Tag Archives: symantec

How to Compromise the Enterprise Endpoint

Posted on by

Because Symantec uses a filter driver to intercept all system I/O, just emailing a file to a victim or sending them a link to an exploit is enough to trigger it – the victim does not need to open the file or interact with it in anyway. Because no interaction is necessary to exploit it, this is a wormable vulnerability with potentially devastating consequences to Norton and Symantec customers.

An attacker could easily compromise an entire enterprise fleet using a vulnerability like this. Network administrators should keep scenarios like this in mind when deciding to deploy Antivirus, it’s a significant tradeoff in terms of increasing attack surface.

Source: Project Zero: How to Compromise the Enterprise Endpoint

Symantec And Security Starlets Say Anti-Virus Is Dead

Posted on by

“The overall detection by anti-virus software in January was disappointing — only 70.62 percent. For February it is even worse — only 64.77 percent was detected. And in March the average detection was 73.56 percent. That might not sound too bad but it means that 29 percent, 35 percent and 26 percent was not detected,” the company’s report read.

via Symantec And Security Starlets Say Anti-Virus Is Dead.

Automated Malware Analysis Under Attack

Posted on by

When it infects the system, UpClicker takes an innocuous first step, binding itself to the mouse. The malware then hibernates until a user clicks the left mouse button and then releases it. Unless security researchers emulate the button press, automated analysis systems will stop observing the malware before its actually does any malicious activity, and the code will not be flagged for further investigation.

via Automated Malware Analysis Under Attack – Dark Reading.

Hackers Exploit ‘Zero-Day’ Bugs For 10 Months On Average Before They’re Exposed

Posted on by

One aspect of zero-day exploits use that’s made them tough to track and count has been how closely targeted they are. Unlike the mass malware infections that typically infect many thousands of machines using known vulnerabilties, the majority of the exploits in Symantec’s study only affected a handful of machines–All but four of the exploits infected less than 100 targets, and four were found on only one computer.

via Hackers Exploit ‘Zero-Day’ Bugs For 10 Months On Average Before They’re Exposed – Forbes.

Unsurprisingly, the study shows that hackers target common software like Microsoft Word, Flash and Adobe Reader. Sixteen of the 18 zero-day exploits discovered and analyzed in the study affected Microsoft and Adobe software.

H.323 Mediated Voice over IP: Protocols, Vulnerabilities & Remediation

Posted on by

Voice over IP (VoIP) can be a complex subject. Network security professionals may find the terminology foreign, and VoIP vulnerabilities are often misunderstood. This paper provides an overview of the H.323 protocol suite, its known vulnerabilities, and then suggests twenty rules for securing an H.323-based network.

via H.323 Mediated Voice over IP: Protocols, Vulnerabilities & Remediation | Symantec Connect Community.

The primary components of an H.323 network include: endpoints, gateways, gatekeepers, and MCUs (Multipoint Control Units). Endpoints (telephones, softphones, IVRs, voicemail, video cameras. etc.) are the devices typically used by end-users in the normal use of the system. Gateways (gateways and controllers) handle signaling and media transport, and typically serve as the interface to other types of networks such as ISDN, PSTN and or other H.323 systems. Gateways which focus primarily on converting between IP and other forms of media (such as PSTN) are termed Media Gateways. Gatekeepers are the logical entity with which endpoints register and are administered. They also manage call setup, teardown, and status and can assist in address resolution. MCUs are designed to support multi-party conferencing.

Symantec ‘fesses up: ‘Code theft worse than we thought’

Posted on by

A hacker calling himself “Yama Tough”, acting as a spokesperson for the group, claims the source code had been pulled from insecure Indian government servers, implying that Symantec was required to supply their source code to Indian authorities. In a series of Twitter updates, Yama Tough talked about various plans to release the source code before committing to release the secret sauce of pcAnywhere.

via Symantec ‘fesses up: ‘Code theft worse than we thought’ • Channel Register.

Even so the whole Symantec hack soap opera/pantomime (‘You’ve been hacked!”, “Oh no we haven’t”… “Oh maybe we have”) raises serious questions about the security of Symantec’s ecosystem as well as turning the security giant into the punchline for jokes. For example, famed Apple hacker Charlie Miller quipped: “How could Symantec have gotten hacked? Don’t they use AV?” ®