Sophos Anti-Virus Update Identifies Sophos Code As Malware

← Back to Stories (view on slashdot.org)

Sophos Anti-Virus Update Identifies Sophos Code As Malware

Posted by timothy on Thursday September 20, 2012 @04:51AM from the auto-immune-disease dept.

An anonymous reader writes "Yesterday afternoon anti-virus company Sophos Inc. released a normal anti-virus definition update that managed to detect parts of their own software as malicious code and disabled / deleted sections of their Endpoint security suite, including its ability to auto-update and thus repair itself. For many hours on the 19th, Sophos technical call centers were so busy customers were unable to even get through to wait on hold for assistance. Today thousands of enterprise customers remain crippled and unable to update their security software." Sophos points out that not everyone will be affected: "Please note this issue only affects Windows computers."

8 of 245 comments (clear)

Min score:

Reason:

Sort:

99.999% by jsepeta · 2012-09-20 04:52 · Score: 5, Insightful

how many of Sophos customers are not on the Windows platform? that makes me laugh.

--
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
1. Re:99.999% by thereitis · 2012-09-20 05:22 · Score: 4, Insightful
  
  Speaking of percentages, I wonder what percentage of anti-virus updates go terribly wrong like this. 0.00001%? AV companies are constantly producing new signatures, many times per day. All it takes is one mistake and you have a loose cannon and a front page news article like this one. It's impressive that there aren't more occurrences.
2. Re:99.999% by Culture20 · 2012-09-20 05:37 · Score: 4, Insightful
  
  What's impressive is that this got out of Sophos' testing lab and into production. I guess they must not test signatures in house at all. Congratulations, Sophos customers, you've been promoted to alpha testers.
Can We Say Test our Code, anyone??? by realsilly · 2012-09-20 04:54 · Score: 4, Insightful

This is a classic case of not thoroughly testing code and making sure you have enough variations of test machines to ensure as little pain to clients as possible.
If I were a customer, I would be shopping for a better company.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.
1. Re:Can We Say Test our Code, anyone??? by MrEricSir · 2012-09-20 05:08 · Score: 3, Insightful
  
  If I were a customer, I would be shopping for a better company.
  Is there a better company, though? Seems like all the major antivirus vendors have had embarassing false positives like this in the past.
  
  --
  There's no -1 for "I don't get it."
2. Re:Can We Say Test our Code, anyone??? by girlintraining · 2012-09-20 06:01 · Score: 4, Insightful
  
  That's pocket change compared to how much the company can lose over a screw up like this.
  Emphasis mine. Look, every major antivirus producer has made a similar mistake to this. Sometimes, it takes the whole operating system down with it (Symantec anyone?). Whether you agree or disagree, it's clear there are business incentives for a fast workflow process -- and as the old saying goes "Do it fast, do it right, do it cheap -- pick any two." It's obvious which ones the antivirus industry as a whole has chosen. Rather than argue over whether or not they're right, I'm pointing out why they're making those choices. Businesses aren't willing to pay a premium to avoid mistakes like this. The cost of the occasional screwup like this is less than the cost required to do all the testing and lab work that many here on slashdot seem to support.
  It's a business decision they've made, right or wrong.
  
  --
  #fuckbeta #iamslashdot #dicemustdie
Re:That's why I don't install AV software on my PC by Anonymous Coward · 2012-09-20 05:19 · Score: 3, Insightful

No, it's like saying you don't use condoms because you only go to bed with people you know well enough to trust them when they say they're on the pill.
Re:Which just goes to show... by localman57 · 2012-09-20 05:37 · Score: 3, Insightful

Just so this whole thing doesn't spin out of control, the code is total bullshit I made up myself. Seemed better than just posting a comment about the 3rd law.