Feeds

Security software: blind lead blind

Commentary by Elias Levy

  • alert
  • submit to reddit

Business security measures using SSL

It's incredible that in this day and age some of the most popular security products, products that are marketed as protecting you from the evils of computers, are so badly designed.

Case in point: The many antivirus products that failed to detect and stop the highly effective SirCam worm, even when updated with the latest signatures and when configured correctly.

Symantec's Norton Antivirus for Gateways v2.x, Norton Antivirus POP email scanner, and TrendMicro's InterScan VirusWall Standard and CVP editions version 3.51 build 1321 for Windows NT all failed to block SirCam. Why? Because all products "failed open," i.e., when they encountered email messages they couldn't handle properly, they sent them through by default.

SirCam spread via email as an infected attachment, and, unlike most other worms, included its own code to send out the infected messages. The email messages generated by the worm were slightly malformed, and while many email clients are lax enough in their parsing of messages to display the message and its attachment correctly (IETF's motto: "be strict in what you produce and tolerant to what you receive"), the flaw in the headers stopped those antivirus products from detecting the attachment and the worm.

Instead of quarantining malformed messages, the security products happily forwarded them to their destination.

Symantec corrected NAV for Gateways in version 2.5.1 by adding a new option named "Messages that can't be processed" which allows the administrator to configure it to either drop, bounce, or deliver malformed message. Notice the lack of a "quarantine" option. TrendMicro fixed InterScan VirusWall by being more permissive in its parsing of messages so that the attachment can be successfully decoded for scanning.

It seems security problems are common in antivirus products.

Look at the poor folks at TrendMicro. This year alone there have been fourteen different vulnerabilities reported in their InterScan product line. Last year, at least four vulnerabilities were reported in a number of their products. Many of these vulnerabilities allow remote command execution on the host where the product is installed. Several of them are buffer overflows. Two new vulnerabilities were just discovered in their AppletTrap product.

Other types of security products are not far behind.

CheckPoint's FireWall-1, the leading firewall by market share, had at least four vulnerabilities reported this year, and at least eleven reported last year.

My intention is not to berate or point the finger at these companies. But one has to wonder, if vendors that specialize in security can't produce a secure product, what chance does any other software vendor have? And before you mention open source as a solution, consider its track record. With some exceptions, it's not much better..

Writing secure code is hard; designing a security product harder. They both require a lot of time, effort, and money. Complexity only makes things more difficult. All these factors are working against security.

Complexity is increased in each revision of the software by adding more features. Time to market is essential to the commercial success of the products, and is shrinking all the time. Each product is made with as little money as possible, so as to increase its return, and allow the vendor to price it at a level customers will buy. Customers are always asking for more features, as soon as possible, and for a cheaper product.

Until we master the art of building a security product that deserves the label, the outlook is grim. I suggest you buy insurance. Lots of it.

© 2001 SecurityFocus.com, all rights reserved.

Elias Levy is CTO of SecurityFocus and moderator of the BUGTRAQ security mailing list.

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.