Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

A Bad Week for Symantec

Posted by CowboyNeal on Thu Mar 01, 2007 07:21 PM
from the seen-better-days dept.
Evan Hughes writes "NeoSmart Technologies has published a scathing editorial regarding 3 high-profile mistakes by Symantec Corp. — all in less than a week. In what seems to be a string of stupid mistakes culminating in the infection of CNN-parent Turner Broadcasting Systems by Rinbot— a virus dedicated to the eradication of Symantec from the known world."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • maybe... (Score:5, Funny)

    by User 956 (568564) on Thursday March 01 2007, @07:25PM (#18201472) Homepage
    NeoSmart Technologies has published a scathing editorial regarding 3 high-profile mistakes by Symantec Corp. -- all in less than a week

    Maybe they're not mistakes... maybe it's just a form of viral marketing.
  • by devphaeton (695736) on Thursday March 01 2007, @07:25PM (#18201474)
    ....in my experience modern Symantec products such as Norton Internet Security is the most malicious, but successful form of malware ever. It actually gets people to pay money for the product, and in a lot of cases, pay other people to install it and keep it on their system.

    I'm so glad I moved out of software maintenance and into hardware maintentance. Now I just wipe harddrives clean as a whistle and make sure the hardware works. Such a load off!
    • Re: (Score:3, Insightful)

      I used to swear by it, but around 2002, it just sucked up too much in the way of system resources. I switched to the Corporate client and got back a lot of CPU and memory, ditched the flashy idiot-targeted UI, and kept the engine. For the past 15 years it hasn't let me down once.
  • No great loss (Score:5, Insightful)

    by ravenspear (756059) on Thursday March 01 2007, @07:30PM (#18201530)
    Every experience I have ever had with a Symantec product has been utterly terrible. Generally they cause more problems than they solve.
    • Symantec: more full of bugs than a frog on a binge.
    • Re: (Score:3, Informative)

      You must be reletivly new to their products. They used to have good/decent products but around 2002/2003 it started going downhill fast. I have stopped recomendig them since 2005 or so and get really frustrated when I have to remove them now.

      You right, They suck now. But they used to be half way decent at one time. I don't know what happened.
      • Re:No great loss (Score:4, Informative)

        by DigiShaman (671371) on Thursday March 01 2007, @11:04PM (#18203248) Homepage
        Agreed! Symantec NAV sucks ass nowadays.

        While Trend Micro is known to be good, my faith in it has been shattered when I cleaned up a web server that was infected with some unknown virus. It was so nasty, that it disabled the Trend Micro services!!!

        Because I use AVG Free at home (and has always prevented infections), I decided to download and install the 30 day trial of AVG for file servers. Needless to day, it found the viri and purged them.

        I think I'm on day 8 of the trial period without further incident. Because the trial version of F-Prot also failed, I fairly certain we will go with AVG.
        • Re: (Score:3, Insightful)

          I have used the AVG server and pro versions at a couple locations. I love them. The administration control console thing (if you use the server and a few clients too) allows you to update and push them out, You can schedule scans and checks the status of them. You can even delete the files remotly if neccesary. There is quite a bit of control it gives you. And best of all, the service doesn't take a brand new computer with plenty of memory and proccesing power and make it apear to be some slow piece of yest
      • Re:No great loss (Score:5, Interesting)

        by Radon360 (951529) on Friday March 02 2007, @01:04AM (#18203942)

        Well, somewhere in 1990, Peter Norton sold things to Symantec. They (Symantec) continued to associate themselves with Peter Norton up until 2001 or so. About that time is the consensus that things went downhill. I'm not certain how much involvement Norton had with Symantec up until that point, but I'm willing to speculate that when the two parted companies, that's when Symantec began their transformation into selling the crap they do now.

        Gosh, I miss the good ol' days of Norton Utilities and the like...in DOS nonetheless. Now there was a powerful piece of software that was truly easy to use. The UI actually showed you some shred of respect that you knew what you were doing.

      • Re: (Score:3, Interesting)

        We're migrating about 250 TB (no, not GB) from Legato^WEMC Networker to NetBackup because some bean counter made a better deal with Symantec and have so far only found drawbacks to that move. Worst of all, Symantec is requiring us to install full (including X, open office and every single piece of software known to man) Solaris packages if we want support from them...
  • Turner apparently got hit because it had not yet updated the Symantec programs on its computers. A fix for the flaw has been available since May and security experts have repeatedly urged users to protect their computers by applying the update.

    Hmm hmm hmm people are dumb.
    • by Bacon Bits (926911) on Thursday March 01 2007, @08:37PM (#18202238)
      If you'd ever been the person responsible for updating the Symantec Antivirus client, you would not be so quick to judge. LiveUpdate only handles scanning engine updates and virus definitions. Anything else is a huge nightmare.

      I don't like Symantec products because they make the life of a sysadmin *more difficult*.
      • LiveUpdate only updates the defs for Corporate, but you can easily deploy updates via Active Directory. Corporate is the only good product that Symantec makes. I admined 300+ seats of it. Granted Turner has more than 300 seats, but it took me about 10 minutes to get my 300 seats updated. They have no excuse. Someone wasn't on top of this.
        • by Gary W. Longsine (124661) on Friday March 02 2007, @01:44AM (#18204122) Homepage Journal
          One of my clients has a relatively large Symantec AntiVirus deployment (something like 35,000 Windows PCs). I was, among many other things, directly and soley responsible for their Symantec AntiVirus architecture for several years. I assure you that there are many issues which can be easily overcome at the scale of 300 machines which are pretty close to show stoppers at the 30,000 node scale. I agree that Symantec Enterprise Edition is a reasonable AntiVirus product, but its weakest link, ironically enough, are the issues that arise when trying to deploy, operate, and maintain it at the scale of a real enterprise.
  • by RESPAWN (153636) <caldwell&tulanealumni,net> on Thursday March 01 2007, @07:35PM (#18201572) Homepage Journal

    What kind of anti-virus product only updates once a week (on Wednesdays)... And most importantly, what kind of security company lets its product remain installed without updating?
    To be quite honest, those are all user configurable options, are they not? To think! Some of us may not WANT Symantec to hold our hands when it comes to maintaining our AV installs. Can you really hold Symantec liable for the mistakes of its customers?

    Furthermore, doesn't Free AVG only update once a week as well?
      • the kind that crash servers, it is not like they haven't done it before, but for most purposes I agree with you. In a large scale environment with lots of custom apps. you had better be checking these patches prior to general deployment or you WILL get bitten...*speaks from experience*
      • by SwashbucklingCowboy (727629) on Thursday March 01 2007, @08:50PM (#18202358)

        What kind of virus rule updates would you not want to download?
        The kind that treat widely installed legitimate programs, e.g. Excel, as a virus [com.com].
      • by RESPAWN (153636) <caldwell&tulanealumni,net> on Thursday March 01 2007, @10:27PM (#18203022) Homepage Journal
        My point is this: the corporate version of Symantec does not automatically install any download rules. They leave this up to the installer who is hopefully capable of properly configuring their update rules and/or updating their servers manually, most likely so that they can properly test the latest virus definitions for errors or anomalies before pushing them in to production. See the comment below that links to the article about Excel being treated as a virus.

        I work for... well, it doesn't matter. In our facility absolutely NO patches or virus definition updates are applied without first being approved by another group whose sole job it is to make sure these pathces don't affect something critical to our operations. Furthermore, we only download our defs from approved (IE our own) sources so as to ensure that we are ONLY downloading what's already been tested.

        In short, we are all professionals and we should be capable of ensuring that our defs are up to date. We don't need (nor will we allow them to in our case) Symantec to hold our fuckin' hands throughout this process. When I install a corporate virus scanner, I fully expect to have to configure the machine policies in order to match our IT policies. If somebody's only updating their definitions once a week, then that's not Symantec's fault. That's the fault of whatever sysadmin was too stupid to properly configure his software.

        That said, I still think Symantec's a piece of shit and I wish we were allowed to use other solutions in its place, but that's not for me to decide. Their management software is no where near as feature rich as EPO, and I seem to have to spend more time dealing with Symantec issues than I do with EPO issues. (Because, yes, we do monitor our machines each day to ensure that they are updating properly. CNN we are not.) Please don't think for a minute that I like defending Symantec. I just believe in placing the blame properly where it belongs, and in this case it's the idiot sysadmins who weren't doing their job.
  • by L. VeGas (580015) on Thursday March 01 2007, @07:35PM (#18201580) Homepage Journal
    a virus dedicated to the eradication of Symantec from the known world

    That's not a virus. That's a feature.
  • by winkydink (650484) * <sv.dude@gmail.com> on Thursday March 01 2007, @07:41PM (#18201662) Homepage Journal
    because CNN is infected?

    1. Estimates are 100-150 million machines are currently part of botnets
    2. Loss estimates exceed 200 billion annually on a global basis
    3. Over 80% of all spam comes from botnets

    Yes, I can cite. Or you can Google. They are all easy to find.

    This is a HUGE problem that is, in many ways, like spam was in 1996 or 1997. The technical community acknowledges it, the average consumer has no clue, and, left unaddressed the problem and associated looses will get much, much worse.
  • by SwashbucklingCowboy (727629) on Thursday March 01 2007, @08:08PM (#18201940)

    A fix for the flaw has been available since May and security experts have repeatedly urged users to protect their computers by applying the update.
    Turner can't update their software in EIGHT MONTHS? That's not a problem with Symantec, that's a problem at Turner.
    • Updates (Score:5, Insightful)

      by fm6 (162816) on Thursday March 01 2007, @08:31PM (#18202174) Homepage Journal

      People often don't update their software for years at a time. Hey, it costs. Which is why NAV is designed to update itself automatically. You just have to configure it correctly.

      I'm no fan of Symantec. It's perfectly true that they're badly run. Hey, they used to be a lot more than a "security software" company, but all their other business (natural language databases, compilers, IDEs, desktop software, backup software) just died on them. But to blame them for the ineptitude of the CNN's IT department is idiotic.

  • by gelfling (6534) on Thursday March 01 2007, @08:37PM (#18202236) Homepage Journal
    We're chucking our desktop firewalls, spyware tools and AV scanners for one big Symantec managed client. And if any of you have ever tried to uninstall Symantec you'll know that you're chained to them for life.
    • by jd142 (129673) on Thursday March 01 2007, @08:55PM (#18202398) Homepage
      I uninstall Symantec Corporate Edition all the time. Works a treat.

      We've got an AV server and all of our clients are managed. We set the server up to check Symantec every two hours for updates and those updates are pushed down to the clients almost immediately.

      Need to install all of your clients to the latest version (say from 9 -> 10)? Click Tools | Install Client Remotely and push it down from a central location.

      We check our clients and any computer that is more than a week out of date is turned on and updated.

      The only reason I can think of that so many people are complaining is because they've only used the consumer version. When we get student laptops we immediately remove it and install the corporate version that is free for them. I've never had a problem uninstalling the trialware version of the AV that ships with so many laptops.
      • Re: (Score:3, Interesting)

        The corporate/enterprise versions of symantec and mcafee are great. They scan mail and scan the system and files so they do everything you want from a virus program.
        In additon they take up alot less resources then the home versions, and are usally easy to uninstall. Even without the management software you can use them, and they will download info from the web sites of the appropriate company.
  • Astroturfing (Score:4, Interesting)

    by jotok (728554) on Thursday March 01 2007, @08:54PM (#18202386)
    Symantec has seen quite a bit of negative publicity in the past year on slashdot.

    I have to wonder how much of it is simply astroturfing by disgruntled former employees? When there's a negative op/ed piece on a "software development and security research" website where none of the SQL even works, I just have to wonder if some no-talent assclown is pissed off because he lost his helpdesk or HR job.
    • Re:Astroturfing (Score:4, Interesting)

      by swordgeek (112599) on Thursday March 01 2007, @09:35PM (#18202682) Journal
      OK, there's no doubt that Turner is pretty incompetent for not fixing this hole with a patch that's been out for most of a year.

      But at the same time, I have to ask how incompetent a company that writes security software can be, when their own code is written so as to allow this type of exploit.

      Furthermore, I've had quite a bit of experience with Symantec over the past few years. I've been using Veritas products for a decade and change (Netbackup and Volume Manager primarily), and know them very well. Once in a while, I'll come up against a bug and phone Veritas for support/workarounds/whatever. For years they weren't top notch, but they were decent and consistent.

      Since Symantec took over, support has fallen through the bottom of the toilet. Their help desk is driven by 'time-to-close,' and actual technical experts are no longer brought in for difficult cases. Bug reports are not even accepted anymore! (Well they'll _take_ the bug report, but won't give you a bug ID to track it with.)

      Furthermore, they've started to crank up the version release numbers so that they can promise support for two versions, but only support products for two years from initial release. TWO YEARS FROM RELEASE!!! That's completely unacceptable even in the home PC marketplace, let alone in an enterprise environment, where a product rollout may take over a year.

      So yesterday I went to install the newly-free version of Storage Foundation, because I needed to migrate some data from an old system (flawlessly running vxvm 3.5) to a new one, where we'd then move it to ZFS and be done with Veritas for good. The installer put 40 packages on my newly built Solaris 10 system (11/06 release), but failed to actually install the volume manager! After screwing around with it for a while, I gave up and went to uninstall it. The uninstaller hung in kernel space, and for twelve hours did nothing but couldn't be killed.

      I don't care about any axes that people have to grind. Symantec is an incompetent company, and DESERVES all of those people holding grudges against them. I'll be glad to see them die horribly.
      • by Dunbal (464142) on Thursday March 01 2007, @11:25PM (#18203362)
        OK, there's no doubt that Turner is pretty incompetent for not fixing this hole with a patch that's been out for most of a year.


              Personally I'm surprised that he hasn't broadcast it on the news as a terrorist attack and recruited the Boston police and bomb squad to deal with this threat...
        • Re:Astroturfing (Score:4, Insightful)

          by swordgeek (112599) on Friday March 02 2007, @12:54AM (#18203910) Journal
          Thanks for your note. I'm going to reply to it rationally (more or less), hoping that you'll see it and take my comments as constructive criticism rather than just ranting.

          First of all, I may have misstated Symantec's support policy, but that is verbatim what I was told by a support engineer. (I even have the email to prove it.) Maybe some internal training is in order?

          "...you've downplayed the fact that two years is a long time in the world of security software."

          Did I mention the "Veritas products" part of the equation? Two years is barely time to get one's feet wet with most (former) Veritas products. There's also support from other vendors to consider: Sun didn't actually provide support for Volume Manager 4.0 until after 4.1 was released. Already we're into the two year window, and we haven't even started a cluster OS upgrade!

          And that's just volume manager. A full-blown enterprise Netbackup installation is a MAJOR event. Here's one scenario I dealt with recently:

          NBU 5.0 gets released. After six months of waiting for it to become stable enough to actually use, the company started the implementation. This involved $980k of new hardware (and they already had the tape library and infrastructure in place). The planning, architecture, implementation, cutover, and validation took a total of roughly eight months. That's 14 months after initial release, and we've just gone live with the product. At that point, after over a million dollars of gear and time and effort, I am NOT planning on a major version upgrade in ten months or twenty or thirty. I want a MINIMUM of three years of full support after that point, and five is much more reasonable. We shouldn't be forced to upgrade our software until we've outgrown our infrastructure, which is about a 3.5-4.0 year turnaround for most big companies.

          Furthermore, service packs or not, the very WEEK that NBU6.0 was released, we were told we couldn't get any more NBU 5.x client licenses. That's it, no more, thanks for coming out. Suddenly, regardless of bug support, we're left without any legal means of growing without upgrading to 6.0.

          That is, in a word, crap.

          This isn't a $100 anti-virus package for a PC that's going to be chucked in two years, this is software that runs enterprise installations. We don't spend $5k per client machine for a product that's obsolete almost as soon as we install it.

          Now you can say that Symantec doesn't operate like this, that my details are all incorrect. That may be, but that is what we were told by our local sales guys, our regional managers, and the other end of Symantec's international support group.

          So on the one hand, we have the model you describe, which is crap. On the other hand, you have the reality that I've described which is rancid festering crap. Add to this the fact that VxVM5.0 Basic (the freebie package) simply doesn't work, and you've got a company that is either too incompetent to survive, or trying very hard to destroy the Veritas products/division they bought a few years ago.

          As for you liking your job, that's great. I really am genuinely happy every time I hear about someone enjoying their work, because we spend a lot of time at it. (random aside: Until recently I hated my job although I love my work, so I quit--now I'm working for a better company for less pay, and loving it.) Unfortunately, that doesn't change the fact that your company doesn't even have the vaguest understanding of what enterprise computing is really about.
    • Re: (Score:3, Interesting)

      I do not, and have not, worked for Symantec, but I will concur their products are crapware, and their staff is made up of A-Grade assholes. As another person posted above, their support is driven by time to close - when I opened a case with them that went unresolved for several weeks (and not due to lack of trying on my end), I finally got a call back from someone that sounded more like a back-alley enforcer than a support specialist. He tried to bully me into closing the case by blaming me for the issue.
  • by flyingfsck (986395) on Thursday March 01 2007, @08:55PM (#18202400)
    Whenever I have to fix a screwed up PC, MsAfee or Symantec is disabled by the malicious code. So, I always uninstall whatever is on the machine and install something else like AVG or ClamWin.
  • ... Every machine that comes to me for service has one requirement: No Norton. Take norton off, and people are *amazed* at how much faster their machines run.

    I substitute Free-av.com for Norton- better infection detection, less memory overhead, free (with the option of buying a license- I usually guilt them into doing it), and nightly upgrades.

  • Can you say AVAST? (Score:5, Interesting)

    by rizzo320 (911761) on Thursday March 01 2007, @10:30PM (#18203038)
    Although they may hold on to the enterprise market, why even bother with Norton AntiVirus or Internet Security when you can get Avast AntiVirus Personal edition for free! http://www.avast.com/eng/download-avast-home.html/ [avast.com]

    No, I don't work for them, or own stock. They've even updated it for Vista. The cost? Register for a free serial number every 14 months.

    Comodo firewall http://www.comodo.com/ [comodo.com] is nice free step up for those who think they need something more than Windows firewall.

    In the year 2007, there is really no need for a consumer to pay for a product from Symantec/Norton, McAfee, or any other security software vendor that has been fleecing us for the last several years.
    • Re:AVG (Score:5, Funny)

      by nsayer (86181) * <(nsayer) (at) (kfu.com)> on Thursday March 01 2007, @07:57PM (#18201820) Homepage
      every reboot or once a day which ever comes first.

      Since we're talking about Windows machines, I can tell you for certain which comes first.

        • Re:AVG (Score:5, Insightful)

          by Southpaw018 (793465) * on Thursday March 01 2007, @08:50PM (#18202350) Journal
          Seconded. The only time I get reboots is when it's required for a security patch, or the occasional "application freaking the #$@%^& out" kinda thing...servers, workstations, all of 'em. And if it weren't for that, I'd be pushing 90-120 day uptimes on most of my machines. Yes, Windows machines.
          In fact, I'll get you the data.

          Main server has rebooted twice in the last four months for security patches, total ~19 minutes downtime.
          • Re:AVG (Score:4, Informative)

            by flyingfsck (986395) on Thursday March 01 2007, @09:07PM (#18202478)
            Windows is pretty damn good nowadays, but my Linux web server only goes down when the ISP has a power problem. That happens about once a year. In four years, the machine rebooted 5 times and never once due to Linux.
        • I only use Windows for maybe 2 hours a day to play a game, then I reboot to Ubuntu for real work.

          Yeah, actually it's really annoying, because AVG is always trying to scan the hard drive when I go to play a game.
    • By the same token, I've never seen AVG prevent, or detect an actual virus. I've then removed avg and installed f-prot /or fsecure and watched the virus count run up. But at least avg is free, right? I'm sure it prevents some, but for my parents, it doesn't deal with their weekly virus infection. always YMMV
      • Maybe CNN was burned by Symantec updates before.

        Perhaps. McAfee had a problem once where they were identifying Excel as a virus [com.com], but I've never heard of Symantec having such a problem. More likely, the CNN IT staff is either incompetent or just plain stupid.

        Also, if they had been burned by Symantec, they should have gone with another vendor's product. A company like CNN not having up to date AV software is inexcusable.

    • by SwashbucklingCowboy (727629) on Thursday March 01 2007, @08:46PM (#18202320)

      How bad does it have to be for people to Stop using windows?
      Really bad. But if everyone started using Linux or OS X then all of their security problems would have a spotlight shown on them.
      • by Heir Of The Mess (939658) on Thursday March 01 2007, @11:01PM (#18203226) Homepage
        I have nothing to worry about as I'm running Solaris. Despite the fact that people are continuously trying to hack me I have no worries. Right now (I'll look at the network activity) ?? funny someone has telneted in using some -froot argument. I wonder wha[No Carrier]
        • Re: (Score:3, Insightful)

          >>As far as I know, The exploits in mac or linux don't really have automation in them. And i'm not talking about getting a tool to let some scipt kiddie pown your system. I'm talking about every infection requires some human intervention to be succesful.<<

          Windows Vista has the same sort of protection built in as well. However, the protection is triggered so many times by non-malicious programs that users quickly become used to clicking "Yes" to every dialog prompt that pops up. This behavior c
    • by Lumpy (12016) on Thursday March 01 2007, @08:48PM (#18202334) Homepage
      How bad does it have to be for people to Stop using windows?

      when the OS let's Steve ballmer and Microsoft know when you are in the shouse so a guy can show up dressed as clippy and forcibly anal rape you.

      Yes, it will have to get that bad before the sheeple out there actually switch.
    • Re: (Score:3, Insightful)

      The reason Windows has so much malware problems is because it's the most common operating system used, therefore it's in the best interest of the malware developers to write malware for Windows. If the most popular operating system was OS X, then OS X would have the most malware problems. The same goes for Linux or .
        • Re: (Score:3, Insightful)

          This has been disproved so many times it's not even funny. you must be a complete fucking idiot to make such a statement.

          Since you seem so smart, how exactly has this been disproven so many times?
            • Re: (Score:3, Insightful)

              Those are mostly worms, which are pretty much old news. Welcome to 2007, where most malware is installed by tricking the user into running something on their computer which then takes it over. Even Microsoft gets it (You're trying to use the mouse. Allow/Deny?). You don't.