9 ms·

Symantec's Bad Week

182 points by ontoillogical 10y ago

joeyrideout 10y ago
I love the (military, not Zombieland) "double tap" nomenclature for follow-up phishing emails that pretend to be warnings about recent phishing emails. It's a pattern in social engineering that I've seen used a bunch, particularly in "vishing" phone calls [1], but never had a good buzzword for until now. [1] https://youtu.be/h8kWcggio5A https://youtu.be/h8kWcggio5A
0xdeadbeefbabe 10y ago
Footnote 1 is very interesting (and so is the rest of the post): > You know, it’s interesting that before I became the CEO of a startup, the only time I thought about “conversion rates” of emails in my career was when I was involved in phishing campaigns. Edit: It's interesting to me that phishers are evil bad etc., and yet more interested in responding well to the rhetorical situation than people with careers.
- joeyrideout 10y ago
  Perhaps malware vendors will soon begin content-marketing to increase engagement with their target markets!
  - zdkl 10y ago
    "begin"
  - basicplus2 10y ago
    Symantec has been doing that very successfully it seems
sjclemmy 10y ago
For anyone who doesn't know the title is a pun on https://en.m.wikipedia.org/wiki/PiHKAL https://en.m.wikipedia.org/wiki/PiHKAL
- deckar01 10y ago
  Next thing you know they will be self administering their own 0-day exploits.
DCoder 10y ago
From SecurityWeek's writeup on the same topic [1]: No interaction is required to trigger the exploit. In fact, when Ormandy sent his PoC to Symantec, the security firm’s mail server crashed after its product unpacked the file. [1]: http://www.securityweek.com/critical-vulnerability-symantec-av-engine-can-be-exploited-sending-email http://www.securityweek.com/critical-vulnerability-symantec-...
- ontoillogical 10y ago
  The source for that detail is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=820#c1 https://bugs.chromium.org/p/project-zero/issues/detail?id=82... > I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent. > They had missed the report, so I sent it again with a randomly generated password. I'm not 100% sure I buy it. The follow up comment is about how he had mistakenly sent them a wrong testcase, and he had sent them similar exploits in a zip with the password infected before (see https://bugs.chromium.org/p/project-zero/issues/detail?id=810 https://bugs.chromium.org/p/project-zero/issues/detail?id=81... from April 28th). It would be incredible for Symantec to guess the password "infected" for ZIP files. It's possible though!
  - jwcrux 10y ago
    "infected" is the industry standard. IIRC (could be making this up) gmail knows to try "infected" in password protected zips.
    - graystevens 10y ago
      Correct in regards to "infected" being used industry-wide for malware infected zips
    - ontoillogical 10y ago
      Yeah I'm just surprised it's going to be scanning zips with the industry standard malware password for ... malware.
doodpants 10y ago
So, do the "stop what you're doing and upgrade" links in the article actually go to Symantec's site, or are they phishing links? Because that would be a perfect example of the type of highly effective phishing the article is talking about.
- ry_ry 10y ago
  My finger hovered over the reply button for a second as I weighed up the possibility that HN was part of an elaborate long-game attack vector!
- omegaham 10y ago
  I would laugh if he put in a link like that just to go "lol, got you again. Is this triple tapping?"
a_small_island 10y ago
>"These vulnerabilities reminded me of phishing and the Double Tap for two reasons. First, every one of these vulns can be exploited by just sending an email. Since the product is an antivirus, so it’s going to scan every file that touches your disk and every email you get for viruses. You don’t have to get your target to click a link or even open the message you sent — Symantec will happily try to parse every email you receive." Another reason not to run any "antivirus" on your personal PC
- Too 10y ago
  Wow. I've always been very against anti virus but never actually thought of this aspect. The anti virus itself is a huge attack surface, probably with higher risk than the risks it can mitigate. Sigh.
Animats 10y ago
We need ways to run "antivirus" software with fewer privileges. One way to do this is what some DoD high-security systems call "guards" and "sanitizers". When files come in from the outside, they're diverted to a jail, where something has to examine them and decide whether they can get through, and what changes have to be made to them. The guard and sanitization software runs jailed or on a separate machine - it has few privileges. All it can do is look at files and say yes or no, or remove something from the file. There's a need for a division of labor here. The downloading function in a browser shouldn't be allowed to look at the contents. The guard/sanitizer function shouldn't be allowed to do anything other than say yes or no, or modify the downloaded file. After processing each file, the guard/sanitizer function is flushed and reloaded, so that if it was corrupted, it can't affect other files.
- acdha 10y ago
  Before going that far, we need a more effective way to get the vendors to care. Symantec could have chosen to ship only the minimal filesystem interface code in the kernel and run the huge, complex inspection code in an isolated low-privilege thread, just like the Windows NT guides recommended in 1993. Symantec could have performed basic diligence and updated their dependencies when security updates were released. Symantec could have followed recommended practice for code auditing, fuzzing, etc. In each case they chose not to spend the money it'd take to be minimally competent, correctly realizing that most of their customers will never check and are unlikely to change their buying habits. Based on my experience running their enterprise management tools and dealing with their support, I'm pretty sure someone just made the business decision not to spend the money because most of their customers have audit requirements to buy something and nobody else in the industry is significantly better.
  - cmdrfred 10y ago
    Their response is very lack luster as well. I work in a enterprise environment where they run Symantec. I found out about this massive vulnerability though hacker news. No email from them, nothing. Go to their website now, not a mention of "Hey, you have to update right this second" just marketing speak about how they are the best. Mark my words somebody is going to worm this and it's going to be bad.
justinlardinois 10y ago
Is there any reason for a Windows user to use anything other than Microsoft Security Essentials (or Defender as it's been called since Windows 8)? It's free and everything I've seen and read indicates it works just as well if not better than commercial antivirus suites.
- ajcannon 10y ago
  I have not found a good reason to use anything else. There are things that MSE will not catch, and I was derided by our "computer" company for using MSE instead of a Symantec product that he would have charged us for, but I then showed him an online virus scanner that showed that the particular piece of malware (ransom wear) that we picked up was not detected by either Symantec or MSE. He then conceded "yeah, well I guess any piece of software can't catch EVERYthing." I have found that MSE is very lightweight and catches almost everything. I have not found a reason to use anything else. (I manage about 10 Windows PC's at work.)
- wmt 10y ago
  No other reason than that it systematically sucks at stopping malware campaigns compared to pretty much everyone else on independent third party comparisons such as https://www.av-test.org/en/antivirus/home-windows/ https://www.av-test.org/en/antivirus/home-windows/ But at least it's free!
- technion 10y ago
  It doesn't satisfy my auditors. Who can't seem to explain why ("it's not on the list of boxes I can tick"), other than to direct us to the big four of McAfee/Sophos/Kaspersky/Symantec.
  - reitanqild 10y ago
    Also some versions of ssl vpns scan your computer and I'm not sure if all of them accept the built in MS antivirus. (Protip: run such connections in a VM. This has a number of benefits: * when they require a full scan it takes next to no time as the vm is almost empty * when they cut off the rest of your network except for their site you can still reach google or your company server in the host machine. * who honestly wants to run all those weird drivers on their day-to-day dev or sysadmin machine? )
walrus01 10y ago
fixed that: "tl;dr: If you use software with “Symantec” or “Norton” somewhere in its name, stop what you’re doing and remove it completely."
droopyEyelids 10y ago
I think everyone is confused because they don't understand Symantec's business model. They're primarily a rent-collecting entity that leverages the requirements of regulating industries like PCI as a way to tax businesses. That why all these simple logical steps to make their product better aren't (and won't be) implemented.

182 points by ontoillogical 10y ago

I love the (military, not Zombieland) "double tap" nomenclature for follow-up phishing emails that pretend to be warnings about recent phishing emails. It's a pattern in social engineering that I've seen used a bunch, particularly in "vishing" phone calls [1], but never had a good buzzword for until now. [1] https://youtu.be/h8kWcggio5A https://youtu.be/h8kWcggio5A

0xdeadbeefbabe 10y ago

Footnote 1 is very interesting (and so is the rest of the post): > You know, it’s interesting that before I became the CEO of a startup, the only time I thought about “conversion rates” of emails in my career was when I was involved in phishing campaigns. Edit: It's interesting to me that phishers are evil bad etc., and yet more interested in responding well to the rhetorical situation than people with careers.

joeyrideout 10y ago
Perhaps malware vendors will soon begin content-marketing to increase engagement with their target markets!
- zdkl 10y ago
  "begin"
- basicplus2 10y ago
  Symantec has been doing that very successfully it seems

sjclemmy 10y ago

For anyone who doesn't know the title is a pun on https://en.m.wikipedia.org/wiki/PiHKAL https://en.m.wikipedia.org/wiki/PiHKAL

deckar01 10y ago
Next thing you know they will be self administering their own 0-day exploits.

DCoder 10y ago

From SecurityWeek's writeup on the same topic [1]: No interaction is required to trigger the exploit. In fact, when Ormandy sent his PoC to Symantec, the security firm’s mail server crashed after its product unpacked the file. [1]: http://www.securityweek.com/critical-vulnerability-symantec-av-engine-can-be-exploited-sending-email http://www.securityweek.com/critical-vulnerability-symantec-...

ontoillogical 10y ago
The source for that detail is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=820#c1 https://bugs.chromium.org/p/project-zero/issues/detail?id=82... > I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent. > They had missed the report, so I sent it again with a randomly generated password. I'm not 100% sure I buy it. The follow up comment is about how he had mistakenly sent them a wrong testcase, and he had sent them similar exploits in a zip with the password infected before (see https://bugs.chromium.org/p/project-zero/issues/detail?id=810 https://bugs.chromium.org/p/project-zero/issues/detail?id=81... from April 28th). It would be incredible for Symantec to guess the password "infected" for ZIP files. It's possible though!
- jwcrux 10y ago
  "infected" is the industry standard. IIRC (could be making this up) gmail knows to try "infected" in password protected zips.
  - graystevens 10y ago
    Correct in regards to "infected" being used industry-wide for malware infected zips
  - ontoillogical 10y ago
    Yeah I'm just surprised it's going to be scanning zips with the industry standard malware password for ... malware.

doodpants 10y ago

So, do the "stop what you're doing and upgrade" links in the article actually go to Symantec's site, or are they phishing links? Because that would be a perfect example of the type of highly effective phishing the article is talking about.

ry_ry 10y ago
My finger hovered over the reply button for a second as I weighed up the possibility that HN was part of an elaborate long-game attack vector!
omegaham 10y ago
I would laugh if he put in a link like that just to go "lol, got you again. Is this triple tapping?"

a_small_island 10y ago

>"These vulnerabilities reminded me of phishing and the Double Tap for two reasons. First, every one of these vulns can be exploited by just sending an email. Since the product is an antivirus, so it’s going to scan every file that touches your disk and every email you get for viruses. You don’t have to get your target to click a link or even open the message you sent — Symantec will happily try to parse every email you receive." Another reason not to run any "antivirus" on your personal PC

Too 10y ago
Wow. I've always been very against anti virus but never actually thought of this aspect. The anti virus itself is a huge attack surface, probably with higher risk than the risks it can mitigate. Sigh.

Animats 10y ago

We need ways to run "antivirus" software with fewer privileges. One way to do this is what some DoD high-security systems call "guards" and "sanitizers". When files come in from the outside, they're diverted to a jail, where something has to examine them and decide whether they can get through, and what changes have to be made to them. The guard and sanitization software runs jailed or on a separate machine - it has few privileges. All it can do is look at files and say yes or no, or remove something from the file. There's a need for a division of labor here. The downloading function in a browser shouldn't be allowed to look at the contents. The guard/sanitizer function shouldn't be allowed to do anything other than say yes or no, or modify the downloaded file. After processing each file, the guard/sanitizer function is flushed and reloaded, so that if it was corrupted, it can't affect other files.

acdha 10y ago
Before going that far, we need a more effective way to get the vendors to care. Symantec could have chosen to ship only the minimal filesystem interface code in the kernel and run the huge, complex inspection code in an isolated low-privilege thread, just like the Windows NT guides recommended in 1993. Symantec could have performed basic diligence and updated their dependencies when security updates were released. Symantec could have followed recommended practice for code auditing, fuzzing, etc. In each case they chose not to spend the money it'd take to be minimally competent, correctly realizing that most of their customers will never check and are unlikely to change their buying habits. Based on my experience running their enterprise management tools and dealing with their support, I'm pretty sure someone just made the business decision not to spend the money because most of their customers have audit requirements to buy something and nobody else in the industry is significantly better.
- cmdrfred 10y ago
  Their response is very lack luster as well. I work in a enterprise environment where they run Symantec. I found out about this massive vulnerability though hacker news. No email from them, nothing. Go to their website now, not a mention of "Hey, you have to update right this second" just marketing speak about how they are the best. Mark my words somebody is going to worm this and it's going to be bad.

justinlardinois 10y ago

Is there any reason for a Windows user to use anything other than Microsoft Security Essentials (or Defender as it's been called since Windows 8)? It's free and everything I've seen and read indicates it works just as well if not better than commercial antivirus suites.

ajcannon 10y ago
I have not found a good reason to use anything else. There are things that MSE will not catch, and I was derided by our "computer" company for using MSE instead of a Symantec product that he would have charged us for, but I then showed him an online virus scanner that showed that the particular piece of malware (ransom wear) that we picked up was not detected by either Symantec or MSE. He then conceded "yeah, well I guess any piece of software can't catch EVERYthing." I have found that MSE is very lightweight and catches almost everything. I have not found a reason to use anything else. (I manage about 10 Windows PC's at work.)
wmt 10y ago
No other reason than that it systematically sucks at stopping malware campaigns compared to pretty much everyone else on independent third party comparisons such as https://www.av-test.org/en/antivirus/home-windows/ https://www.av-test.org/en/antivirus/home-windows/ But at least it's free!
technion 10y ago
It doesn't satisfy my auditors. Who can't seem to explain why ("it's not on the list of boxes I can tick"), other than to direct us to the big four of McAfee/Sophos/Kaspersky/Symantec.
- reitanqild 10y ago
  Also some versions of ssl vpns scan your computer and I'm not sure if all of them accept the built in MS antivirus. (Protip: run such connections in a VM. This has a number of benefits: * when they require a full scan it takes next to no time as the vm is almost empty * when they cut off the rest of your network except for their site you can still reach google or your company server in the host machine. * who honestly wants to run all those weird drivers on their day-to-day dev or sysadmin machine? )

walrus01 10y ago

fixed that: "tl;dr: If you use software with “Symantec” or “Norton” somewhere in its name, stop what you’re doing and remove it completely."

droopyEyelids 10y ago

I think everyone is confused because they don't understand Symantec's business model. They're primarily a rent-collecting entity that leverages the requirements of regulating industries like PCI as a way to tax businesses. That why all these simple logical steps to make their product better aren't (and won't be) implemented.