Unpatched Symantec flaw leads to university data breach
32812
(InfoWorld) - An unpatched flaw in a Symantec anti-virus management console resulted in the compromise of a server containing the names and Social Security numbers of nearly 45,000 students at the University of Colorado at Boulder. The students, enrolled at the university from 2002 to present, are presently being notified about a potential compromise of their information as a result of the breach, according to a statement posted on the school's Web site. The breached server belonged to the Academic Advising Center of the University's College of Arts and Science. According to Dan Jones, director for campus IT security, the intrusion was discovered May 12 by the university's security staff when the compromised server started scanning other Internet-connected systems, including those on campus, for the same Symantec flaw. The vulnerability in question was a previously disclosed flaw for which Symantec had already issued a patch, but which the Advising Center had not applied. It is not clear if the compromised server had been infected by another similarly infected system or had been deliberately broken into, Jones said. None of data on the system appears to have been compromised in the incident but the university is alerting affected individuals all the same in keeping with its notification policy, Jones said. He added that no other servers appear to have been infected. The infected server was taken offline following the discovery of the breach, and all applications needed by the Advising Center were brought up on another server that is being managed by the university's central IT organization, Jones said. Measures are also underway to bring all IT operations at the Arts and Sciences Advising Center under the control of the central IT department, Jones said. The move is part of a broader effort under which distributed IT operations across campus are being centralized, he added. In addition, the university is continuing with its efforts to purge Social Security numbers from all CU-Boulder computers in all departments. The university is also making available new host intrusion-detection software to campus IT administrators, according to a statement on the school's Web site.
61922
SAN FRANCISCO -- A computer hacker accessed names and Social Security numbers of about 1.4 million Californians after breaking into a University of California, Berkeley, computer system in perhaps the worst attack of its kind ever suffered by the school
316852
Holey night Symantec says it has fixed vulnerabilities in its NetBackup storage software identified by TippingPoint.â¦
396453
A non-campus computer and server that were hooked to the campus network without proper security precautions have been linked to a University of California, Berkeley, hacker
743855
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
238495
Symantec, seeking to make amends for the glitch that knocked out thousands of computers across China last month, is offering affected users free backup software and an extension on their subscription to their anti-virus software. Some customers are not mollified.
86222
In brief Exploit circulating for unpatched vuln
432894
Up to 800,000 of the school's students, faculty and alumni may be vulnerable to identity theft.  What went wrong, and what can be done about it?
400722
Unpalatable A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.â¦
19620
Authorities are trying to determine how a hacker gained access to a University of California computer that contained personal information for up to 600,000 state residents.
349737
In a potentially huge computer security breach, a hacker broke into a computer at UC Berkeley containing Social Security numbers and other personal data for about 600,000 Californians, the university said Wednesday.
607054
Symantec Corp.&#39;s Security Response service on Friday confirmed that unpatched Windows vulnerabilities could pose a serious risk for exploits via malicious Web pages and e-mail messages.
413013
Security researcher issues a warning that a rogue software application targeting the Mac has surfaced.
150857
Microsoft describes unpatched flaw that could corrupt PC memory and allow intruders.
140360
A Rice University computer scientist and two of his students have discovered a potentially serious security flaw in the desktop search tool for personal computers that was recently distributed by Google.
725739
As many as 800,000 current and former employees and students of the University of California Los Angeles may be at risk after a hacker gained access to their private information, the school disclosed on Tuesday.