Feeds

Chinese user sues Symantec over dodgy updates

Unpalatable

The Essential Guide to IT Transformation

A Chinese user's attempt to sue Symantec for damage caused as a result of dodgy anti-virus signature update files is unlikely to succeed, according to security experts.

Liu Shihui, a solicitor based on Southern Guangdong Province, is suing Symantec for 1,644 Yuan ($215) for damage caused by a signature update of Norton Anti-Virus which identified two core Windows XP files as potentially malicious.

As previously reported, Symantec software wrongly identified two system files (netapp32.dll and lsasrv.dll) in the simplified Chinese version of Windows XP SP2 as the Haxdoor Trojan following a faulty update issued on 18 May.

In standard configurations on Norton Anti-Virus these files are deleted, resulting in problems subsequently booting systems. Fixing systems involves copying these files from backup CDs.

Liu's lawsuit, reckoned to be the first of its kind in China, could open the floodgates for similar claims. But security experts are skeptical of the possibility of the action succeeding because of Symantec's limited warranty.

"Obviously I'm no expert in Chinese law, but here in the West, an action of this type is unlikely to succeed because of the warranty conditions that IT vendors normally apply to their software," said Phil Higgins, a senior partner with systems integrator Brookcourt Solutions.

All apologies

Symantec said that shortcomings in systems designed to automatically respond to fast-evolving malware threats were responsible for the problems experienced by Chinese-speaking users of its software. It's apologised to them and promised to learn lessons from the SNAFU.

Users of Pegasus, the popular email client package, were also hit by similar problems due to Norton anti-virus signature updates last month.

False alert

False positives among anti-virus packages are an industry-wide issue. In March 2006, a signature update from McAfee falsely identified components of MS Office as a low-risk virus.

In another similar incident, MS anti-spyware labelled security software from rival Symantec as a Trojan back in February 2006. A dodgy update from Trend Micro floored the PCs of many who applied it, irrespective of what other apps were running.

The security behemoth promised to review the problems caused by recent false detections in order to prevent the repetition of similar incidents in future. It declined to comment on Liu's lawsuit.

In a statement prompted by our questions on its recent reliability problems, Symantec said: "Symantec Security Response uses a variety of automated systems to complement manual analysis in order to provide rapid response times to new threats. The automated processes have run successfully for several years and have allowed Symantec Security Response to dramatically increase the number of high quality malware detections it's able to provide, especially with the continued increase in the number of threats faced by customers.

"In response to the increased use of encryption in malware, a change was made to the automation recently to deal with these malware more effectively. This inadvertently resulted in a change to a single definition used by the automated system and subsequently led to two files being falsely detected as malware.

"Symantec was notified of the false detection on 17 May at 18.30 PST and after an investigation was initiated, it was quickly determined that the automated system was the cause of this false detection. The false detection was immediately removed from the definitions. Symantec Security Response then initiated a LiveUpdate posting to include the updated definitions. This LiveUpdate became publicly available at 22:50 PST, approximately 4.5 hours after Symantec was notified of this issue.

"Symantec has been reaching out to its customer and partner network, to provide them with the updated file definition and the necessary steps to prevent further issues. Symantec is working to ensure customer issues are resolved in a timely manner. Symantec remains committed to this market and values its customers in China," it added. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.