Symantec held info about a big cyberthreat for hours after spotting it ....

I was just reading an article that the big security firm Symantec held info about a big cyberthreat for hours after spotting it.
The threat is the Slammer worm that did quite a lot of damage in January.
Symantec being the nice people they are "Shared the information only with "SELECT CUSTOMERS" [ which of course means people with lots of money,, ooh guess that leaves us out, but oh well], while the rest of use were of course being bombarded by Slammer.
What does Symantec do next they boast about how they had discovered the worm way ahead of time,, then delivered timely alerts and procedures to DeepSight users. Which that would be us oh I forgot we dont have a subscription to DeepSight.
Of course this made many people very angry.
Really shows you how most companies think about money first and then the customers.
I was wondering what people think of this ...
To read the whole story go to the following link below:

http://www.mickeytheman.com/boardnat...4899c4d165.htm

After reading this I think that I might just change my AV software.

Thats good reading..

Quote:

---

The damage from the Slammer worm did not rival that of the 9/11 attacks, but it did manage to temporarily fry much of the Internet. Telecommunications systems in Asia and Europe were swamped, some North American ATM machines ceased to spit out cash, and several airline reservations systems shut down.

---

If symantec is trying to spoil there customers, there going a little too far.

Intresting to know this things. The question which rises is:
"is this the first time ?????? and will it be the last time???????"

:)

If this is an attempt to get more people to buy NAV 2004, its not going to be their last time..
Go look at the ratings they recieved from other users over here

Norton was ok when I needed it and I sure as hell liked it better than I did Mcfee. But indeed... I also dislike the direction Norton is going.

As for slammer what must be remembered here is like MSblaster for example there was a patch for the exploit long before there was a worm useing it. The same can be said about SQL slammer.

Thats a good point there was a patch out long before there was a worm to use the hole.
Still I think symantec should inform everyone at the same time about security issues they find. Not just a select few with $$. I'm still going to use them because I have for years. But if they continue down this road. I'm going to look for alternatives very soon.

Wow... those are horrible reviews for NAV2k4...

My suscription is about up in a month of so too...

Looks like its almost time for a backup/format/reinstall.... NIS2k3 works wonderfully for me.

I don't think its fair for them to hold the info and give it to select customers.
Its the more of the home users PCs that were slamming the internet... not as much the corporations (due to multilayer protection/firewalls/patches/etc)...

Its more of the home users and small businesses who don't have security personnel or even an IT dep. to make sure they are protected and up2date.

As long as they can hear "You've got mail!"... thats all they care about.

Welcome to the world of big business.

I think it is silly of all of you to expect a company to share data that they are spending a lot of money to gather. Running the collection nodes and paying the analysts that are the backbone of the deepsight system is not a cheap thing to do.

If you think symantec is the only company that does this, you are sadly mistaken. Just about every security/AV monitoring company in the world sees threats ahead of time and let's their biggest customers know ahead of time.

NAI is the anti-virus vendor that my employer uses and we will receive a call from our account manager as soon as a critical virus/trojan is detected. This is usually anywhere from 4-6 hours before the threat is publicized. Mainly because most AV vendors will not publish data about a threat until they have a dat file that will detect the threat. We get this kind of service because we pay top dollar to have it. That is just the way of the world.

Nobody is going to provide this type of service for free. It just costs to much money to do it.

Wow, thats really lame they only let the people with the $$ know about it ahead of time...

It reasons like this that I've been praising Panda AV for the last almost year. Not only do they share their info with all their customers, but they had virus definitions already availble to be downloaded for all of the latest big ones, before they hit. (including slammer, SoBig, Blaster, etc)...

So anyone using their products, even if they haven't done the MS patches yet, were protected from those viruses via the automatic daily virus definition downloads...

RRP

Quote:

---

It reasons like this that I've been praising Panda AV for the last almost year. Not only do they share their info with all their customers, but they had virus definitions already availble to be downloaded for all of the latest big ones, before they hit. (including slammer, SoBig, Blaster, etc)...

---

I don't quite undertand... how can they have a def out before the virus is out?

It a conspiracy! The AV corps pay people to code, then turn over to AV company to make def. then release to public. Anyone who does'nt pay, gets hit... sometimes softly, sometimes with a cannonball to the stomach. Doesn't the mob use those buiness practices?

Quote:

---

I think it is silly of all of you to expect a company to share data that they are spending a lot of money to gather. Running the collection nodes and paying the analysts that are the backbone of the deepsight system is not a cheap thing to do.

---

Hey... we pay too. So... if they tell their deepsight customers first (say 4-6 hrs) then they should tell their suscribers next (2-4hrs) and then finally the public? LoL That makes no sense at all... they should just tell everyone so everyone can scramble to try to minimize the effects of said virus/worm.

Then again... they should be scrambling to path their systems when the patch is released and tested. Not when a virus/worm hits that can exploit the security hole.

get on a good mailing list and you won't be left out of stuff like this. We are a premier customer of Symantec and did learn about it through them, but it was about four hours AFTER I heard about it on one of my mailing lists.

Lv4: What mailing lists do you suggest? I'm already on a couple... such as bugtraq, incidents and a couple of misc lists.

EDIT: Offtopic:

This post made me 1337!!!!! :)

You read my mind phishphreek...I was gonna ask the same thing.. has anybody posted a list here before of mailing lists for the newer members? (myself included).

Quote:

---

Wow, thats really lame they only let the people with the $$ know about it ahead of time...

---

That is like saying "it sure is lame that the Jaguar dealership only gives new cars to people with $$$."

Symantec is a business- not a non-profit organization. They are under no obligation per se whatsoever to share the information with ANYONE who isn't paying them- much less before their paying customers.

If you want a service like that then you essentially need the government to step up to the plate and fund an organization to set up a cyber-surveillance and alerting system similar to Symantec and other security providers and put it on the taxpayer's tab- then they can disseminate the information publicly in virtual realtime.

As for a mailing list you can get info from I recommend AVIEN / EWS. It is a non-vendor supported / related organization. It is nice because its grassroots. The members are the ones who report incidents as they occur to them so you get knowledge quickly- not hours after the fact. I have the alert lists set to email to my text pager so I get notified immediately of new suspicious / malicious traffic.

As mentioned earlier- vendors don't generally publicize problems until AFTER they have created the solution. With an organization like AVIEN you get the info as it happens so you can prepare or mitigate prior to the vendors getting their ducks in a row.

Here is a link: AVIEN

Quote:

---

If you want a service like that then you essentially need the government to step up to the plate and fund an organization to set up a cyber-surveillance and alerting system similar to Symantec and other security providers and put it on the taxpayer's tab- then they can disseminate the information publicly in virtual realtime.

---

OMG That is a scarry thought! Force the taxpayers to provide more money to support the lameos that refuse to pay for viral/vulnerability alert services. Shame on you Tonybradley for even suggesting such a thought! ;)

Seriously though if you take on the responsibility for owning a computer, then you need to be ready to pony up the dough to support it.

Quote:

---

That is like saying "it sure is lame that the Jaguar dealership only gives new cars to people with $$$."

---

No - what I was talking about wouldn't cost them anything but a few seconds time - not giving away something that cost thousands and thousands of dollars... (While I see your point, its still not really an accurate analogy)

Quote:

---

Symantec is a business- not a non-profit organization. They are under no obligation per se whatsoever to share the information with ANYONE who isn't paying them- much less before their paying customers.

---

I wasn't saying they should give it out to the public before their paying customers - I agree their customers should come first...

But part of them maintaining a customer base is "GOOD" public relations. Which sending out information they already had, a few hours earlier wouldn't of cost them any more then it did to send it out after the fact. Only doing it they way they did it was "BAD" for public relations - and therefore would be bad for business...

Quote:

---

I don't quite undertand... how can they have a def out before the virus is out?

---

Sorry, I should of been more specific about that... I was referring for us American customers - as they have offices throughout Europe and Asia - they were able to identify the virus when it was origannly released overseas and had definitions out for them before they even hit the Americas... (And yes they came out that quickly, as I know they were spread in mere hours for the faster ones, and in about a day/day and a half for the slowest of those newer big ones)...

RRP

Quote:

---

Sorry, I should of been more specific about that... I was referring for us American customers - as they have offices throughout Europe and Asia - they were able to identify the virus when it was origannly released overseas and had definitions out for them before they even hit the Americas... (And yes they came out that quickly, as I know they were spread in mere hours for the faster ones, and in about a day/day and a half for the slowest of those newer big ones)...

---

Ah, Ok. I understand what you were saying now. I never really thought too much about how they gather data and samples to analyze and dissect to come up with defs. for the viruses and worms. I know why they do it... but never paid much attention to how they do it.

Similar to a whole bunch of honeynets around the world.

Thanks for clearing that up.

Quote:

---

Originally posted here by bpiedlow


No - what I was talking about wouldn't cost them anything but a few seconds time - not giving away something that cost thousands and thousands of dollars... (While I see your point, its still not really an accurate analogy)



I wasn't saying they should give it out to the public before their paying customers - I agree their customers should come first...

But part of them maintaining a customer base is "GOOD" public relations. Which sending out information they already had, a few hours earlier wouldn't of cost them any more then it did to send it out after the fact. Only doing it they way they did it was "BAD" for public relations - and therefore would be bad for business...



Sorry, I should of been more specific about that... I was referring for us American customers - as they have offices throughout Europe and Asia - they were able to identify the virus when it was origannly released overseas and had definitions out for them before they even hit the Americas... (And yes they came out that quickly, as I know they were spread in mere hours for the faster ones, and in about a day/day and a half for the slowest of those newer big ones)...

RRP

---

You are making assumptions that it would only cost Symantec a couple of seconds. This is not at all the case. They didn't find out about this as quickly as they did because they have offices in foreign countries. They found out about it quickly because they offer a service where they monitor thousands of different areas of the internet looking for patterns in the traffic that resemble attacks and other malicious activity. When they find these patterns they have a highly paid analyst dig into the issue further. Once the analysts have determined exactly what the issue is, they give the information to the customers who have paid to support the service. Along with telling them about the "attack" symantec also gives recommendations on how to deal with the issue.

Tony's analogy is dead on. The service that symantec is providing costs thousands, if not hundreds of thousands of dollars to maintain. Why is it that you think you should be privy to this information, for free, that cost symantec so much money to gather?

If symantec were just to give this information away, they would not be able to continue gathering that data to begin with for much longer, mainly because it would be a situation where they would lose mass quantities of money.

What a Lame thread!

Come on childeren.. You are doing the same crap again.. Flogging a company because of business practice.. ok Its not fair.. Grow up nothing in life is bloody fair..

NOTE: SLAMMER Worm ONLY attacked vulnerable SQL servers.. Hello PPL.. Other than Sysadmins.. So how many of your were vulnerable.. So Who would be most affected .. Bloody big business you twits.. The ppl who do pay the money..

If you are going Slam the companies.. how about ALL of them.. What is the time between discovery of a threat and the release of the Def's? Corporate only hours.. Domestic.. ???? AVG updates about every 14days.. fark.. Norton 7 days... mcafee ???.. (except when there is a major threat... well that is dependent on your perspective isn't it)

Some of you guys have had your heads up your academic arse to bloody long to see the busness world with a real perspective.. Your talking about companies with Millions of customers not bloody mom and dad corner store business's.. put the facts into perspective..

OK .. End of minor Dummy Spit..

cheers

Quote:

---

You are making assumptions that it would only cost Symantec a couple of seconds. This is not at all the case. They didn't find out about this as quickly as they did because they have offices in foreign countries. They found out about it quickly because they offer a service where they monitor thousands of different areas of the internet looking for patterns in the traffic that resemble attacks and other malicious activity. When they find these patterns they have a highly paid analyst dig into the issue further. Once the analysts have determined exactly what the issue is, they give the information to the customers who have paid to support the service. Along with telling them about the "attack" symantec also gives recommendations on how to deal with the issue.

Tony's analogy is dead on. The service that symantec is providing costs thousands, if not hundreds of thousands of dollars to maintain. Why is it that you think you should be privy to this information, for free, that cost symantec so much money to gather?

If symantec were just to give this information away, they would not be able to continue gathering that data to begin with for much longer, mainly because it would be a situation where they would lose mass quantities of money.

---

Just because you don't understand my perspective, please don't just start claiming I'm making assumptions here...

To clarify my point and to put it a little differantly:

All I'm saying is that; Since Symantec already had the information, AND were already planning on giving it to the public FOR FREE (Like they eventually did) - is that it would of seemed a better PR tactic (IMHO) to give it to the people a few hours earlier then they did so that people could of been prepaired. Instead of after the fact as if to say 'well now that its to late heres the info you needed to-bad for you for not paying us'...

How is it costing them thousands and thousands of dollars to send out a notification that they had PRE-PREPAIRED already - only to send it out a few hours ealier then they did. (Since they already planned on giving it to the public for free anyway)...

(Which btw is why the anology was wrong, although like i did say - I see where his point was coming from, so you don't have to explain it to me... But for it to be accurate Jaguarr would have to both be giving cars to all their paying customers and then going back and giving whats left on the lot to all the non-paying customers - which we all know they don't do)

Which is where my comment came from, that it would only take them a few seconds - as thats all the time it takes to post a pre-prepaired statement that they plan on posting later anyway...

And Yes I know it was 'pre-prepaired' because what they released to the public was nothing more then a copy of the information half of what they did send out to their customers hours and hours earlier... Which again I don't have a problem with them giving MORE of the info to their customers - nor do I have a problem with them giving it to their customers first... As you says thats just part of the business...

RRP

I think if that were the case that nobody would pay for the service. If you know that you- and the rest of the world- are going to get the same information in another 15 minutes or so it might affect your decision to spend tens of thousands of dollars per year to get the information faster.

I can see your point that IF they plan on releasing the information anyway, why not release it earlier when its of more use- but I believe that part of the reason for announcing the data after the fact was to highlight what you COULD have had if you were a paying customer. In other words, a sort of public pat-on-the-back for marketing purposes to say "hey- if you HAD been a paying customer you would have gotten this data in time for it to be useful."

I don't KNOW that- its just a hypothesis. I just think that people getting information for free from companies that invested a lot of money to get it should not complain about how or when they got the information.

If they are going to make more money off of home and small business users they should fix the little issues with NAV2003 and others most likely. If you are forced to resubscribe, follow the link first and then close that box. Then NAV will ask you if you updated your subscription and hit yes. Without even checking your update subsciption status you should have another year of free updates. That should save some of us a wipe and reload of Windows.

Quote:

---

Really shows you how most companies think about money first and then the customers.

---

Welcome to customer service of the 21st century.

Hard to believe that a nine-month old article can cause this much hoo-haw.

I find it hard to understand why someone wants to lay the Slammer at the feet of Symantec. The vulnerability was announced and a patch was available almost a year ahead of the release of the Slammer worm. So, you know where that puts the blame.

That Symantec may have seen or detected some evidence of the worm's travels early on doesn't mean they are responsible for the results. Chances are, they thought most people had patched their systems and were following their standard procedures. Hell, none of the "experts" had a clue how virulent Slammer would become.

An hour earlier or an hour later wouldn't have changed anything for me. My systems were patched. We got probed and a couple student laptops that weren't protected got nailed.

quote :: " Hard to believe that a nine-month old article can cause this much hoo-haw.

I find it hard to understand why someone wants to lay the Slammer at the feet of Symantec. The vulnerability was announced and a patch was available almost a year ahead of the release of the Slammer worm. So, you know where that puts the blame. "

I was in no way trying to blame or trying to hold Symantec Responsible. I just wanted people to read the article and make their suggestions and own opinions. I believe that everyone is allowed to share their opinion. I know that some of you may have been offended by it oh well that's how the world goes... No wonder why there's world always gonna be the way it is ... Never going forward but always going backwards ... But I guess that rapier57 never took into thinking that maybe when people apply patches they dont always work. Patches seem to make fix problems but create more .. As for patches for MS I kinda starting to see a pattern.
1] Vulnerability is found
2] Virus is created to take advantage of the Vulnerability
3] MS finds out about it
4] They create a patch ,, so people lay back thinking all is well
-a] patch works well
-b] patch is total garbage and crashes computer system oh well,, time for backup plan ...
-c] they fix the patch
5] Someone changes the code to the virus
6] And the pattern repeats again and again ...

Ummmm... thats kinda outta order don't you think? Usually vulnerabilities get discovered and thats when patches usually come out. The malware usually comes out a few days... if not week later afterwards when peaple start to study it, it become well known, & then peaple give the source code to exploits for the vulnerabilities so someone can C&P it into worms and things.

I have very rarely (if ever) seen worms and trojans exploit vulnerabilities before a patch has been made.

Thanks for pointing that out TheSpecialist ... Guess I learned something today to do a little more research ... Oops

Quote:

---

Welcome to customer service of the 21st century.

---

I don't think that it is a disease exclusive to the 21st century..

Buy a computer from wallies world then go to Sids Super computers and expect advice on how to use it..
When A retailer (provider of a product or service) offers "Free" advice, It is not free.. never is.. never has been.. "Free" information is given on the expectation that you will buy products and or services from the retailer.. The "Free" information is not the complete and absolute information that you will need.. The guys who have the larger accounts get that info..
Who gets the realy good freebies?.. the customer who spends the most money in the store..
That is known a business!

Quote:

---

If they are going to make more money off of home and small business users they should fix the little issues with NAV2003 and others most likely. If you are forced to resubscribe, follow the link first and then close that box. Then NAV will ask you if you updated your subscription and hit yes. Without even checking your update subsciption status you should have another year of free updates. That should save some of us a wipe and reload of Windows.

---

isn't that what they have done with NAV2004? (only hearsay for me on the PA requirment)

My own suspicion is that Symantec didn't consider the Domestic "multi Use" a serious factor until recently..perhaps they now see the domestic market as comparable to the Comercial market.. ..
do a little bit of maths.. average home compared to business use.. how many pcs in commercial use and in home use... do a then and now.. do the sums guys.. visit your Statisticion on the web.. ..

And remember my earlier comment regarding slammer.. "Who was most vulnerable" I wasn't .. and many of the whiners wern't either

Cheers