloon popups and shove them. If you don't have anything valid to say, leave me the hell alone. All of the major AV programs these days are pretty much adware. "hey look at us, we're working. You paid for us and we're doing something, yeah!". Damn attention whores.
ol' Symantec has a hole... eEye, eEye, Oh!
it is a big security flaw... eEye, eEye, Oh!
with a worm attack here and a rootkit there... eEye, eEye, Oh!
The meaning of "hand" or "HAND" has been updated from "Have a nice day" to the much more hip and trendy "Talk to the (hand)". Please make a note of it.
TTYL.
Symantec Client Security -- their enterprise software firewall -- allows an administrator to pre-configure the firewall settings and then push to as many workstations as needed w/o the user ever having to deal with anything (popups, whathaveyou).
Unfortunately, all other swfws require the user to be involved at some point -- even MS's that comes with XPSP2 (am I the only one who gets the popups asking if I want to allow the requested connection?). Name for a swfw you could install on your mom's computer that won't need some user interation. Seriously, I hope you can cuz I want it!
Otherwise, I don't get your hostility. Oh wait, yes I do too....
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
It's bad enough Symantec AV corp editions have a documented bug from versions 9.x-10.1 that cause windows domain controllers to crash, but this is like adding salt to a wound. Symantec should really open up their support databases and provide better knowledge bases to their customers.
These guys and plenty others work with the Department of LameLand InSecurity. Their hands are badly stuck in the porkbarrel. Come the revolution it's jail for 'em ;-)
Now mod the incite...
Have a nice day!
No, no... you guys are all missing the point. This was a strategic move on the part of the antivirus industry as a whole. Look for "meta-antivirus" software packages---in home, small business, and enterprise versions---on your CompUSA shelves soon. One "level" of protection just isn't (profitable) enough!
I have a great new business idea! We'll sell Anti-Virus Anti-Virus programs!
No, I will not work for your startup
*pawwave*
Bah.
if the answer isn't violence, neither is your silence / freedom of expression doesn't make it alright
Win-win? Do you claim each core will run its own copy of Windows?
I do recall having to type win at the DOS prompt to start Windows and lose performance.
I actually experimented with renaming win.com to lose.com... and that was in the days of Win3.11fW... was I a prophet or what?
http://en.opensuse.org/Welcome_to_openSUSE.org
Sorry. Couldn't resist. OK, start flaming now.
I've dropped Symantec's products like a hot-potato.
It happened one fine day, whwen I saw my harddisk sans netcat. The guy *just* erased all instances of it. When I downloaded a new copy and unzipped, I found the exe 0wner and deleted.
So long, and thanks for all the lost cycles!
* lon3st4r *