http://www.theregister.co.uk/content/56/29340.html By John Leyden Posted: 14/02/2003 at 20:40 GMT Symantec says it discovered the prolific Slammer worm "hours before it began rapidly propagating". The claim, contained in a press release extolling the company's DeepSight Threat Management System, suggests that Symantec notified its own customers of a serious threat hours before the wider Internet community knew anything was amiss. Wired takes Symantec to task for this apparent lapse in ethics. Symantec spokesman Yunsun Wee told Wired that it issued an alert about Slammer to its early warning list subscribers "at approximately 9pm PST on Friday, January 24." News of the worm began to filter onto security mailing lists at 10pm PST, the magazine reports. Well-established practices among AV vendors call for virus samples to be rapidly exchanged between rival vendors, so that users can be protected as soon as possible. But did Symantec really sit on the problem? The company's claims are inconsistent: a Silicon Defence analysis shows that Slammer infected more than 90 per cent of vulnerable hosts within 10 minutes. This analysis is supported by first-person accounts of telecom security experts contacted by us, as well as security consultant Robert Graham's excellent review of the spread of the worm. So we think this is more a case of Symantec shooting itself in the foot with inflated marketing claims for its early warning service rather than anything more sinister. If it knew about Slammer before everyone else (which is questionable) then we doubt it knew it was anything like as vicious as it turned out to be. At least we hope so, but without been able to discuss the sequence of events or Symantec's wider alerting policy with anyone from the company its hard to know for sure. Despite numerous calls to Symantec today the best its UK staffers could do was to point us towards its press release. Pathetic. Promises that its US team would be in touch came to nothing, but once they get in touch we'll be sure to update this story with what the company has to say. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Sat Feb 15 2003 - 03:37:32 PST