Symantec puts encryption on the backup server
474680
Symantec's new Veritas NetBackup Media Server Encryption Option offers encryption at the backup server, relieving application servers of the chore and also offers centralized key management.
262461
NetBackup 6.5 leads new initiative Symantec fleshed out its storage software portfolio today, and wheeled in CEO John Thompson to big up the launch during his keynote at the Symantec Vision conference in Las Vegas.â¦
214456
Update to SecureCore firewall aims to prevent programs from executing malicious commands.
697857
Symantec Corp. (NASDAQ: SYMC) today announced that Symantec Security Response in conjunction with the Indiana University School of Informatics has uncovered a significant new security threat.
753042
(InfoWorld) - The notorious Mpack hacker toolkit is installing malware that carries out its chores -- including spewing spam -- from within the Windows kernel, making it extremely difficult for security software to detect it, Symantec said Thursday. The Trojan horse that Symantec has dubbed "Srizbi" is being dropped onto some PCs by the multi-exploit Mpack, a ready-to-use attack application that until recently has been selling for around $1,000. Responsibility for a large-scale attack launched from thousands of hijacked Web sites last month was pinned on Mpack, as was a follow-up campaign waged from compromised Internet porn sites. Although Mpack can force-feed any malicious code to a commandeered PC, Symantec researchers said Srizbi stands out. Rather than follow the current practice of hiding only some activities with rootkit-cloaking technologies, Srizbi goes completely undercover. The new Trojan, said Symantec, works without any user-mode payload and does everything from kernel mode, including its main task: sending spam. "When Trojans go to spam, they go out to user land," said Dave Cole, director of Symantec's security response team, referring to malware writers injecting their code into visible Windows processes to carry out spam-sending tasks. "Srizbi, though, is basically using kernel libraries [to send spam]," said Cole. "It's calling the kernel libraries it needs." A blog entry by Kaoru Hayashi, a senior security response engineer at Symantec, spelled out the technical details. "Srizbi seems to move a step forward by working totally in kernel mode without the need to inject anything into user mode," wrote Hayashi. "To manipulate the network connection directly in kernel mode, it attaches NDIS and TCP/IP drivers and gets all the Ndis* and Zw* functions that it needs. This technique also allows the Trojan to bypass firewall and sniffer tools, and to hide all its network activities." Translation: Only advanced security tools will detect Srizbi. It's also the first full-kernel malware spotted in the wild. "It's evolutionary, not revolutionary, but it's indicative of what we see in the threat landscape," Cole said. "And if your security software is relying only on [Windows'] APIs to detect malware, you won't be protected. You need something that uses modern, anti-rootkit techniques." Cole added other information to the Srizbi story, in particular his suspicion that its author is probably the same hacker who created Rustock, a dangerous polymorphic Trojan from 2006 that also relied on rootkit technology to avoid detection. "It appears to be from the same author," said Cole. "He's been quiet for a while, and everyone has been waiting for Rustock 2.0. Some thought he'd maybe went away, but [Srizbi] uses some of the same components as Rustock." Cole expects Srizbi to follow a similar trajectory. "The pattern with Rustock seemed to be to get something out there that might be sloppy at first, but to evolve it over time. It's reasonable to believe that [Srizbi] will do the same." According to Symantec's research, the new Trojan is sloppy. "Users may be able to detect the presence of this malicious code via a registry key that happens to not be hidden by the rootkit component," said an alert to Symantec's DeepSight customers. The registry key to look for, said Symantec, is: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RcpApi\\"MachineNum" = "[six random digits-six random digits-two random digits]" In other Mpack-related news, a third Symantec security researcher said today that he's spotted the toolkit selling for as little as $150, an 85 percent reduction from its previous $1,000 price tag. "Considering the toolkit is written in a script language, it is easy to redistribute and modify," said Eric Chien, a Symantec security response engineer. "The sellers likely didn't even need to buy it themselves, but rather probably found some of the multiple Web sites that did not employ standard Web site protections, allowing them to download the whole kit for free. "Talk about clearance sales." Mpack's wider "distribution" spells trouble not only for the hacker -- suspected to be Russian -- who created the multiple-strike attack kit, but for users, too. "Its usage is likely to grow," said Chien. "In addition, without a single author controlling the distribution of the toolkit, we also expect to see forks of the source code with additional exploits, bug fixes, and other feature enhancements."
747033
(InfoWorld) - Symantec Corp. Wednesday released a beta of its new enterprise security product, formerly code-named Hamlet, that melds technology from several of the company's acquisitions over the last few years. The product, Symantec Endpoint Protection 11.0, replaces the previous enterprise version, Symantec AntiVirus. It's a public beta, and the final version will be released around September. Symantec has decided not to charge more for the new product. "We believe the level of protection you should get for your money should be higher," said Mathew Lodge, director of product marketing for Europe, the Middle East and Africa. The EndPoint Protection suite is the culmination of a Symantec buying spree that included acquisitions of Sygate, Whole Security and Veritas. "We've spent a lot of money buying other companies," Lodge said. "We've integrated that technology into the new release." Endpoint Protection includes technology that looks at how applications behave, a way to detect if a program is doing something suspicious. For example, some malicious software programs try to download other programs from the Internet, which often is a bad sign. The suite includes other security features such as antivirus and antispyware capabilities, a firewall and host and network-based intrusion prevention technology. Another new feature is application control, which allows administrators to control what programs users can run on their machines. Also new is Symantec Network Access Control 11.0, an optional module that can be incorporated into Endpoint Protection. The feature determines whether or not to allow a mobile device to connect to the network depending on if it is a security risk, such as if the device doesnât have up-to-date patches. The module accommodates both Cisco's and Microsoft's protocols for network access control, Lodge said. It can also simply authenticate and check devices when they connect to a network and make a DHCP (Dynamic Host Configuration Protocol) request, Lodge said. Symantec also announced a new program called Storage United, which is designed to help companies better organize their data storage even if they are using different OSes and storage hardware platforms. The program revolves around three themes: next-generation data protection, storage management and information management, said Kevin Bailey, senior product marketing manager. Prominent in the strategy will be use of NetBackup, a storage platform that came from Symantec's acquisition of Veritas, Bailey said. REFERENCES: Symantec slips, but closes in on AV product delivery, May 2, 2007Symantec mobile security client delayed, May 30, 2007
32812
(InfoWorld) - An unpatched flaw in a Symantec anti-virus management console resulted in the compromise of a server containing the names and Social Security numbers of nearly 45,000 students at the University of Colorado at Boulder. The students, enrolled at the university from 2002 to present, are presently being notified about a potential compromise of their information as a result of the breach, according to a statement posted on the school's Web site. The breached server belonged to the Academic Advising Center of the University's College of Arts and Science. According to Dan Jones, director for campus IT security, the intrusion was discovered May 12 by the university's security staff when the compromised server started scanning other Internet-connected systems, including those on campus, for the same Symantec flaw. The vulnerability in question was a previously disclosed flaw for which Symantec had already issued a patch, but which the Advising Center had not applied. It is not clear if the compromised server had been infected by another similarly infected system or had been deliberately broken into, Jones said. None of data on the system appears to have been compromised in the incident but the university is alerting affected individuals all the same in keeping with its notification policy, Jones said. He added that no other servers appear to have been infected. The infected server was taken offline following the discovery of the breach, and all applications needed by the Advising Center were brought up on another server that is being managed by the university's central IT organization, Jones said. Measures are also underway to bring all IT operations at the Arts and Sciences Advising Center under the control of the central IT department, Jones said. The move is part of a broader effort under which distributed IT operations across campus are being centralized, he added. In addition, the university is continuing with its efforts to purge Social Security numbers from all CU-Boulder computers in all departments. The university is also making available new host intrusion-detection software to campus IT administrators, according to a statement on the school's Web site.
504765
Symantec has announced that several of its firewalls and gateways are vulnerable to denial of service attacks, and has released firmware to fix them.
577721
(InfoWorld) - Anti-virus firm Symantec warned today that exploit code is circulating for a known security hole in Computer Associates' BrightStor ARCServe Backup software, which provides data backup and restore for a variety of operating systems including Windows, Netware, Linux, Unix, and Mac. Symantec issued an alert early Friday, after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software. The exploit code is designed to run on Windows XP and Windows 2000 systems. The remote buffer overflow vulnerability in BrightStor was initially disclosed on January 12, when CA released a patch to fix the hole. According to CA, the flaw results from insufficient bounds checking on user-supplied data. Attackers could trigger the overflow using specially crafted RPC (Remote Procedure Call) requests sent to TCP ports 6503 or 6504. Triggering a buffer overflow would allow attackers to run malicious code on the vulnerable system with administrative privileges, allowing them to take control of the vulnerable machine. Backup software is a particularly attractive target for malicious hackers, because the systems -- by their nature -- store large volumes of data that can be accessed when the systems are compromised, said Max Caceras, director of product management at Core Security. BrightStor customers are advised to apply the patch that fixes the vulnerability or to block external access to the BrightStor software or use IDS to spot attacks.
145108
Blog: New suite of smart phone protection includes antispam for SMS and data encryption.
196646
With a waterproof casing, this is a chunkier drive that comes in a serious-looking gray. Data is protected using 256-bit AES encryption. Any person trying to access files needs a password. After 10 unsuccessful password attempts (the default), the drive locks and can't be accessed without formatting the drive.
411679
The volume of worms and viruses is increasing, but the rate of successful attacks has dropped, according to Symantec.
374831
Bank deploying software designed to encrypt confidential documents, control access no matter where they travel.
433732
There&#39;s good news and bad news on the security front. Internet security company Symantec Corp. on Monday released its Internet Security Threat Report, which provides a six-month snapshot
732682
Security workers warn that encrypting stored data doesn't truly protect it, and you're fooling yourself if you think so.
64588
An 11-month supercomputer project suggests even tough encryption can be cracked.
385943
Security specialist Symantec has admitted to a number of vulnerabilities in its firewall and gateway products. The weaknesses make them liable to denial of service attacks and other compromises.