Feeds

Chinese user sues Symantec over dodgy updates

Unpalatable

SANS - Survey on application security programs

A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.

Liu Shihui, a solicitor based on Southern Guangdong Province, is suing Symantec for 1,644 Yuan ($215) for damage caused by a signature update of Norton Anti-Virus which identified two core Windows XP files as potentially malicious.

As previously reported, Symantec software wrongly identified two system files (netapp32.dll and lsasrv.dll) in the simplified Chinese version of Windows XP SP2 as the Haxdoor Trojan following a faulty update issued on 18 May.

In standard configurations on Norton Anti-Virus these files are deleted, resulting in problems subsequently booting systems. Fixing systems involves copying these files from backup CDs.

Liu's lawsuit, reckoned to be the first of its kind in China, could open the floodgates for similar claims. But security experts are skeptical of the possibility of the action succeeding because of Symantec's limited warranty.

"Obviously I'm no expert in Chinese law, but here in the West, an action of this type is unlikely to succeed because of the warranty conditions that IT vendors normally apply to their software," said Phil Higgins, a senior partner with systems integrator Brookcourt Solutions.

All apologies

Symantec said that shortcomings in systems designed to automatically respond to fast-evolving malware threats were responsible for the problems experienced by Chinese-speaking users of its software. It's apologised to them and promised to learn lessons from the SNAFU.

Users of Pegasus, the popular email client package, were also hit by similar problems due to Norton anti-virus signature updates last month.

False alert

False positives among anti-virus packages are an industry-wide issue. In March 2006, a signature update from McAfee falsely identified components of MS Office as a low-risk virus.

In another similar incident, MS anti-spyware labelled security software from rival Symantec as a Trojan back in February 2006. A dodgy update from Trend Micro floored the PCs of many who applied it, irrespective of what other apps were running.

The security behemoth promised to review the problems caused by recent false detections in order to prevent the repetition of similar incidents in future. It declined to comment on Liu's lawsuit.

In a statement prompted by our questions on its recent reliability problems, Symantec said: "Symantec Security Response uses a variety of automated systems to complement manual analysis in order to provide rapid response times to new threats. The automated processes have run successfully for several years and have allowed Symantec Security Response to dramatically increase the number of high quality malware detections it's able to provide, especially with the continued increase in the number of threats faced by customers.

"In response to the increased use of encryption in malware, a change was made to the automation recently to deal with these malware more effectively. This inadvertently resulted in a change to a single definition used by the automated system and subsequently led to two files being falsely detected as malware.

"Symantec was notified of the false detection on 17 May at 18.30 PST and after an investigation was initiated, it was quickly determined that the automated system was the cause of this false detection. The false detection was immediately removed from the definitions. Symantec Security Response then initiated a LiveUpdate posting to include the updated definitions. This LiveUpdate became publicly available at 22:50 PST, approximately 4.5 hours after Symantec was notified of this issue.

"Symantec has been reaching out to its customer and partner network, to provide them with the updated file definition and the necessary steps to prevent further issues. Symantec is working to ensure customer issues are resolved in a timely manner. Symantec remains committed to this market and values its customers in China," it added. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.