More Security Attacks Motivated By Greed, Symantec Reports
433732
There&#39;s good news and bad news on the security front. Internet security company Symantec Corp. on Monday released its Internet Security Threat Report, which provides a six-month snapshot
126519
(InfoWorld) - It may have taken enterprise customers years to get proper security tools in place to defend their PCs, but if large businesses drag their feet in aligning the applications necessary to protect their smartphones, they will pay a heavy price, says Symantec. As part of a media tour to call attention to the planned launch of its Symantec Mobile Security Suite 5.0 package on June 4 -- touted as its most comprehensive product to date for protecting handheld devices against loss or attack -- experts with the company said hackers and electronic scammers are already creating a mobile environment that will soon rival the dangers of today's PC security landscape. All of the attack profiles that have become standard fare for desktops and laptops, from root kit-like programs that attempt to infect device operating systems, to ingenious social engineering attempts that play on the multimedia footprint of smartphones, have already arrived, said Khoi Nguyen, group product manager for mobile security at Symantec. How quickly the attacks multiply and proliferate will be determined only by the pace with which people adopt more powerful handhelds and how aggressive they are in defending the devices, he said. Unlike in previous years where much of the buzz around wireless security could be attributed to forward thinking, Symantec believes that handheld platforms are about to be deluged by a storm of different types of attacks. "Since the first mobile threats started arriving several years ago things have evolved dramatically, these attacks are real and people are being impacted by them today, particularly in other regions of the world where smartphone use is higher than in the U.S.," Nguyen said. "We are still in the early stages here, but things are evolving much more rapidly than they did on the PC side; as more enterprises adopt smartphones and they are being used more frequently to carry out financial transactions, the attackers will be there waiting." While Symantec estimates that there are still about 450 PC-oriented threats for every attack designed to assail mobile devices, the company expects the gap to close rapidly over the next several years. As new devices and applications that are expected to drive adoption of smartphones hit the market, such as those built to run on Microsoft's Windows Mobile platform, more enterprises will buy the memory-heavy handhelds and hackers will follow, the security expert said. In the last month alone, Symantec has uncovered root-kit style threats attacking Symbian smartphones which attempt to modify the devices' operating system files to bypass onboard security features. The company has also observed so-called snoopware programs, which add voice-driven schemes into the malware mix. One snoopware attack, which had the ability to remotely activate a smartphone's microphone to secretly eavesdrop on calls, take control of its camera to surreptitiously take pictures, and forward all of a user's text messages to another account, was aimed at users of Windows Mobile With an estimated 60-70 percent of the world's smartphones running on Symbian software today, most mobile previously-identified device attacks have targeted the company's OS. In moving to target Windows Mobile users in such a way, hackers illustrate how they are already preparing to cash in on the projected growth of Microsoft's platform, according to Nguyen. "Basically the threats have gone from proof-of-concept to full-blown spyware in a span of three years, whereas it took over a decade for the same type of evolution to occur on the desktop side," said Nguyen. "On the enterprise side, companies are finding that the smartphone is just another endpoint that is going to need to be protected in the same way that desktops and laptops are protected today." As a result of the need for PC-like protection for their handhelds, Symantec is pitching a range of applications in Mobile Security Suite 5.0 that mimic its products for larger computers. Included in the package will be what the company is touting as the first network access control (NAC) system for smartphones, with NAC applications still existing as a fairly new security development in the PC space. Much like a PC-oriented NAC system, the smartphone tools -- which must be used in concert with Symantec's standalone mobile VPN product line -- promise to perform a series of security health checks on devices before the handhelds are allowed to access corporate networks. Another capability unique to the company's latest enterprise smartphone defense package is a tamper-protection feature that monitors devices' operating systems to detect any attempts to modify the code, such as in root kit attacks. As with its Norton consumer smartphone offerings, the Mobile Security Suite 5.0 package will also include more traditional anti-virus and firewall tools as well. Other industry watchers agree that enterprises must have their smartphone security plans firmly in place as they hand out more of the devices to employees. And according to executives at Nokia, the world's top producer of mobile devices, more customers than ever are asking about security implications upfront as they consider wider smartphone distribution. One of the most significant concerns among customers remains the use of unsanctioned devices in the enterprise, typically occurring when workers who have not yet been offered smartphones by their employers instead begin using their own handhelds to carry out business tasks. "A lot of people are still asking us about dealing with unsanctioned devices, the administrators realize that there are often a lot of people using their smartphones in the enterprise without authorization, and they need to find a way to protect themselves," said Kara Hayes, senior product marketing manager for Nokia's Security & Mobility Connectivity group. "People are also very concerned about device loss and theft, they want the ability to wipe the data on the device and kill service," she said. "They want mobile e-mail protection and they're concerned about preventing against data loss; security really has become a big part of the conversation with customers looking to adopt smartphones across more of their organization." Sam Bhavnani, an analyst with Current Analysis, said that organizations should take the best practices they have developed for laptops and port them directly into their smartphone adoption plans. "This all goes back to the migration from desktops to laptops. There are a lot of common sense implications, and people need to be sensible about creating realistic policies that both protect the data on the device and allow users to tap into the potential of the smart phones," Bhavnani said. "Some people are still scared to go there, they know that adopting these devices will open another can of worms, but creating smart policies ahead of time and building on their laptop experience will be the best ways to foster strong mobile security."ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
607054
Symantec Corp.&#39;s Security Response service on Friday confirmed that unpatched Windows vulnerabilities could pose a serious risk for exploits via malicious Web pages and e-mail messages.
596489
Symantec says U.S. agencies need to better protect their cyber assets, echoing concerns raised last year by U.S. Government Accountability Office.
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
376640
A worm was released recently designed to break into corporate computers running Symantec Corp's security software and make them part of its botnet.
444803
Symantec is making a play for a broader market with a new "information integrity" strategy, which users and analysts said meshes with their needs for corporate security. The question is whether the vendor can execute on its wider vision.
143304
A computer worm is attacking some business PCs through a flaw in antivirus software by Symantec Corp., a security company warned Friday.
448889
Symantec is suing a group of software vendors claiming they distributed several unauthorized versions of security and backup software, including Norton AntiVirus and Veritas Backup Exec.
735989
Anti-virus company Symantec warned its customers about a number of critical holes in Windows that surfaced late Thursday and that could make their systems vulnerable to compromise by remote attackers.
179658
As part of its service, Symantec will use a global network of probes and decoy e-mail accounts to collect, analyze and identify new phishing scams targeted at customers that use its Online Fraud Management services.
712665
Symantec Corp. has repaired a serious problem with versions of its leading antivirus software, which protects some of the world&#039;s largest corporations and U.S. government agencies. The flaw lets hackers steal sensitive data, delete files or implant malicious programs.
697857
Symantec Corp. (NASDAQ: SYMC) today announced that Symantec Security Response in conjunction with the Indiana University School of Informatics has uncovered a significant new security threat.
633509
- Security software maker Symantec Corp.   said it sued a large network of distributors selling  counterfeit Symantec software, and sought over $15 million in  damages.
692830
A new worm is making the rounds, attacking some business computers through a known -- and already patched -- flaw in a popular antivirus software suite from security firm Symantec.
671331
Antivirus software company Symantec Corp. said on Wednesday that it joined a group devoted to fighting online identity theft attacks known as "phishing scams."
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.