Feeds

Symantec PR bunnies score Slammer own goal

Silence is Not Golden

  • alert
  • submit to reddit

Intelligent flash storage arrays

Symantec says it discovered the prolific Slammer worm "hours before it began rapidly propagating".

The claim, contained in a press release extolling the company's DeepSight Threat Management System, suggests that Symantec notified its own customers of a serious threat hours before the wider Internet community knew anything was amiss.

Wired takes Symantec to task for this apparent lapse in ethics. Symantec spokesman Yunsun Wee told Wired that it issued an alert about Slammer to its early warning list subscribers "at approximately 9pm PST on Friday, January 24."

News of the worm began to filter onto security mailing lists at 10pm PST, the magazine reports.

Well-established practices among AV vendors call for virus samples to be rapidly exchanged between rival vendors, so that users can be protected as soon as possible.

But did Symantec really sit on the problem? The company's claims are inconsistent: a Silicon Defence analysis shows that Slammer infected more than 90 per cent of vulnerable hosts within 10 minutes. This analysis is supported by first-person accounts of telecom security experts contacted by us, as well as security consultant Robert Graham's excellent review of the spread of the worm.

So we think this is more a case of Symantec shooting itself in the foot with inflated marketing claims for its early warning service rather than anything more sinister. If it knew about Slammer before everyone else (which is questionable) then we doubt it knew it was anything like as vicious as it turned out to be.

At least we hope so, but without been able to discuss the sequence of events or Symantec's wider alerting policy with anyone from the company its hard to know for sure.

Despite numerous calls to Symantec today the best its UK staffers could do was to point us towards its press release.

Pathetic.

Promises that its US team would be in touch came to nothing, but once they get in touch we'll be sure to update this story with what the company has to say. ®

External Link

CERT advisory on SQL Server (Slammer) worm

Related Stories

Security experts duped by Slammer 'jihad' rot
Slammer: Why security benefits from proof of concept code
Korean Net users blame MS for Slammer carnage
ATMs, ISPs hit by Slammer worm spread
MS struggles to contain the Slammer worm
SQL worm slams the Net
'Secure by design', claims MS op-ed ad
Out of the Slammer

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.