Norton Users Worried By PIFTS.exe, Stonewalling By Symantec 685
An anonymous reader writes that "[Monday] evening, on systems with Norton Internet Protection running, users began to see a popup warning about an executable named PIFTS.exe trying to access the internet. The file was shown to be located in a non-existent folder inside the Symantec LiveUpdate folder. There were several posts about this to the Norton customer forums asking for help or information on this mysterious program. The initial thread received several thousand views and several pages of replies in a few short hours before being deleted. Several subsequent posts to the Norton forum were deleted much more quickly. These actions — whether actively covering up, or simply not well thought through — have spurred people to begin crafting conspiracy theories about the purposes of this PIFTS program. I for one am blocking the program until more information becomes available." The current top link on Google for "PIFTS.exe" links to one of these deleted questions on Norton's support boards, which sounds innocent enough: "I searched this forum but did not see PIFTS.exe. Any idea what this is?"
Rootkit? (Score:5, Interesting)
An application that exists in a folder not accessible by the underlying operating system? Sounds suspiciously like a rootkit to me. If so, then man, am I glad I gave up Norton years ago! I mean seriously, what is so hard to understand about the concept that hiding things like directories is a security risk? Have we learned nothing from Sony's stupidity?
Oh yeah, it's Norton (aka Symantec) we're talking about here. I guess not.
Re:Rootkit? (Score:5, Funny)
Re: (Score:3, Informative)
If that really were the answer I could almost respect it... I mean really, it works pretty well for the CIA.
Re:Rootkit? (Score:4, Insightful)
Oh, that would be hilarious ... if it wasn't true.
People never quite understand that the government has the most to gain by making things illegal. Not only do they get fines and other penalties from those who are in that industry, but it allows them to keep the market value overinflated and they can squeeze out any other big players by simply leaking information on them to local law enforcement or other federal agencies.
There's nothing like having a C130 loaded with guns or drugs (or both), and simply saying "You don't see this plane. It was never here." You only hear about the ones where the planes have crashed inconveniently in the wrong place, and the site wasn't able to be isolated before the news leaked.
Really, it does give some control, and an acceptable covert budget. Things are going to be smuggled in anyways, why can't the gov't make a profit on it? :)
Excuse me. There's a black van outside, and some nice man knocking on my door.
Hello?
[thud]
Re:Rootkit? (Score:5, Insightful)
Re:Rootkit? (Score:5, Informative)
Somebody traced the execution, and linked it here:
http://www.reddit.com/r/reddit.com/comments/83hjr/symantec_covering_up_the_piftsexe_file_and/c0857t5 [reddit.com]
Furthermore 4chan's /b/ seems to have a field day with this. Norton discussion boards appear very slow.
Re:Rootkit? (Score:5, Informative)
Norton discussion boards appear very slow.
You mean disabled after seeing that moderators can't keep up with the posts about PIFTS?
Re:Rootkit? (Score:5, Funny)
Re:Rootkit? (Score:4, Insightful)
Have we learned nothing from Sony's stupidity?
They never went bankrupt or even suffered a financial loss. Nobody got fired for it, nobody went to jail for it, so I'd say they did learn from XCP.
They learned that placing rootkits on ordinary peoples' computers has no consequences whatever. Why not do it, particularly if you lack ethics or morals?
Re:Rootkit? (Score:5, Insightful)
Peter Norton came from the mainframe world and created useful utilities for the end user of PCs and compatibles. He was a solid programmer and created a solid company. Symantec purchased him and his competition. We no longer have utilities designed by these companies.
Instead we have a company using his name. That's it. There really is no Norton any more. It's barely even a brand.
I tell people that when comparing the free antivirus utilities vs. the paid take the free, as long as they are of reputable means. The reason is that the antivirus side of things is pretty straight forward. Free does a very good job these days, and no matter how you look at it you always need a compliment of utilities anyway (e.g., Spybot S&D 1.6.2, Ad-Aware 2008 (the latest version is unstable), Windows Defender, and AV such as AVG 8).
The paid commercial product has to compete with these free competent products (and I should know I use them to clean computers every day). When the paid commercial products are released they full of bloat and attempt to integrate themselves do deeply into the OS, so much so that they become the cure worse than the disease.
Not only that the commercial products have tended over time to make customers paranoid. They need to to keep them purchasing their products. A realistic schedule for scanning, once you know your system is clean, along with continued updates for the OS, is all you need--you can be certain you don't need a paranoid schedule such as every day, every week or even every two weeks.
The flip side is that if you get so relaxed about your security you won't do it at all.
Stay away from Norton and McAfee. They are bulky, they are paranoid about their own customers constantly requiring verification of subscription just to get updates (McAfee anyone?).
Stay away from the gimmick. Do you need that toolbar? The 3rd or 4th one in your IE, or even FF? If you don't understand what the toolbars are doing you shouldn't be installing them. What are they doing? They want you to log in, just like Google and Yahoo. They want to track you and your web pages for targeted ads. I'm not saying that Google and Yahoo are gimmick software used to bait you to install malware, but I am saying that there are plenty of them that do and they are taking their directions from the likes of Google and Yahoo. The more toolbars you have the more search engine choices you install. Choose one and stick to it. Stay away from anything that's a gimmick because it is bound to get you in trouble. Windows itself never pops up a dialog box saying to buy this or that software product. Those are fake. Downloading codecs from an innocent site can also get you in trouble and you should set your system to ensure that you don't automatically download codecs.
The bottom line is that commercial software is bloated and creates paranoia, and for good reason--they die as a company if you don't resubscribe. The free products do just as good a job as the commercial. And you can't get away with just one product to defend your system anyway. It takes a compliment of them. Stay away from the gimmick. Uninstall your extraneous toolbars (or all of them for that matter). Your web browser is to browse pages not to be served ads or to be tracked by a product that you don't know is tracking you.
Re:Rootkit? (Score:5, Funny)
No, that's not the file. That's the noise I make in disgust everytime somebody tells me to install Norton.
I'd rather download WINDOWSANTIVIRUS.jpg.exe from bittorrent. At least that will shut up every now and then after I pay the extortion fee.
Windows Users Beware... (Score:5, Interesting)
As of this writing, if you do a Google search for "PIFTS.exe" (like was noted in the above summary), the first several links will take you to compromised/attack vector sites.
Did /. just get social engineered?
(Yes, Offtopic to the posts above, but maybe this will have kept someone from getting a nasty surprise...)
Re: (Score:3, Interesting)
Re:Windows Users Beware... (Score:5, Interesting)
That does seem to be the case.
Maybe not just Slashdot, but the whole intertubes is getting socially engineered... ;)
1) Crack the NAV update process, inject a timed release 'pifts.exe'.
2) At the appointed time, firewall alerts get users to start massive concurrent searches on 'pifts.exe', and while Norton tries to figure out WTF is going on, they make the deadly mistake of censoring their forums to disguise their bafflement, which creates huge internets buzz on various security and tech related sites like here and Digg and ZA.
3) Have your malware sites primed and ready to go, optimized for the expected Google results, creating a nice giant influx of "new users" for your botnets.
4) Profit!!!
Okay, just joking... Possible, but highly unlikely. It will be interesting to see what this story turns out to be all about. :)
Re:Windows Users Beware... (Score:4, Insightful)
Well now if it's not what they did, they are certainly planning the next one!
Re:Windows Users Beware... (Score:5, Informative)
Original submitter of the article here (wasn't logged in last night). Clever maybe, but not the case. I got the popup from Norton last night asking me to allow or block this executable's internet connection attempt. It was around 10 o'clock I believe. The inital few threads on Norton's forum were completely legitimate and no one was throwing around conspiracy and virus accusations. The problem started when Norton mods started deleting the threads, and blocking the people who posted them from creating more. About 1:30 I went to bed, having found nothing concrete. At that time there were a number of posts around the net, most notably the Zone Alarm forum (since Norton was deleting things). At that point the Norton boards weren't being raided by 4chan at all -- that happened sometime overnight/this morning.
The file is real -- I can send you a copy if you'd like -- and appears to be part of some Norton update. Really the only problem here, and what triggered everything was that Norton was trying to delete any mention of it from their forums. As many others have pointed out, this leads me to believe that either the file is something Norton doesn't want in the open because they're tracking/doing something they don't want us to know about (tracking personal info, rootkit, whatever) or that somehow the Norton update was compromised and sent out a file that they're desperately trying to cover up/fix.
I haven't disassembled the file, but I was looking at it in a hex editor last night when I noticed all the ascii "PADDINGXX" at the end of the file, which strikes me as odd and doesn't seem to have a readily available reason to be in a legitimate file. There's no more code after the PADDINGXX sections, so it seems to be there only to ensure that the executable is a specific size.
Re:Windows Users Beware... (Score:5, Informative)
Of course, the problem with that justification for deletion being that 4chan spamming didn't start until sometime overnight or this morning. Hours earlier several completely legitimate question threads had been deleted with no explanation.
Re:Windows Users Beware... (Score:4, Informative)
Re:Windows Users Beware... (Score:4, Interesting)
Reading the various forums and comments, I also noticed that there were/are several people who have checked their logs and seen that the 'pifts.exe' file was uploaded to their system several days prior to the "3 hour window" in which the patch was distributed/activated last night (this info is according to the Symantec spokesperson official statements I have seen so far).
It is obvious that Symantec really fumbled the ball, PR-wise. Yet even as they have picked it back up, their statements on what happened do not seem cohesive with the experiences of people that I've read in many different places. I still feel "It will be interesting to see what this story turns out to be all about.", because I don't think that the full truth about this has come out. Too many inconsistencies...
Re:Windows Users Beware... (Score:5, Interesting)
Don't we all run Linux? (Score:5, Funny)
/ yet another smug, uninfected Linux user.
Re: (Score:3, Informative)
P.S.
I should mention I was banned from the forum a few minutes ago - hence my anti-Norton Forum bias.
Re: (Score:3, Insightful)
>>>you agreed to their TOS which probably state they can censor anything they want and ban anyone they want for any reason.
True. And the same applies when you enter into China, but I'm not aware of anyone who thinks China's Internet Firewall censorship is acceptable practice. Infringement of a human right is infringement regardless if the perpetrator is China or Norton.
Re:Windows Users Beware... (Score:5, Insightful)
There's a difference between censorship on a private message board operated by a private company, and censorship by a state with authority over its citizens. But that seems to be a really hard concept for the average internet user to grasp.
Corporations are legal entities which only exist because the state creates the framework which allows them to exist. They are not human beings (created by God etc) with an independent existence.
There is a difference between censorship practiced by a private individual who has an inherent natural ability to control things in his possession and is also liable without limit for any harm he may cause to others and a corporation which has no ability or power to do anything whatsoever except what the State gives to it, and limited liability towards the owners.
It is an act of congress which allows corporations to exist. That act should not result in a violation of the bill of rights. And if it does, it certainly can not be justified merely by saying it is the consequence of the act of congress and not congress itself which violates the bill of rights. That would be like saying "I didn't kill you, it was the bullet that flew out of my gun that killed you".
I would argue that when a corporation of people attempt to violate the human rights enumerated in the constitution of the United States, the US government has a constitutional obligation to revoke its legal protections of that body of people. In effect the limited liability corporation would revert to a partnership with full liability to all its owners (shareholders).
I would argue that any corporation of private individuals that goes to the People of the Unites States (the government) seeking limited liability for its members (shareholders) is also promising to uphold the Constitution of the United States.
Re:Windows Users Beware... (Score:5, Insightful)
Posting on Norton's forums is a fundamental human right?
Re:Windows Users Beware... (Score:5, Insightful)
Welcome to Slashdot - you must be new here. Let me fill you in on how things work hereabouts.
1. Free Speech applies to everything, all of the time, and you don't have to take responsibility for either your words or your actions, unless you are "Teh Man".
2. The higher your UID, the more likely that you believe in 1. with religious fanaticism.
3. Spelling and grammar don't count, no matter how poor.
4. Neither do organization or coherence: You don't have to make sense, you just have to include enough buzzwords and generalities to sound good.
5. Google is good.
6. Apple is better.
7. Information wants to be free as in beer, and you're entitled to everything for free.
8. Copyright is an obsolete concept, unless you're referring to the GPL.
9. Microsoft is always evil.
10.Novell sold out.
There you go! That's about all you need to know to fit in here. So, turn off your brain, spout a few platitudes, and bask in the warmth of the resulting karma.
Re:Windows Users Beware... (Score:5, Funny)
12. Profit???
Re:Windows Users Beware... (Score:5, Funny)
Strawman? False Dichotomy? Slippery Slope?
Man... where do I even begin to explain how bizarre this leap of logic is? Not even Evel Knievel could make this jump.
Re:Windows Users Beware... (Score:5, Funny)
Not even Evel Knievel could make this jump.
Is that because he is dead? Or because the gap is too far?
Re: (Score:3, Insightful)
Re:Windows Users Beware... (Score:5, Interesting)
"Censorship" is done by governments
Censorship is done by people who censor, and has nothing to do with government at all. The only connection it has to government is the prevailing belief that it's "bad" when government does it and "ok" when anyone else does it.
Re:Windows Users Beware... (Score:5, Insightful)
In defense of a rational understanding of human rights abuses:
Norton isn't not keeping you from critiquing them anywhere else. Not on Slashdot, not on your own webpage, not out in the street, not via pamphlets or street marches, not anywhere else, not at all. Norton isn't beating down Slashdot to revoke your UID and retroactively delete every comment you've made. Norton isn't erasing your existence, making an example out of you, disappearing you, or destroying your life over this.
Norton DOES NOT HAVE THE POWER TO CENSOR, and you're a fool if you follow Commodore64_Love by equating Norton with China, North Korea, or any of the numerous and viable human rights watch hotspots on the planet. Norton doesn't come anywhere near the kind of awful, degrading, threatening, chilling power that a genuine censoring government can wield in the night.
Norton simply refuses to propagate other people's speech that coincidentally sabotages their business. Since they provide that opportunity on their servers, they have the right to oversee speech on the site they pay for and manage.
Norton is not even spitting distance from looking at the closest edge of the slippery slope on the horizon. Norton is exercising its right over the property it actually owns: the bits n' bytes that live on the hard drives on their servers. Nobody else's.
Lord know I don't respect Norton, but they're not setting the world ablaze with their fascist thugs. They're just being jerks toward their customers, and that is -- rightly -- not a crime. When they start kicking down doors, then I'll worry.
Re:Windows Users Beware... (Score:4, Insightful)
If I go onto a Disney children's forum and post nothing but swear words, and Disney deletes it, is that censorship too?
It's their right to do so, but this does not make it "not censorship", whether they remove the post entirely, *** over the swear words, or replace them with gumdrops and candy canes.
Re:Windows Users Beware... (Score:5, Insightful)
And if it is a businesses right to delete comments they want deleted, as they stated in the terms that all posters agree to, it isn't censorship either. If I go onto a Disney children's forum and post nothing but swear words, and Disney deletes it, is that censorship too?
Yes, it's censorship. Please regard the dicntionary:
To Censor [merriam-webster.com] :: to examine in order to suppress or delete anything considered objectionable [censor the news] ; also : to suppress or delete as objectionable [censor out indecent passages]
It has nothing to do with morals or laws. It's a term with a definition. Societies determine if it's a "good" or a "bad" thing based on the situation.
Re:Windows Users Beware... (Score:4, Insightful)
>>>the corporation should inherit (where applicable) the rights of its founders
And the workers are treated like cattle - "human resources". Sorry but I don't consider a corporation anything other than a non-free state, and when you enter that "state" you lose several of your rights - like freedom to speak, or freedom to drink beer on weekends (else you get fired when the boss sees the photo on your facebook page), or .....
Re:Rootkit? (Score:4, Informative)
That's a good idea. Although this coding horror post is about a year old, it's a note on how much anti-virus software slows down your machine. Norton leads the pack with an amazing 46% slower boot, 20% slower CPU, and 2400% slower disk access time.
Coding Horror: Choosing Anti-Anti-Virus software [codinghorror.com]
Weekend???? (Score:5, Funny)
Wow, you managed to uninstall Norton A/V in less than 48 hours????
Re:Weekend???? (Score:4, Informative)
After you did the Add/Remove Programs, how did you get rid of Norton Antivirus programs?
If you believe that this actually removed them, then you are very, very wrong.
Re:Rootkit? Nice timing (Score:4, Informative)
I've read a lot of reviews (Gizmo freeware, for example) : http://www.techsupportalert.com/best-free-anti-virus-software.htm [techsupportalert.com] which don't support this view.
Kaspersky seems to not have won out too well recently too.
Can you post a link to back up your argument?
Don't worry. (Score:5, Funny)
Re: (Score:3, Funny)
Re:Don't worry. (Score:5, Funny)
Re:Don't worry. (Score:5, Funny)
Probably just some anonymous report sender (Score:5, Interesting)
Many default with the "Do not ask again" option checked, so once you click through...
(* however anonymous "anonymous" means. Just because they give you a button to look at the contents of the report doesn't means they showed you the headers or all of the data.)
Re:Probably just some anonymous report sender (Score:4, Insightful)
use a better os (Score:3, Insightful)
Re:use a better os (Score:5, Insightful)
You should run a virus scanner, just to keep from accidentally forwarding viral crap to other people. Infected files and attachments, etc. And assuming you're safe is equally foolish. I run plenty of security software on my linux boxes.
Norton, however, is a turd. Anyone who runs Norton gets what they deserve. It's like a parasite that eats cycles for no reason, and cannot be removed without killing the host.
Re: (Score:3, Funny)
>>>Norton is a turd....It's like a parasite that eats cycles for no reason
I have McAfee on my new laptop. Is that any better, or should I remove it immediately? Why or why not?
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
No, Symantec Endpoint Protection is just as crappy. It's not Norton level of shit but it's there. It still likes to eat CPU cycles for no reason and randomly crash. Also, as added feature, it marks many Windows Network tools like Angry IP Scanner, Blues Port Scanner and Ethereal as "Hacking tools" or other such garbage. Makes diagnosing problems with users PC quite entertaining as I get to box with Virus Scanner on top of everything else.
More conspiracy theories (Score:5, Funny)
Let's begin the conspiracy theories:
Any publicity is good publicity (Score:5, Funny)
Ping Internet For Time on Slashdot?
not to worry (Score:5, Funny)
lulz (Score:4, Interesting)
Auto-update sent out a virus? (Score:5, Interesting)
Reading TFA, the author noted a lot of padding in the suspect executable, presumably to have it match the filesize of something it's pretending to be.
The author then suggests with the rapid proliferation and Norton's screwy coverup in their forums, that the auto-updater may have sent out a virus/rootkit.
Perhaps Norton thought they could send out a patch to clean it up before anyone found out?
PIFTS Obvious what it is (Score:5, Funny)
P = Purposely
I = Introduced
F = File
T = Thieving
S = System
They used to get it. (Score:5, Informative)
Do ** NOT ** search Google for pifts.exe !! (Score:5, Informative)
The first one links to a blank page which will redirect in about 20 seconds to a malware site.
The second one is immediately flagged by Firefox as being a "Reported attack site".
This slashdot article is possibly a attack on the /. community.
Re: (Score:3, Interesting)
Perhaps this is why pifts.exe is being bandied about. It's a perfect way to get people to get to sites that will infect them with a virus by using search engines to point the way.
Re:Do ** NOT ** search Google for pifts.exe !! (Score:5, Informative)
Good riddance Norton (Score:5, Interesting)
Sorry if this comes across as rather elitist, but the all-encumbering anti-virus packages these days just seem so out of date. Norton has always sold itself on the basis it has every possible corner and hole of Windows plugged, checked, double-checked and clamped shut (that is...until your subscription ran out anyway)
Up until a few years ago, I would have really wanted that assurance...like there was a big Daddy Norton with a big fuck-off gun vigilantly checking all entrances; verifying all in & out; assuming guilt until proven innocent.
Thing is, as much as people here may dislike Vista, one thing I think no one will deny is that it's a version of Windows far more capable of taking care of itself; the effect being that AV really doesn't need to be the relentless and fearsome bouncer it was.
Gone are the days when you could "just write in the system32 dir" etc; nay, even programs not rubber-stamped with a certificate that don't need root access will raise an eyebrow in the shell in Vista/W7.
My point is, AV now is nothing more than a "These programs are bad" list. The leaky sieve that was Windows past is diminishing every, and heavy security like Norton is becoming less and less relevant (thank god)...and they know it. Good riddance I say.
Zone Alarm boards info (Score:5, Informative)
They would not answer my (a customer) question. (Score:5, Interesting)
Crash explorer and become System to view that file (Score:4, Informative)
pifts is "invalid content" on the forums (Score:3, Interesting)
Tried to register at their forums with login 'pifts and got this:
Way to go Norton! We may have to rename Streisand effect to Norton effect pretty soon...
Way to treat your customers (Score:3, Funny)
PIFTS is the sound of their market share with the excellent way they are treating their customers.
I know I would be removing this from my machines.
PIFTS.asm download (Score:4, Informative)
Strings in PIFTS.exe (Score:5, Interesting)
Here's a dump of strings found in the pifts.exe on pastebin:
http://pastebin.com/m1e207a78
Interesting padding buffer right at the end? Spoofed length or just room to grow some internal resource?
Re:Strings in PIFTS.exe (Score:5, Informative)
Some interesting things in there:
This seems to point to that at the very least it's not some random virus that managed to sneak into the installer, it's either an actual Norton program that does something fishy Norton doesn't want to admit, or a Norton program that got infected with something. I wonder what's in those registry key.
Interesting, it reports stats to Norton somewhere, perhaps?
This seems to pretty clearly point to that an URL for a GET request is created for some purpose.
So there's a .DLL too, did anybody post that one?
There may be a .log file somewhere, named with a timestamp
Something that might appear in the log file, perhaps? What is it pinging, and why?
Looks like a path from the development computer that accidentally got into the binary. Names unfortunately don't seem to explain anything though.
Re:Strings in PIFTS.exe (Score:5, Informative)
Replying to myself,
On reddit [reddit.com] there's a link to a decompiled version [mediafire.com].
It seems to do pretty much what I guessed. However, there are various function calls scattered through the code, like "sub_4022C0();", which aren't in the decompiled code, and probably come from a DLL.
So it looks like the .exe itself is just WinMain that calls the functions that do the real work, reports stats and does some logging. Whatever it actually does seems to be elsewhere.
Re:Strings in PIFTS.exe (Score:5, Informative)
An effort underway (Score:5, Interesting)
Re:An effort underway (Score:5, Funny)
Thanks for effort. I just hope you will have the time to do it while still following the other piece of news you have posted on your blog regarding the immediate annexation of Mexico by the U.S...
Re:An effort underway (Score:5, Funny)
There is an effort underway here http://chrysler5thavenue.blogspot.com/ [blogspot.com]
The previous blog entry on this site is that the US is annexing Mexico. Looks like a reliable source to me.
PIFTS (Score:5, Funny)
ThreatExpert report (Score:4, Informative)
I've submitted the file to ThreatExpert, and the report is available here: http://www.threatexpert.com/report.aspx?md5=91b564d825a3487ae5b5fafe57260810 [threatexpert.com]
It appears as if this is a statistical reporting tool, given the URLs to which it calls home. All in all, it seems reasonably innocuous -- even if Symantec's response to it is unnecessarily heavy-handed.
Nothing dangerous... (Score:5, Informative)
I have a copy of PIFTS.exe now and am examining it.
Notes:
1) It is small
2) Internally it is a "patch tool" from patch "021809db"
3) The Operating System function calls it makes are generally non-threatening
4) It accesses the registry (Norton products) and does some kind of date based validation
My guess is... It is an activation checker of some kind. It looks like it is pulling the registration information from the registry and checking it against file dates.
It also seems to copy its self to the temp folder on execution although I'm not entirely sure as to why.
Re: (Score:3, Informative)
Mod this up. For all the hysterics, this sounds accurate from reading the Strings dump. The only real news story here may be Norton's inappropriate forum reaction.
If this is indeed a "legitimate" patch tool, why not post that info on the forum, sticky it at the top, and refer to it when locking (instead of deleting) subsequent re-posts?
Hmm... what else comes from Africa..... (Score:3, Funny)
Happened before, apparently (Score:3, Informative)
Symantec Caught in Norton Rootkit Flap
"Symantec Corp. has admitted to using a rootkit-type feature in Norton SystemWorks that could provide the perfect hiding place for attackers to place malicious files on computers..."
http://www.eweek.com/c/a/Security/Symantec-Caught-in-Norton-Rootkit-Flap/ [eweek.com]
And this is what RMS keeps talking about (Score:4, Insightful)
When you use proprietary software, you don't really know what's happening on your system.
If somebody happened to notice a suspicious process on a Linux box, it'd have been the question of 15 minutes to figure out what package the file belongs to, get the source, take a look at it, and find out what it does and why is it there.
Instead what we have here a mess with some people coming up with conspiracy theories, Norton refusing to acknowledge the issue, and people trying to figure out what this thing does by looking at the output of strings without much success so far.
Things are much easier when source is available.
The News Within The Non-News (Score:5, Interesting)
When I first saw this here, the first place I looked for additional information was the Internet Storm Center [sans.org], where they eat this kind of stuff up. And sure enough, they even had a call from someone at Symantec saying that yes, this one is theirs.
Conspiracy theory or no (and it's looking more like no), there are two things that rescue this from dullsville:
In the comments on that SANS article, it's mentioned that yes, Symantec is deleting comments left and right, and meanwhile the talk is slowly wending its way onto the ZoneAlarm forums, which just goes to show that one man's misstep is another man's opportunity. And...
While the story behind the PIFTS file itself isn't terribly interesting, some unsavory rapscallion had noticed its popularity as a search term, and planted malware where people looking for information on it could stumble upon it. Fun stuff, eh? Look for malware information, and find it the hard way.
Google has already removed that link, but it might still be out there, just in case you use a different search engine. And there's no reason he/they won't try again on another site.
Re:law enforcement back door (Score:5, Insightful)
That sounds a little too much like "James Bond" to me, mr anonymous poster. I think we should wait until someone disassembles it and looks at what it's doing.
Re: (Score:3, Interesting)
Re:law enforcement back door (Score:4, Funny)
If that's true, Symantec must be dumber than I thought if they provided a backdoor to a firewall that allows said firewall to warn the user.
Re:law enforcement back door (Score:5, Interesting)
Or smarter... If they were forced to put the backdoor in, then gagged by the court, maybe one of the programmers "accidentally" made a mistake so that the existence was indirectly revealed.
Re:law enforcement back door (Score:4, Funny)
Maybe Norton's anti-virus is so good that even THEY can't get a virus past it? ;)
Re:law enforcement back door (Score:5, Insightful)
I call shenanigans. This comment has all the earmarks of an urban legend. An anonymous post claiming to have insider knowledge from another anonymous post.
Why would a third party "security" product require a secret law-enforcement backdoor? The FBI, CIA, NSA, etc. would simply have Microsoft provide a backdoor into ALL of Windows. They wouldn't waste time with a commercial product that only some Windows users install. Why go that route when going the MS route would ensure a backdoor into all systems and not just a very small subset of systems?
CIPAV is not something added willy-nilly into commercial applications. It's basically an extremely well designed rootkit that the FBI, etc. targets against specific users & computers by tricking users into installing it. (social engineering, etc.)
Re: (Score:3, Insightful)
This is why we need additional mod options. I have points, but there's no option for "Interesting, if it's true" or "thanks for the info, but since there's no way to validate, caveat reader."
It's really easy to get bullshit modded up because of the number of people who say "I didn't know that, thanks". How many of the +4 so far are "+1 because it's true" vs. "It's news to me"?
so what alternatives do we have? (Score:3, Interesting)
For those of us who have systems with patient study data, this is a Big Fucking Deal. Luckily, we have firewalls involved, but still...
Phase 2 has begun (Score:3, Funny)
I know a guy who knows someone who dated the sister of someone at symantec, and lets just say, they're going to team up with Starbucks To Begin Sinister 'Phase Two' Of Operation [theonion.com]
Re:pot! kettle! black! (Score:4, Funny)
What sort of response are you talking about?
timothy
Re: (Score:3, Insightful)
ever try getting a response from the slashdot crew?
Ever had a thread deleted by the Slashdot crew?
Precisely.
-FL
Re:Any idea what it is? (Score:5, Insightful)
I can think of a dozen unix/linux rootkits without even trying. Just because it's harder to install them, doesn't mean it's impossible. If you think you don't need to run any sort of security software (not Norton, of course, because they suck), then one day you're going to have a very very rude awakening.
Re:Any idea what it is? (Score:5, Insightful)
The second that Linux gets above a 50% market, it will also be targeted by viruses, and anti-virus will then be a must for Linux.
So, unless we want that to happen: Keep quiet and enjoy your virus-free Linux.
Re:Any idea what it is? (Score:5, Insightful)
It's a clue for you to stop using a platform where you must run anti-virus software and to finally switch to something better and come to the 21 century of computing.
I've been using Linux not quite as long as some, but probably longer than most. Quite probably longer than someone, like the parent poster, who has a Slashdot user ID five times larger than mine, especially since I lurked on Slashdot for a few years before getting an account. For me, Linux has been my primary computing platform for over 15 years, and, before then, it was Unix, or, prior to that, one of the DEC predecessors leading back to the early 80s. I have used machines running ITS, one of the first timesharing systems, when they were still contemporary.
That said, I'm tired of this dribble. Unix (in the industrial versions) had / has nearly no viruses or malware because there were very few people using it in total numbers. There was and continues to be little to be gained by writing a virus for these systems: no press coverage, no botnet of millions of computers. It doesn't pay. It isn't worth the effort. Same for Linux: the market is still too small. Same used to be true for MacOS, but that's starting to change as it increases in popularity.
Contrast this with Windows boxes that are so ubiquitous that a half-talented virus writer has a decent chance of getting their malware into hardened sites like the Pentagon through social vectors (eg, an absent-minded worker who uses a USB key on both home and work computers by mistake).
Linux has no viruses because the market is too small. To think that it is immune to attack from malware is naive at best, and, more probably, self-deceptive. If Linux starts to enjoy 10, 20 or 30 percent market share, we will see Linux-targeted malware become a common nuisance. We already see Firefox-specific browser exploits (but for Windows boxes). FOSS isn't somehow magically immune from nuisance teenage activity or out-and-out criminal intent.
So, please, enough of the holier-than-thou attitude.
Re:Any idea what it is? (Score:5, Insightful)
> Linux has no viruses because the market is too small
Well, even assuming this is the only reason (a bit questionable due to the situation with web servers), exploits usually are not particularly portable. And since each distribution compiles their own version, Linux reaching 50% market share actually might _not_ be enough, but what you would need might actually be a _single version_ of a _single distribution_ reaching 50%, which is far less likely.
Re:Any idea what it is? (Score:4, Informative)
No, and that is exactly what I'm saying. That is not a virus (something that propagates itself without user intervention).
Something that requires social engineering (lure of porn in this case) to get the user to run it is something else altogether. And like I said there is no way to protect any platform from the user who chooses to download malware and run it.
Re:PIFTS.asm (sorry for the bad formatting) (Score:4, Interesting)
34308: SWC00413C88__PIF__B8E1DD85_8582_4c61_B58F_2F:
34309: unicode '\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}',0000h
--
34370: SWC00413E78__60333AE5_B66E_4994_B15C_CA2D665:
34371: unicode '{60333AE5-B66E-4994-B15C-CA2D665CDC89}',0000h
--
34373: SWC00413EC8_systemState:
34374: unicode 'systemState',0000h
34375: SWC00413EE0_SOFTWARE_Symantec_PIF__B8E1DD85_:
34376: unicode 'SOFTWARE\Symantec\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEngine',0000h
--
34430: SWC00413FA0_http___stats_norton_com_n_p_modu:
34431: unicode 'http://stats.norton.com/n/p?module=2667',0000h (this looks very interesting!)
Re: (Score:3, Informative)
Here are the strings: http://pastebin.com/m1e207a78