7 ms·

Symantec throws up hurdles to independent software developers

87 points by r00tbeer 14y ago

cluda01 14y ago
Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?
- ghurlman 14y ago
  No. There's nothing remotely resembling a monopoly here, just a garbage product.
  - damian2000 14y ago
    A garbage product that is unfortunately pre-installed on hundreds of millions of windows PCs. Its actually quite difficult to remove all of its components; its not just a one click operation as it should be.
    - woqe 14y ago
      I have had some success with http://www.symantec.com/nrt http://www.symantec.com/nrt .
  - tomjen3 14y ago
    Then prosecute them under Rico act. It has real teeth too.
  - antidoh 14y ago
    You don't need to be a monopoly to be a racketeer. They're completely different.
- symcthrowaway 14y ago
  They do have this program, though you are allowed to pay other CAs if you want. Symantec sells certificates (they bought Verisign), which will whitelist you, but it is not required that you get your certificate from them.
hikkymemo 14y ago
Are your executables signed?
- tonyedgecombe 14y ago
  Signing doesn't always solve the problem.
  - ryanpetrich 14y ago
    Signing should allow reputation from previous versions to apply to updates, if implemented correctly by the antivirus vendor.
    - AndreasLoew 14y ago
      The product is out for about 1.5 years now but I moved to a new domain (from texturepacker.com to codeandweb.com). This is when the trouble started. I have not signed it yet - just learned about the issue some days ago.
CamperBob2 14y ago
Why isn't this grounds for a product-disparagement lawsuit?
malkia 14y ago
We have Symantec AntiVir at work. Few months ago I was researching way to make DLL's behave like OSX/linux - e.g. while they are loaded, they can get replaced. This is doable with the compiler option /SWAPRUN:CD,NET - e.g. if your dll/exe was running from CD or Network, and the media went down, it should still work. This somehow pulls the whole data somewhere (I guess in the page file), and it can be replaced. Anyway, as soon I as started using this Symantec started reporting virus reports - not for everything - but few were enough for me to stop.
deleted 14y ago
[deleted]
randomguy1122 14y ago
Companies pay to get stuff listed. Someone paid to get rid of your product.
mjard 14y ago
I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a few business days. Second: sign your executables. This goes a long way. And no, it doesn't have to be Verisign. Third: don't change domains. This wiped out your known reputation. (Would have been acceptable if your binaries were signed) Symantec is not out to squish the little guy. Sometimes you do have a few more hoops that you are required to hop through. Symantec should have better transparency on how this process works, it's something I pushed for pretty heavily but never had the power to get done. Don't worry, you're not alone. Example: We weren't able to get Mozilla to sign their beta or developer builds that are shared on multiple mirrors (domains not related to mozilla). We'd get lots of angry (understandably) reports of reputation issues on these builds. If anybody has any questions within reason, I'll be glad to answer them.
- kevingadd 14y ago
  Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because you're the ones who added this reputation system that's causing users grief. Record known-good SHA or MD5 sums of unsigned apps like Firefox that you know are okay, for example. Or just not default this feature on.
  - gus_massa 14y ago
    It's "easy" to build a program with the same length and md5 code than another program. The md5 hash is useful as a protection against accidental collision, but it is not secure enough as a protection against an attack. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities
jim_lawless 14y ago
It's not just Symantec. I've had issues with multiple AV companies that pertained to binary-string signatures in my code. The AV companies I've dealth with all seem to have online ticketing systems that allowed for rapid correction of these situations. A few months ago, I found that a command-line screen-capture tool that I publish was flagged as malware by multiple AV products due to behavioral characteristics. In ScreenKap, I was experimenting with obfuscation of text-strings used by the code. I removed the obfuscation from the code and resubmitted to VirScan.org. I received a clean bill of health. Note that I did not formally pursue this with any of the AV companies as the string obfuscation was an experiment and was nothing that needed to remain an integral part of my product. If my assumption is correct ( please note that it is an assumption ), we might be restricted to coding in the way the AV companies think we should code.
16s 14y ago
When I used to write Windows software, Authenticode signing solved this sort of issue. Does that no longer work?
- kevingadd 14y ago
  Last I checked, Authenticode certificates are not cheap.
n-gauge 14y ago
Hence why I don't install rubbish virus checkers. It also gets confused on those 4k demos (due to the packers they use probably)
hluska 14y ago
I once worked for a company that ran into this same problem, hence, I have a whole lot of sympathy. However, I also sympathize with Symantec. The biggest problem with the AV world is that it tends to be reactive. A criminal releases a piece of malware, it infects computers and then there is a fix released. The problem is that there is a gap between release and fix and criminals exploit this gap to steal information. Reputation analysis is one possible solution. Alas, when it fails, it fails big (and hurts primarily independent developers).
jiggy2011 14y ago
Is there even much point in using AV software? I ask this because I have never installed any on my computer (including on Windows) and I have only ever knowingly been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it). On the other hand people I know who have things like Norton etc installed seem to have way more problems with their computers than me (including fairly tech savvy people). For example programs randomly breaking, tracking cookies being flagged as "malware" , general slowness of the system , nonsensical warning messages etc. Besides that they still seem to end up infected with malware more often than me and usually re-format their systems once every few months. On that one occasion that I did end up infected , I had to install 3 different AV programs and do full scans before it was even detected. Mac and Linux users never bother having AV installed and as far as I am aware there is nothing inherently more secure about either of these systems than there is Windows 7. If you are running a network , surely it would be simpler just to disallow any executable files apart from those explicitly whitelisted and to make sure security patches are installed?
- ams6110 14y ago
  In the past, on Windows and Macs (pre-OSX), it was pretty much a requirement unless your machine was really stand-alone and you never dealt with files from any untrusted sources. These days, if you keep your system patched, use an unprivileged account for your normal activity, use a local firewall and/or NAT, and stay away from shady websites you are probably pretty safe. I have similar experiences with a friend who's constantly getting malware even though he's running Windows 7 and Microsoft Security Essentials. The main vector seems to be PDF files; he deals with a lot of them via email as part of his job, and he's very much in the habit of just opening PDFs in email before he even really looks at who the sender is. I agree that many AV programs slow the sytem way down, and in general cause problems, and don't seem to really guarantee that you won't get infected. And FUD is a huge part of how it's marketed. Even Windows itself will nag you with ominous warnings if you don't have any AV software installed.
  - jiggy2011 14y ago
xpaulbettsx 14y ago
Norton has caused a large amount of frustration for our GitHub for Windows users - Symantec will basically block any EXE using MSys, because of its use of the CreateRemoteThread API. There is no way I am going to submit all of the 200+ EXEs that comprise MSysGit to that web form, though we will try signing all of the EXEs.
- mjard 14y ago
  Argh, that's rough, submit a few mention there are more, the team will be able to vet the entire collection.
voidr 14y ago
Software that does this should become illegal. This is technical slander. They are not even trying to explain what this means, the reason for this is simple: they want to show off, how many times they "protected" their customers, so that they are fooled to believe that AV products actually have value in them.

87 points by r00tbeer 14y ago

Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?

ghurlman 14y ago
No. There's nothing remotely resembling a monopoly here, just a garbage product.
- damian2000 14y ago
  A garbage product that is unfortunately pre-installed on hundreds of millions of windows PCs. Its actually quite difficult to remove all of its components; its not just a one click operation as it should be.
  - woqe 14y ago
    I have had some success with http://www.symantec.com/nrt http://www.symantec.com/nrt .
- tomjen3 14y ago
  Then prosecute them under Rico act. It has real teeth too.
- antidoh 14y ago
  You don't need to be a monopoly to be a racketeer. They're completely different.
symcthrowaway 14y ago
They do have this program, though you are allowed to pay other CAs if you want. Symantec sells certificates (they bought Verisign), which will whitelist you, but it is not required that you get your certificate from them.

hikkymemo 14y ago

Are your executables signed?

tonyedgecombe 14y ago
Signing doesn't always solve the problem.
- ryanpetrich 14y ago
  Signing should allow reputation from previous versions to apply to updates, if implemented correctly by the antivirus vendor.
  - AndreasLoew 14y ago
    The product is out for about 1.5 years now but I moved to a new domain (from texturepacker.com to codeandweb.com). This is when the trouble started. I have not signed it yet - just learned about the issue some days ago.

CamperBob2 14y ago

Why isn't this grounds for a product-disparagement lawsuit?

malkia 14y ago

We have Symantec AntiVir at work. Few months ago I was researching way to make DLL's behave like OSX/linux - e.g. while they are loaded, they can get replaced. This is doable with the compiler option /SWAPRUN:CD,NET - e.g. if your dll/exe was running from CD or Network, and the media went down, it should still work. This somehow pulls the whole data somewhere (I guess in the page file), and it can be replaced. Anyway, as soon I as started using this Symantec started reporting virus reports - not for everything - but few were enough for me to stop.

deleted 14y ago

[deleted]

randomguy1122 14y ago

Companies pay to get stuff listed. Someone paid to get rid of your product.

mjard 14y ago

I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a few business days. Second: sign your executables. This goes a long way. And no, it doesn't have to be Verisign. Third: don't change domains. This wiped out your known reputation. (Would have been acceptable if your binaries were signed) Symantec is not out to squish the little guy. Sometimes you do have a few more hoops that you are required to hop through. Symantec should have better transparency on how this process works, it's something I pushed for pretty heavily but never had the power to get done. Don't worry, you're not alone. Example: We weren't able to get Mozilla to sign their beta or developer builds that are shared on multiple mirrors (domains not related to mozilla). We'd get lots of angry (understandably) reports of reputation issues on these builds. If anybody has any questions within reason, I'll be glad to answer them.

kevingadd 14y ago
Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because you're the ones who added this reputation system that's causing users grief. Record known-good SHA or MD5 sums of unsigned apps like Firefox that you know are okay, for example. Or just not default this feature on.
- gus_massa 14y ago
  It's "easy" to build a program with the same length and md5 code than another program. The md5 hash is useful as a protection against accidental collision, but it is not secure enough as a protection against an attack. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

jim_lawless 14y ago

It's not just Symantec. I've had issues with multiple AV companies that pertained to binary-string signatures in my code. The AV companies I've dealth with all seem to have online ticketing systems that allowed for rapid correction of these situations. A few months ago, I found that a command-line screen-capture tool that I publish was flagged as malware by multiple AV products due to behavioral characteristics. In ScreenKap, I was experimenting with obfuscation of text-strings used by the code. I removed the obfuscation from the code and resubmitted to VirScan.org. I received a clean bill of health. Note that I did not formally pursue this with any of the AV companies as the string obfuscation was an experiment and was nothing that needed to remain an integral part of my product. If my assumption is correct ( please note that it is an assumption ), we might be restricted to coding in the way the AV companies think we should code.

16s 14y ago

When I used to write Windows software, Authenticode signing solved this sort of issue. Does that no longer work?

kevingadd 14y ago
Last I checked, Authenticode certificates are not cheap.

n-gauge 14y ago

Hence why I don't install rubbish virus checkers. It also gets confused on those 4k demos (due to the packers they use probably)

hluska 14y ago

I once worked for a company that ran into this same problem, hence, I have a whole lot of sympathy. However, I also sympathize with Symantec. The biggest problem with the AV world is that it tends to be reactive. A criminal releases a piece of malware, it infects computers and then there is a fix released. The problem is that there is a gap between release and fix and criminals exploit this gap to steal information. Reputation analysis is one possible solution. Alas, when it fails, it fails big (and hurts primarily independent developers).

jiggy2011 14y ago

Is there even much point in using AV software? I ask this because I have never installed any on my computer (including on Windows) and I have only ever knowingly been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it). On the other hand people I know who have things like Norton etc installed seem to have way more problems with their computers than me (including fairly tech savvy people). For example programs randomly breaking, tracking cookies being flagged as "malware" , general slowness of the system , nonsensical warning messages etc. Besides that they still seem to end up infected with malware more often than me and usually re-format their systems once every few months. On that one occasion that I did end up infected , I had to install 3 different AV programs and do full scans before it was even detected. Mac and Linux users never bother having AV installed and as far as I am aware there is nothing inherently more secure about either of these systems than there is Windows 7. If you are running a network , surely it would be simpler just to disallow any executable files apart from those explicitly whitelisted and to make sure security patches are installed?

ams6110 14y ago
In the past, on Windows and Macs (pre-OSX), it was pretty much a requirement unless your machine was really stand-alone and you never dealt with files from any untrusted sources. These days, if you keep your system patched, use an unprivileged account for your normal activity, use a local firewall and/or NAT, and stay away from shady websites you are probably pretty safe. I have similar experiences with a friend who's constantly getting malware even though he's running Windows 7 and Microsoft Security Essentials. The main vector seems to be PDF files; he deals with a lot of them via email as part of his job, and he's very much in the habit of just opening PDFs in email before he even really looks at who the sender is. I agree that many AV programs slow the sytem way down, and in general cause problems, and don't seem to really guarantee that you won't get infected. And FUD is a huge part of how it's marketed. Even Windows itself will nag you with ominous warnings if you don't have any AV software installed.
- jiggy2011 14y ago

xpaulbettsx 14y ago

Norton has caused a large amount of frustration for our GitHub for Windows users - Symantec will basically block any EXE using MSys, because of its use of the CreateRemoteThread API. There is no way I am going to submit all of the 200+ EXEs that comprise MSysGit to that web form, though we will try signing all of the EXEs.

mjard 14y ago
Argh, that's rough, submit a few mention there are more, the team will be able to vet the entire collection.

voidr 14y ago

Software that does this should become illegal. This is technical slander. They are not even trying to explain what this means, the reason for this is simple: they want to show off, how many times they "protected" their customers, so that they are fooled to believe that AV products actually have value in them.