[ISN] Symantec PR bunnies score Slammer own goal

From: InfoSec News (isnat_private)
Date: Sat Feb 15 2003 - 00:47:41 PST

  • Next message: InfoSec News: "[ISN] Security documents at risk on federal site: Audit"

    By John Leyden
    Posted: 14/02/2003 at 20:40 GMT
    Symantec says it discovered the prolific Slammer worm "hours before it
    began rapidly propagating".
    The claim, contained in a press release extolling the company's
    DeepSight Threat Management System, suggests that Symantec notified
    its own customers of a serious threat hours before the wider Internet
    community knew anything was amiss.
    Wired takes Symantec to task for this apparent lapse in ethics.  
    Symantec spokesman Yunsun Wee told Wired that it issued an alert about
    Slammer to its early warning list subscribers "at approximately 9pm
    PST on Friday, January 24."
    News of the worm began to filter onto security mailing lists at 10pm
    PST, the magazine reports.
    Well-established practices among AV vendors call for virus samples to
    be rapidly exchanged between rival vendors, so that users can be
    protected as soon as possible.
    But did Symantec really sit on the problem? The company's claims are
    inconsistent: a Silicon Defence analysis shows that Slammer infected
    more than 90 per cent of vulnerable hosts within 10 minutes. This
    analysis is supported by first-person accounts of telecom security
    experts contacted by us, as well as security consultant Robert
    Graham's excellent review of the spread of the worm.
    So we think this is more a case of Symantec shooting itself in the
    foot with inflated marketing claims for its early warning service
    rather than anything more sinister. If it knew about Slammer before
    everyone else (which is questionable) then we doubt it knew it was
    anything like as vicious as it turned out to be.
    At least we hope so, but without been able to discuss the sequence of
    events or Symantec's wider alerting policy with anyone from the
    company its hard to know for sure.
    Despite numerous calls to Symantec today the best its UK staffers
    could do was to point us towards its press release.
    Promises that its US team would be in touch came to nothing, but once
    they get in touch we'll be sure to update this story with what the
    company has to say.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Sat Feb 15 2003 - 03:37:32 PST