Slashdot Mirror
Sophos Anti-Virus Update Identifies Sophos Code As Malware
An anonymous reader writes "Yesterday afternoon anti-virus company Sophos Inc. released a normal anti-virus definition update that managed to detect parts of their own software as malicious code and disabled / deleted sections of their Endpoint security suite, including its ability to auto-update and thus repair itself. For many hours on the 19th, Sophos technical call centers were so busy customers were unable to even get through to wait on hold for assistance. Today thousands of enterprise customers remain crippled and unable to update their security software."
Sophos points out that not everyone will be affected: "Please note this issue only affects Windows computers."
how many of Sophos customers are not on the Windows platform? that makes me laugh.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
This is a classic case of not thoroughly testing code and making sure you have enough variations of test machines to ensure as little pain to clients as possible.
If I were a customer, I would be shopping for a better company.
Life takes interesting turns, but the most interest is when you're off the beaten path.
they're running Avast free version like everyone else.
Obviously, once this change had gone in, Sophos was correct to identify itself as malicious.
I am officially gone from
Considering all the people I know that still want to stay with XP no matter what, it doesn't surprise me at all.
Understanding the scope of the problem is the first step on the path to true panic.
Let's see this isn't a virus, it's kinda like software leukemia or a software autoimmune disease.
The detection rate for Sophos's malware engine inched closer to 100%.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
That's like saying you don't use condoms because you know how to pull out.
"test by eyeballing the code" has its drawbacks.
Exactly. Sometimes code that looks useless is really pretty important. The article follow up said they removed this test from an iteration loop, since there weren't comments about what it did. Apparently the original programmers thought it obvious...
if ( asimov_3rd_violation())
{
continue;
}
else
{
remove_file(filename);
}
Every year, we need to go down the list of software makers who have managed to totally Bork their users. The Meltdown awards. Just to distinguish between the companies that handle it well and the companies that are incompetent.
What would Richard Feynman do, if he were here right now? He'd do some math and he'd follow through!
My cousin used to say the same sort of thing about his know-it-all supervisor at work that was always riding him to wear safetly glasses. After he got back from disability, the guy got him a couple of tickets to Avatar in 3d, just to be an asshole.
No, it's like saying you don't use condoms because you only go to bed with people you know well enough to trust them when they say they're on the pill.
I would say it's like having sex without a condom with a long-term partner who you trust not to carry diseases.
Wanna cause problems? Add code from the various AV vendors...
This should be obvious to any geek! What is Asimov's 3rd law? All together now: "A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws."
I've never seen the code in question, and it's obvious to me that this means "don't delete myself".
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Just so this whole thing doesn't spin out of control, the code is total bullshit I made up myself. Seemed better than just posting a comment about the 3rd law.
Just think about it. The average Windows AV program runs with sufficient privilege to wreck your system by altering or removing arbitrary files. And it gets fed multiple updates per day created by teams of workers working in a hugely stressful situation: When a new virus appears, you've got to get those signatures out NOW.
I'm amazed people don't see this risks in this.
AV users have a very similar situation too. They have no infections that they or their AV software know of.
You might assume the AV vendor is really good at spotting malware, but their job is like solving the halting problem, only without knowledge of the full inputs and program.
I on the other hand prefer to "solve" the halting problem by ensuring the program actually halts no matter what happens- aka Sandboxing.
Measure twice, cut once!
That's the old, craftsmanship way. These days, especially with software, it's measure with a micrometer, mark with chalk, cut with an axe.
Free Martian Whores!
Using the identification of the client logmails : - I remotely stopped the Sophos Av service and auto update service - removed agen-xuv.ide - copied the full autoupdate folder contents to the remote pc - restarted both services After a few pcees I wrote a batch script to handle all clients Got it done after 5 hours work
Avoid your fears , or wonder at the past
Yes, this was bad. The virus signature in question appears to match any software that does auto-updates (possibly trying to spot phone-home malware?) so it's flagged dozens of software packages and according to what policy you've set, quarantined or deleted the files. This includes the auto-update part of the sophos client. The flood of emails from the sophos enterprise manager package as machines were switched on this morning quickly alerted us that this wasn't good, and just looking at names of the files it was flagging was enough to see that this was a false positive. Cleanup continues.
We've been very happy with sophos enterprise, and I'm staggered that this signature made it out the door - they should have numerous controls in place to ensure this can never happen and I await an explanation for how they failed.
I'm not too impressed by some of the advice given in their cleanup procedure - they advise setting the policy to not scan certain sophos directories - guess where viruses may try to hide in future.
This is an embarassing fubar which will have had a high impact on thousands of enterprises. It'll be interesting to see if Sophos come clean about the circumstances and can be convincing enough about how it's never going to happen again.