Feeds

Chinese user sues Symantec over dodgy updates

Unpalatable

Securing Web Applications Made Simple and Scalable

A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.

Liu Shihui, a solicitor based on Southern Guangdong Province, is suing Symantec for 1,644 Yuan ($215) for damage caused by a signature update of Norton Anti-Virus which identified two core Windows XP files as potentially malicious.

As previously reported, Symantec software wrongly identified two system files (netapp32.dll and lsasrv.dll) in the simplified Chinese version of Windows XP SP2 as the Haxdoor Trojan following a faulty update issued on 18 May.

In standard configurations on Norton Anti-Virus these files are deleted, resulting in problems subsequently booting systems. Fixing systems involves copying these files from backup CDs.

Liu's lawsuit, reckoned to be the first of its kind in China, could open the floodgates for similar claims. But security experts are skeptical of the possibility of the action succeeding because of Symantec's limited warranty.

"Obviously I'm no expert in Chinese law, but here in the West, an action of this type is unlikely to succeed because of the warranty conditions that IT vendors normally apply to their software," said Phil Higgins, a senior partner with systems integrator Brookcourt Solutions.

All apologies

Symantec said that shortcomings in systems designed to automatically respond to fast-evolving malware threats were responsible for the problems experienced by Chinese-speaking users of its software. It's apologised to them and promised to learn lessons from the SNAFU.

Users of Pegasus, the popular email client package, were also hit by similar problems due to Norton anti-virus signature updates last month.

False alert

False positives among anti-virus packages are an industry-wide issue. In March 2006, a signature update from McAfee falsely identified components of MS Office as a low-risk virus.

In another similar incident, MS anti-spyware labelled security software from rival Symantec as a Trojan back in February 2006. A dodgy update from Trend Micro floored the PCs of many who applied it, irrespective of what other apps were running.

The security behemoth promised to review the problems caused by recent false detections in order to prevent the repetition of similar incidents in future. It declined to comment on Liu's lawsuit.

In a statement prompted by our questions on its recent reliability problems, Symantec said: "Symantec Security Response uses a variety of automated systems to complement manual analysis in order to provide rapid response times to new threats. The automated processes have run successfully for several years and have allowed Symantec Security Response to dramatically increase the number of high quality malware detections it's able to provide, especially with the continued increase in the number of threats faced by customers.

"In response to the increased use of encryption in malware, a change was made to the automation recently to deal with these malware more effectively. This inadvertently resulted in a change to a single definition used by the automated system and subsequently led to two files being falsely detected as malware.

"Symantec was notified of the false detection on 17 May at 18.30 PST and after an investigation was initiated, it was quickly determined that the automated system was the cause of this false detection. The false detection was immediately removed from the definitions. Symantec Security Response then initiated a LiveUpdate posting to include the updated definitions. This LiveUpdate became publicly available at 22:50 PST, approximately 4.5 hours after Symantec was notified of this issue.

"Symantec has been reaching out to its customer and partner network, to provide them with the updated file definition and the necessary steps to prevent further issues. Symantec is working to ensure customer issues are resolved in a timely manner. Symantec remains committed to this market and values its customers in China," it added. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.