Feeds

Chinese user sues Symantec over dodgy updates

Unpalatable

Protecting users from Firesheep and other Sidejacking attacks with SSL

A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.

Liu Shihui, a solicitor based on Southern Guangdong Province, is suing Symantec for 1,644 Yuan ($215) for damage caused by a signature update of Norton Anti-Virus which identified two core Windows XP files as potentially malicious.

As previously reported, Symantec software wrongly identified two system files (netapp32.dll and lsasrv.dll) in the simplified Chinese version of Windows XP SP2 as the Haxdoor Trojan following a faulty update issued on 18 May.

In standard configurations on Norton Anti-Virus these files are deleted, resulting in problems subsequently booting systems. Fixing systems involves copying these files from backup CDs.

Liu's lawsuit, reckoned to be the first of its kind in China, could open the floodgates for similar claims. But security experts are skeptical of the possibility of the action succeeding because of Symantec's limited warranty.

"Obviously I'm no expert in Chinese law, but here in the West, an action of this type is unlikely to succeed because of the warranty conditions that IT vendors normally apply to their software," said Phil Higgins, a senior partner with systems integrator Brookcourt Solutions.

All apologies

Symantec said that shortcomings in systems designed to automatically respond to fast-evolving malware threats were responsible for the problems experienced by Chinese-speaking users of its software. It's apologised to them and promised to learn lessons from the SNAFU.

Users of Pegasus, the popular email client package, were also hit by similar problems due to Norton anti-virus signature updates last month.

False alert

False positives among anti-virus packages are an industry-wide issue. In March 2006, a signature update from McAfee falsely identified components of MS Office as a low-risk virus.

In another similar incident, MS anti-spyware labelled security software from rival Symantec as a Trojan back in February 2006. A dodgy update from Trend Micro floored the PCs of many who applied it, irrespective of what other apps were running.

The security behemoth promised to review the problems caused by recent false detections in order to prevent the repetition of similar incidents in future. It declined to comment on Liu's lawsuit.

In a statement prompted by our questions on its recent reliability problems, Symantec said: "Symantec Security Response uses a variety of automated systems to complement manual analysis in order to provide rapid response times to new threats. The automated processes have run successfully for several years and have allowed Symantec Security Response to dramatically increase the number of high quality malware detections it's able to provide, especially with the continued increase in the number of threats faced by customers.

"In response to the increased use of encryption in malware, a change was made to the automation recently to deal with these malware more effectively. This inadvertently resulted in a change to a single definition used by the automated system and subsequently led to two files being falsely detected as malware.

"Symantec was notified of the false detection on 17 May at 18.30 PST and after an investigation was initiated, it was quickly determined that the automated system was the cause of this false detection. The false detection was immediately removed from the definitions. Symantec Security Response then initiated a LiveUpdate posting to include the updated definitions. This LiveUpdate became publicly available at 22:50 PST, approximately 4.5 hours after Symantec was notified of this issue.

"Symantec has been reaching out to its customer and partner network, to provide them with the updated file definition and the necessary steps to prevent further issues. Symantec is working to ensure customer issues are resolved in a timely manner. Symantec remains committed to this market and values its customers in China," it added. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.